CommentaryMarkdown PR reviewLegal
Docs
Legal

Privacy Policy

Effective March 18, 2026Last updated March 18, 2026

This Privacy Policy explains how Commentary collects, uses, and discloses information when people use commentary.dev and related review routes, documentation routes, and support channels.

Commentary is a Git-backed Markdown review product. Public GitHub pull requests can be opened without login for read-only review, while authenticated access unlocks commenting, replies, private repository access, and review submission.

Information we collect

We collect information in a few categories:

  • GitHub account and profile data needed to authenticate you, such as your GitHub user ID, login, granted scopes, and token metadata.
  • Repository, pull request, branch, document, and review metadata needed to render GitHub-hosted Markdown in Commentary and keep review state attached to the right source material.
  • Comments, replies, thread status changes, review summaries, and related app-native review data you create in Commentary.
  • Operational logs and request data such as IP address, browser or device hints, route usage, timestamps, errors, and session identifiers.
  • Cookies and similar technologies, including necessary session cookies and optional tracking cookies when you allow them.

How we use information

We use collected information to operate the service, including to:

  • authenticate users and maintain sign-in state;
  • load public and authenticated GitHub review surfaces;
  • persist review threads, replies, refresh state, and document projections;
  • protect the service against abuse, security incidents, and misconfiguration;
  • measure service reliability and product usage with privacy-safe telemetry; and
  • respond to support, privacy, copyright, and security requests.

Cookies and similar technologies

Commentary uses necessary cookies to keep sign-in and routing flows working. Commentary also plans to use optional session tracking cookies for privacy-safe usage measurement. Those optional cookies remain off unless you accept them through the cookie banner or a later preference flow.

The current cookie inventory, categories, and retention windows are described in the Cookie Policy.

Third-party services and disclosures

Commentary relies on third-party processors and infrastructure providers to deliver the product, including:

  • GitHub for repository, pull request, branch, and authentication data;
  • Microsoft Azure for hosting and operating Commentary infrastructure; and
  • service providers or advisors engaged to support security, legal compliance, or operations.

Commentary may also disclose information when required by law, to enforce product terms, to protect users and the service, or as part of a corporate transaction involving the business or assets behind Commentary.

Retention and deletion

Commentary keeps data for as long as it is reasonably needed to operate the product, maintain review history, resolve disputes, meet security and legal obligations, and improve service reliability.

Authentication tokens and session data are retained only as long as needed for active access, subject to security, operational, and legal requirements. Review data and related repository metadata may remain in Commentary while the corresponding review surface is available or until deletion is requested and approved.

To request deletion or a privacy review, contact privacy@commentary.dev.

Privacy rights and contact

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection with respect to certain personal information.

Commentary will review reasonable requests in light of applicable law, identity verification needs, product security, and the rights of other users or repository owners.

Privacy requests: privacy@commentary.dev
General support: support@commentary.dev