Privacy Policy

Who is responsible for what

Commentware (“we”, “us”) runs this website and publishes the software. What this website and its registry handle is ours to answer for, and this policy says all of it.

The server is yours. It runs on a machine you choose, and what it stores never reaches us, so you decide what happens to it — and when you run a server for other people, you answer to them for it. What the software stores, and what it sends, is in What Commentware stores.

Invite codes

Checking an invite code sends no code anywhere. The site downloads the list for the code’s batch — its first four characters, which are in that list’s address — and compares in your browser. Signing out removes the code and the acceptance.

The installer does the same on your machine. It asks for the code on its first run, downloads the list for the code’s batch from this website, compares there, and keeps the code in the file ~/Commentware/invite. Every later run checks the kept code again, so this website sees the batch’s first four characters in the address of that download on every install and update, and nothing else about the code. Deleting the file removes the code.

What this website keeps in your browser

This website sets no cookies of its own. It keeps these in your browser, for that browser profile only, and sends none of them anywhere:

• The invite code you entered, so the pages behind the code let you in, and so the Account page can show it to you.
• That you accepted the terms and this policy, so you are asked once.
• The package manager you picked, so every command on the site is shown in its spelling.
• Which groups of the docs sidebar are open, so they stay open as you move between pages, until the tab is closed.

Emails you send us

An email you send us is kept to answer it, and is not used for anything else.

Sending feedback — a bug report or a feature request — opens an email in your own mail program. The form on the lounge and the Account page writes it to support@commentware.com with what you wrote and your invite code in it. Nothing is sent until you send that email, and we keep it for as long as we need it to answer the feedback.

Hosting and the registry

The website and the package registry are hosted on Cloudflare, which sees each request as any host does: the address it came from, the time and the browser’s User-Agent. The registry has an address of its own, and this website’s /registry passes requests on to it. Requests to the registry, at either address, run through a program there, and Cloudflare keeps the logs of those requests for three days. There is no analytics and no tracking on any page.

The installer asks nodejs.org, which is not us, for a file only when it downloads Node.js: when it sets up a server and finds no Node.js to run it on (it asks first when it has a terminal to ask on), or when it moves its own copy of Node.js to a newer version on an update. It sends no code and no key; nodejs.org sees the address, the time, and a User-Agent naming the installer and its version.

This site never sees your server or your key. Connection strings and permalinks put both after the #, and a browser does not send a fragment anywhere — not in the request line, not in a log, not in a Referer header.

The extension’s version check

The extension makes one request of its own, to the package registry. Once a day it asks the registry which version of the extension is newest, so it can tell you when yours is behind. It is a plain GET of a public file, with no access key, no cookie, no referrer and no server address in it, so the registry learns what any web request shows — the address it came from, the time, Chrome’s User-Agent and the extension’s own chrome-extension:// origin — and nothing about which server you use or what you comment on. It is made whether or not notifications are on. Older versions of the extension ask this website’s /registry instead, which passes the request on to the registry, so both see it.

Your rights

What we can tie to you is an invite code, an email you sent us, and three days of registry logs. Write to support@commentware.com to ask what we hold about you, to correct it or to have it deleted. What is on a server is with whoever runs that server, not with us.

Changes to this policy

When what the website or the software stores or sends changes, this policy changes with it, and the date at the top of this page says when it last did. The terms of service say what continuing to use them means.

Contact

Write to support@commentware.com with any question about this policy.