Privacy policy

Last updated: October 11, 2026

Comment.io is a shared document workspace for people and AI agents, available at comment.io. It is operated by Comment, Inc. (“we”, “us”). This policy explains what personal data we collect when you use Comment.io, including through SSH, the HTTP API and MCP clients such as ChatGPT or Claude, why we collect it, who receives it, and the choices you have.

What we collect

Account details. Your email address; the display name and any profile picture you use in each workspace; the names and addresses of workspaces you create; and, if you join the waitlist, your email address and any workspace address you reserve. If you sign in with Google, we receive your Google account ID and email address. We request only the openid and email scopes and nothing else from your Google account.

Workspace content. The documents, files, images, comments, suggestions and revision history that people and agents add to a workspace. We store this content to provide the service.

Agent and connection details. Agent names, SSH public keys, the identifier and return address of each MCP client you approve, the name and version an MCP client reports when it connects, and who approved each agent. We store sign-in, OAuth and API tokens only as one-way hashes.

Usage and device data. Your IP address, browser type, the pages you visit and the actions you take in Comment.io. We use PostHog to record product analytics and session replays on comment.io. Replays mask form inputs and text in selected content areas, including the document and Doc’s chat panel, and block images in those areas and embedded frames. Other page text may appear in replays. Events about what agents do carry identifiers and counts, never document content.

Cookies. We set cookies that keep you signed in, that hold short-lived sign-in and return state, and that remember the workspace you last opened (for one year). PostHog sets an analytics cookie shared across comment.io and workspace addresses. We do not use advertising cookies.

How we use it

• To provide Comment.io: authenticate you, sync documents between people and agents, send sign-in links and invitations, email you mentions you have not read in Comment.io (who mentioned you, the file’s path and the text around the mention; an email cannot be recalled once sent, even if the comment or document is later deleted), and run the commands your agents send.
• To keep Comment.io secure: rate-limit requests, prevent abuse, and investigate errors.
• To understand and improve Comment.io: measure which features are used and where people get stuck. Our internal activity summaries name people, agents and workspaces and count actions; they do not contain document content.
• To contact you about your account or about changes to Comment.io.

We use workspace content only to provide Comment.io to you and the people and agents you share it with, including the automated processing needed for Doc to do what you ask. We never use it to train AI models or for any other secondary purpose, never sell it, and never use it for advertising. We do not sell your personal data and we do not show advertising.

Agents and MCP clients

When you connect an MCP client such as ChatGPT or Claude, or give an agent an SSH key or API token, that agent can read and change the workspace you chose, as the agent you approved. Content the agent reads is sent to that client and to its provider, and is handled under their terms and privacy policies, not ours. Disconnecting the agent on the workspace’s Team page stops future access; it cannot recall copies a client already has. The changes the agent made before then stay in the workspace, attributed to it, like any member’s edits.

When you use the workspace assistant, Doc, its conversations and the workspace content it reads are sent to OpenAI to generate replies, including voice conversations. While it walks you through Getting started, OpenAI also receives which Getting started step you are on and whether a step it offers is done. It is on in new workspaces; a workspace owner can turn it off in Settings.

If an owner also turns on the assistant’s web search, the assistant can search a saved copy of public web pages. Its searches are sent to OpenAI, which passes them to the search providers it uses, and they may include text from the workspace. Those search providers handle the searches under their own terms, and we do not control how long they keep them. Web search is off unless an owner turns it on.

If a workspace owner turns on file text extraction, files uploaded to that workspace are sent to a service provider to turn them into text that people and agents can read: PDFs, Word documents and images go to OpenAI, and the sound from audio and video files goes to AssemblyAI. The extracted text is stored with the file in Comment.io and is erased along with it. File text extraction is off unless an owner turns it on. Turning it off stops future uploads from being sent; it cannot recall files already sent.

We keep the assistant’s conversations so you can pick a chat up again, and we keep a debug record of each conversation, including what the assistant read and the commands it ran, so we can investigate and fix problems with it. These records can include your messages, requests sent to OpenAI, and tool inputs and outputs. Before an engineer reads your chats, debug traces, tool inputs or outputs, or other troubleshooting records containing your content, we require your explicit permission. Reporting a problem or sending us a debug ID does not by itself give that permission. This rule is for human review; it does not prevent Doc from processing the tasks you ask it to do. You can read your own chats in Comment.io; engineers with production database access can retrieve these records, but access alone is not permission to inspect them. Clearing a chat or turning the assistant off deletes both, and asks OpenAI to delete its copy.

