Privacy Policy

This Privacy Policy describes how Comment Monster Inc.(“we,” “us,” “our”), operator of CommentMonster (commentmonster.tech and app.commentmonster.tech), collects, uses, stores, and shares information about you when you visit our website, create an account, or use the CommentMonster product.

1. Information we collect

Account information

When you sign up at app.commentmonster.tech/signup we collect:

• Email address (used as your login identifier and to send account + service emails).
• Name and avatar URL if you sign in via Google or Facebook (supplied by the provider).
• Password hash if you sign up with email and password. We never store passwords in plaintext - they are hashed with PBKDF2 using a per-user salt before storage.
• Provider identifiers- Google “sub” and Facebook user ID - when you sign in via OAuth, so we can recognize your account on subsequent sign-ins.
• Optional phone number if you enable SMS-verified push notifications. We store it after SMS one-time-code verification completes.

Connected channel information

When you connect a YouTube channel, Facebook Page, Instagram Business account, TikTok, or X account, we receive and store:

• The channel / Page / account ID, display name, and profile picture URL provided by the platform.
• OAuth access and refresh tokens issued by the platform so we can read comments and post replies on your behalf. Tokens are encrypted at rest using AES-256-GCM with a key held only on our server infrastructure.
• The list of OAuth scopes you granted and the date the channel was connected.

Content data

To deliver the core service we periodically fetch and store:

• Comments left on your connected channels (text, author display name, author ID, timestamp, and the post or video they were left on).
• AI-drafted replies we generate for those comments (the draft text, which model produced it, token counts, your edits if any, and the final reply we posted on your behalf after your approval - or automatically, if you have auto-mode enabled).
• Voice-profile examples - the comment-and-reply pairs you upload or that we auto-capture from your past activity - used to make future drafts sound like you.

Usage and security data

We log information about how you use the product for security and operational purposes:

• Sign-in events (IP address, user agent, success / failure, MFA used), session tokens, and audit-log entries for sensitive actions such as password changes, MFA enable / disable, channel connections, reply approvals, account deletion requests.
• Notification preferences (which event types you want delivered in-app, via email, or via push), Telegram bot link if you set one up.
• Subscription tier, trial end date, and Stripe customer ID once billing is configured.

Site analytics and anti-abuse

On the marketing website we use Google Analytics 4 to measure aggregate traffic. GA4 sets cookies and collects device, browser, referrer, and interaction data with IP anonymisation enabled. We use Cloudflare Turnstile on the sign-up and login forms to prevent automated abuse; Turnstile may collect limited technical signals to verify you are human.

2. How we use your information

• To operate the CommentMonster service - authenticate you, identify the channels you manage, fetch comments, draft and post replies, and deliver notifications.
• To send transactional email - account verification, password reset, team invites, notification fan-out, billing receipts. We never use your account email for marketing.
• To enforce per-tier usage limits, monitor for abuse, and recover from errors.
• To improve the service - aggregate, de-identified usage analytics that cannot be tied back to a specific account.
• To comply with legal obligations and respond to lawful requests from public authorities.

3. Legal basis (GDPR)

Where GDPR applies, we rely on:

• Contractual necessity for the data we need to deliver the service you signed up for (account credentials, OAuth tokens, comments, replies, billing data).
• Legitimate interest for security logging, fraud and abuse prevention, and aggregate analytics.
• Consent for marketing analytics (GA4) and optional features such as SMS / push notifications. You can withdraw consent at any time.

4. Sharing

We do not sell your personal data. We share data with the following service providers strictly to deliver the service:

• Cloudflare, Inc. - hosting, edge compute, database (D1), caching, transactional email DMARC, and bot protection. All account and content data is stored on Cloudflare infrastructure.
• Anthropic, PBC - generates AI reply drafts. We send comment text, channel context, and your voice-profile samples; Anthropic does not train on this data.
• Resend, Inc. - delivers transactional email (account verification, password reset, team invites, notification emails). Receives recipient email + display name only.
• Stripe, Inc. - payment processing once you upgrade past the trial. Receives email + name + payment method details that you submit directly to Stripe on their hosted checkout page.
• Amazon Web Services, Inc. - SMS one-time-codes for optional phone verification (via SNS Publish). Receives only the phone number and the code body.
• Google LLC and Meta Platforms, Inc. - we call their public OAuth and platform APIs to read your comments and post the replies you approve. We do not share data with them beyond what their APIs require to fulfil your requests.
• Telegram FZ-LLC - optional push delivery if you link our Telegram bot. Receives only the notification text + your Telegram chat ID.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect our rights or the rights of others.

5. Data retention

We retain your account data and connected-channel data for as long as your account is active. When you delete your account (Settings → Danger zone → Delete account):

• Your account is soft-deleted immediately and becomes unusable. You have a 30-day grace period during which logging back in cancels the deletion.
• After day 30, we permanently purge your user record, organization, connected channels, comments, drafted replies, voice profiles, MFA secrets, recovery codes, sessions, and notification preferences.
• Some records may persist briefly in encrypted backups (rotated within 35 days) and in invoice / tax records we are legally required to retain.

Public deletion instructions also live at www.commentmonster.tech/data-deletion/ for users who can no longer log in. Analytics data is retained per Google Analytics defaults (14 months).

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to processing or withdraw consent. To exercise any of these rights, email hello@commentmonster.tech from the address on your account. We respond within 30 days.

7. Cookies and similar technologies

We use:

• Session cookies on the app subdomain to keep you signed in. These are HTTP-only, Secure, and SameSite-Lax.
• Analytics cookies on the marketing site (GA4). You can opt out by blocking cookies in your browser or by declining the cookie banner where shown.
• Anti-abuse cookies set by Cloudflare Turnstile during human-verification challenges.

8. Security

We protect your data with encryption in transit (TLS 1.2+), encryption at rest for OAuth tokens (AES-256-GCM), hashed passwords (PBKDF2 with per-user salt), optional TOTP-based two-factor authentication, and session revocation. No system is perfectly secure; please use a strong unique password and enable 2FA.

9. International transfers

Our service providers process data in the United States, the European Union, and other regions. Where we transfer personal data of EU / UK residents outside those regions, we rely on Standard Contractual Clauses or equivalent safeguards.

10. Children

CommentMonster is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has signed up, contact us and we will delete the account.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the current version. Material changes will be notified by email or in-product banner.

12. Contact

Comment Monster Inc.
30 River Road, New York, NY 10044, USA
hello@commentmonster.tech