Privacy policy

Last updated: October 20, 2026

Comment.io is a shared document workspace for people and AI agents, available at comment.io. It is operated by Comment, Inc. (“we”, “us”). This policy explains what personal data we collect when you use Comment.io, including through SSH, the HTTP API and MCP clients such as ChatGPT or Claude, why we collect it, who receives it, and the choices you have.

What we collect

Account details. Your email address; the display name and any profile picture you use in each workspace; the names and addresses of workspaces you create; and, if you join the waitlist, your email address and any workspace address you reserve. If you sign in with Google, we receive your Google account ID and email address. We request only the openid and email scopes and nothing else from your Google account.

Workspace content. The documents, files, images, comments, suggestions and revision history that people and agents add to a workspace. We store this content to provide the service.

Agent and connection details. Agent names, SSH public keys, the identifier and return address of each MCP client you approve, the name and version an MCP client reports when it connects, and who approved each agent. We store the sign-in, OAuth and API tokens we issue only as one-way hashes.

Connectors. When a workspace owner adds a connector, an outside service such as Linear, we store its address and how people sign in to it, including any app details, secrets or fixed request information the owner enters, which we store encrypted. These stay until an owner changes them or removes the connector; if the workspace is deleted, they stay for its 30-day restoration period and are erased when it is permanently deleted. Disconnecting your own account does not remove them. When you connect to one, we store the key you enter or the sign-in the service gives us, encrypted, and which connectors you are connected to.

Usage and device data. Your IP address, browser type, the pages you visit and the actions you take in Comment.io. We use PostHog to record product analytics and session replays on comment.io. Replays mask form inputs and text in selected content areas, including the document and Doc’s chat panel, and block images in those areas and embedded frames. Other page text may appear in replays. Events about what agents do carry identifiers and counts, never document content.

Cookies. We set cookies that keep you signed in, that hold short-lived sign-in and return state, and that remember the workspace you last opened (for one year). PostHog sets an analytics cookie shared across comment.io and workspace addresses. We do not use advertising cookies.

How we use it

• To provide Comment.io: authenticate you, sync documents between people and agents, send sign-in links and invitations, email you mentions you have not read in Comment.io (who mentioned you, the file’s path and the text around the mention; an email cannot be recalled once sent, even if the comment or document is later deleted), and run the commands your agents send.
• To keep Comment.io secure: rate-limit requests, prevent abuse, and investigate errors.
• To understand and improve Comment.io: measure which features are used and where people get stuck. Our internal activity summaries name people, agents and workspaces and count actions; they do not contain document content.
• To contact you about your account or about changes to Comment.io.

We use workspace content only to provide Comment.io to you and the people and agents you share it with, including the automated processing needed for Doc to do what you ask. We never use it to train AI models or for any other secondary purpose, never sell it, and never use it for advertising. We do not sell your personal data and we do not show advertising.

Agents and MCP clients

When you connect an MCP client such as ChatGPT or Claude, or give an agent an SSH key or API token, that agent can read and change the workspace you chose, as the agent you approved. Content the agent reads is sent to that client and to its provider, and is handled under their terms and privacy policies, not ours. Disconnecting the agent in the workspace’s Settings, under Agents, stops future access; it cannot recall copies a client already has. The changes the agent made before then stay in the workspace, attributed to it, like any member’s edits.

When you use the workspace assistant, Doc, its conversations and the workspace content it reads are sent to OpenAI to generate replies, including voice conversations. While it walks you through Getting started, OpenAI also receives which Getting started step you are on and whether a step it offers is done. It is on in new workspaces; a workspace owner can turn it off in Settings.

While the assistant’s web search is on, the assistant can search a saved copy of public web pages. Its searches are sent to OpenAI, which passes them to the search providers it uses, and they may include text from the workspace. Those search providers handle the searches under their own terms, and we do not control how long they keep them. Web search is on unless a workspace owner turns it off in Settings.

While a workspace’s file text extraction is on, files uploaded to it are sent to a service provider to turn them into text that people and agents can read: PDFs, Word documents and images go to OpenAI, and the sound from audio and video files goes to AssemblyAI. The extracted text is stored with the file in Comment.io and is erased along with it. File text extraction is on unless a workspace owner turns it off in Settings. Turning it off stops future uploads from being sent; it cannot recall files already sent.

When you or an agent import a publicly available web page into a workspace as a document, we may load the page in a browser that Amazon Web Services runs for us, so that text the page’s own scripts add is included. The browser receives the page’s full address, including anything in it such as a sharing or signing key, and loads the page from the site that hosts it. Nothing else from the workspace is sent to it.

We keep the assistant’s conversations so you can pick a chat up again, and we keep a debug record of each conversation, including what the assistant read and the commands it ran, so we can investigate and fix problems with it. These records can include your messages, requests sent to OpenAI, and tool inputs and outputs. Before an engineer reads your chats, debug traces, tool inputs or outputs, or other troubleshooting records containing your content, we require your explicit permission. Reporting a problem or sending us a debug ID does not by itself give that permission. This rule is for human review; it does not prevent Doc from processing the tasks you ask it to do. You can read your own chats in Comment.io; engineers with production database access can retrieve these records, but access alone is not permission to inspect them. Clearing a chat or turning the assistant off deletes both, and asks OpenAI to delete its copy.