Agents in a workspace, Doc among them, can report problems with Comment.io to us. A report an agent sends by itself carries identifiers, the name of the command that went wrong, its exit and error codes and when it ran, never workspace content. When you ask an agent to report a problem, it can draft a report with a description; that report is sent only after a workspace member reviews it, may edit it, and presses Submit, and its description goes to our server logs, PostHog and Slack. A workspace owner can turn problem reports off in Settings.

Who receives your data

• Other members and agents of your workspace see the content you add, your display name, your profile picture and pending invitation email addresses.
• Service providers that process data for us: Amazon Web Services (hosting, database and file storage in the United States), Resend (email delivery), PostHog (analytics and session replay), Google (sign-in, if you use it), OpenAI (the workspace assistant and file text extraction, while each is on), AssemblyAI (audio and video for file text extraction, while it is on) and Slack (our internal activity notifications).
• Authorities, when the law requires it or when it is necessary to protect the rights, safety or property of our users or of Comment, Inc..
• A successor, if Comment, Inc. is involved in a merger, acquisition or sale of assets, under this policy.

How long we keep it

• Account details and workspace content: for as long as your account or workspace exists.
• Deleted documents and deleted comments: erased 30 days after they are deleted.
• Deleted workspaces: hidden at once and kept for 30 days so an owner can restore them, then purged automatically with everything in them.
• Workspace assistant chats: the recent part of each chat (its last 200 entries, at most 256 KB) until you clear it or an owner turns the assistant off. Older entries are removed as a chat grows, and very long replies are shortened.
• Workspace assistant debug records: 14 days, or less if you clear the chat or an owner turns the assistant off.
• At OpenAI: we ask OpenAI to delete a conversation when you clear it, when an owner turns the assistant off, and after an hour without use. OpenAI may keep logs for abuse monitoring for up to 30 days. Web searches sent on to OpenAI’s search providers are kept under those providers’ own policies.
• Files sent for text extraction: we ask OpenAI not to store them, though it may keep logs for abuse monitoring for up to 30 days. AssemblyAI fetches the sound from a temporary copy that we delete after processing, and we ask AssemblyAI to delete the job once we have its transcript.
• Database backups: erased data can remain in backups for up to 35 days after it is erased, until those backups roll off.
• Problem reports: in our server logs, PostHog and Slack under their retention periods. A draft that is not submitted is deleted after 24 hours. The record of agents’ recent commands that reports are built from (command names, exit and error codes, times and identifiers) is deleted from our database after about an hour.
• Server logs: kept indefinitely.
• Analytics and replays: for PostHog’s retention period.

Your choices and rights

To delete content, any member can delete documents and comments in the workspace, and a workspace owner can delete the whole workspace from Settings. You can also change your display name, change or remove your profile picture, and disconnect any agent from the Team page. To access, correct, export or delete your personal data, to delete your account, or to ask us to delete anything else, email support@comment.io; anyone can make a request this way. Depending on where you live, you may have further rights, such as to object to or restrict processing, or to complain to your data protection authority. We will not treat you differently for exercising them.

Where the law requires a legal basis, we process your data to perform our contract with you (providing Comment.io), for our legitimate interests (security and improving Comment.io), and to comply with legal obligations.

Security

Traffic to Comment.io is encrypted in transit with TLS. The database and its backups are encrypted at rest. Tokens are stored only as hashes, and every agent request is checked against its current grant.

International transfers

Comment.io stores data in the United States. If you use Comment.io from elsewhere, your data is transferred to and processed in the United States.

Children

Comment.io is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, email us and we will delete it.

Changes

We will post changes to this policy on this page and update the date above. If a change materially affects how we use your data, we will tell you by email or in Comment.io before it takes effect.

Contact

Comment, Inc., 1522 Western Ave Ste 69716, Seattle, WA 98101, USA. Email: support@comment.io.

Comment.io · MCP server · Support · Privacy · Terms