When you connect to a connector, Comment.io reads from that service using your own account and only the tools a workspace owner allows for reading data, which start as those the service marks as only reading. It reads when you open an App that shows data from that service, and when you ask Doc, if an owner lets Doc use it. What it reads with your account is shown to you; other people viewing the same App each see what their own account can see. When Doc reads it, it is sent to OpenAI like the rest of your conversation, and Doc can copy it into the workspace when you ask, where other members can see it. The service receives each request made with your account, including any text you or Doc put in it, and handles it under its own terms and privacy policy, not ours.

Agents in a workspace, Doc among them, can report problems with Comment.io to us. A report an agent sends by itself carries identifiers, the name of the command that went wrong, its exit and error codes and when it ran, never workspace content. When you ask an agent to report a problem, it can draft a report with a description; that report is sent only after a workspace member reviews it, may edit it, and presses Submit, and its description goes to our server logs, PostHog and Slack. A workspace owner can turn problem reports off in Settings.

Who receives your data

• Other members and agents of your workspace see the content you add, your display name, your profile picture and pending invitation email addresses.
• Service providers that process data for us: Amazon Web Services (hosting, database, file storage, email delivery and loading web pages imported as documents, in the United States), PostHog (analytics and session replay), Google (sign-in, if you use it), OpenAI (the workspace assistant and file text extraction, while each is on), AssemblyAI (audio and video for file text extraction, while it is on) and Slack (our internal activity notifications).
• Services you connect to, such as Linear, receive the requests made with your account and handle them under their own terms.
• Authorities, when the law requires it or when it is necessary to protect the rights, safety or property of our users or of Comment, Inc..
• A successor, if Comment, Inc. is involved in a merger, acquisition or sale of assets, under this policy.

How long we keep it

• Account details and workspace content: for as long as your account or workspace exists.
• Connector keys and sign-ins: until you disconnect, you leave the workspace, the workspace is deleted, or an owner removes the connector or replaces or removes the app people sign in with. We also remove one when a later request shows it no longer works; ending access at the outside service does not by itself erase our copy.
• What a connector returns for an App: kept in our servers’ memory, separately for each person, and shown again for up to an hour. It is not saved to our database, though it can stay in memory longer until it is replaced or the server restarts.
• Deleted documents and deleted comments: erased 30 days after they are deleted.
• Deleted workspaces: hidden at once and kept for 30 days so an owner can restore them, then purged automatically with everything in them.
• Workspace assistant chats: the recent part of each chat (its last 200 entries, at most 256 KB) until you clear it or an owner turns the assistant off. Older entries are removed as a chat grows, and very long replies are shortened.
• Workspace assistant debug records: 14 days, or less if you clear the chat or an owner turns the assistant off.
• At OpenAI: we ask OpenAI to delete a conversation when you clear it, when an owner turns the assistant off, and after an hour without use. OpenAI may keep logs for abuse monitoring for up to 30 days. Web searches sent on to OpenAI’s search providers are kept under those providers’ own policies.
• Web pages imported as documents: the imported text is kept like any other document. Amazon Web Services keeps a record of each browser session it runs for us, which can include the page’s address, for up to 30 days.
• Files sent for text extraction: we ask OpenAI not to store them, though it may keep logs for abuse monitoring for up to 30 days. AssemblyAI fetches the sound from a temporary copy that we delete after processing, and we ask AssemblyAI to delete the job once we have its transcript.
• Database backups: erased data can remain in backups for up to 35 days after it is erased, until those backups roll off.
• Problem reports: in our server logs, PostHog and Slack under their retention periods. A draft that is not submitted is deleted after 24 hours. The record of agents’ recent commands that reports are built from (command names, exit and error codes, times and identifiers) is deleted from our database after about an hour.
• Server logs: kept indefinitely.
• Analytics and replays: for PostHog’s retention period.

Your choices and rights

To delete content, any member can delete documents and comments in the workspace, and a workspace owner can delete the whole workspace from Settings. You can also change your display name, change or remove your profile picture, disconnect any agent in Settings, under Agents, and disconnect from any connector in Settings, under My Connectors. To access, correct, export or delete your personal data, to delete your account, or to ask us to delete anything else, email support@comment.io; anyone can make a request this way. Depending on where you live, you may have further rights, such as to object to or restrict processing, or to complain to your data protection authority. We will not treat you differently for exercising them.

Where the law requires a legal basis, we process your data to perform our contract with you (providing Comment.io), for our legitimate interests (security and improving Comment.io), and to comply with legal obligations.

Security

Traffic to Comment.io is encrypted in transit with TLS. The database and its backups are encrypted at rest. Tokens we issue are stored only as hashes, keys and sign-ins for connectors are stored encrypted and used only on our servers, and every agent request is checked against its current grant.

International transfers

Comment.io stores data in the United States. If you use Comment.io from elsewhere, your data is transferred to and processed in the United States.

Children

Comment.io is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, email us and we will delete it.

Changes

We will post changes to this policy on this page and update the date above. If a change materially affects how we use your data, we will tell you by email or in Comment.io before it takes effect.

Contact

Comment, Inc., 1522 Western Ave Ste 69716, Seattle, WA 98101, USA. Email: support@comment.io.