Signed out, nothing leaves your browser.
Effective date · Version 1.2 · Covers VibeComments 0.2
This policy covers VibeComments — the browser extension for leaving comments on live web pages, the sync service behind it, and this website.
The short version
- Signed out, your comments never leave your browser. They are held in the extension’s own storage area, which the web pages you visit cannot read.
- Signing in is what creates a server-side copy. That is the whole point of an account: a comment has to reach a teammate.
- The extension contains no analytics. No tracking SDK, no third-party scripts, no advertising identifiers.
- We never read the pages you comment on. The extension records the element you selected and the text you typed, not the contents of the page around it.
- We never sell your data. Not now, not later. There are no advertisers to sell it to.
What stays on your device
With no account, everything the extension keeps is stored locally in your browser, in the extension’s own storage area, and is never transmitted:
- Your comments and replies, and their resolved or open status
- Where each comment is anchored: enough about the element and the text around it to find that element again
- A cropped screenshot of the commented element, if element screenshots are enabled in settings
- Your settings
It is kept where the pages you visit cannot reach it, deliberately. Clearing all of it is a single action: Settings → Clear local data. Uninstalling the extension removes it too, and we keep no copy — because while you are signed out we never had one.
What leaves your device
Signed out: nothing. Signing in uploads the comments already on your machine and keeps new ones in sync. From then on we store:
- Comment and reply text, thread structure, and status
- The page URL each thread belongs to, and its anchor
- Element screenshots, where they were captured
- Your account identity, your project memberships and your role in each project
- An audit record of security-relevant actions — creating a project, creating or accepting an invite, removing a member, creating a comment — each with the acting account, a timestamp, an IP address and a browser user-agent string
Authentication is a six-digit code sent to your email address. There is no password to store, and we do not store one.
During the beta, signing in needs an invitation. If you do not have one, you can leave your email address on the sign-in page; we keep it until we invite you or you ask us to remove it.
What is never sent, signed in or out: the contents of the pages you visit. The extension records the element you picked and the words you wrote about it, and nothing else from the page. The only server it talks to is ours; no other site can talk to it.
The website
If you join the early-access list, we store the email address you submitted so we can write to you when a seat opens. It reaches us through this site’s own server, not a third-party form.
This site uses a self-hosted analytics instance that sets no cookies and builds no cross-site profile. It runs on the production domain only, so a preview or a local build sends nothing. It records the page, the referrer and coarse device information; it never receives anything you typed, including your email address. The extension sends it nothing at all — the two are not connected.
The site also notifies us when a page is opened, so we can see interest as it happens: which page, when, and where the visit came from. It goes to our own server and carries nothing that identifies you.
Permissions the extension asks for
A browser shows you this list at install time without explaining it. Here is the explanation.
| Permission | Why it is needed |
|---|---|
activeTab | Act on the tab you are looking at when you open the overlay. |
storage | Hold your comments and settings, as described above. |
tabs | Relay an update to every open tab, so a teammate’s reply appears without a reload, and open the sign-in page. |
alarms | Refresh your session token before it expires. A timer cannot do this: the extension’s background worker is shut down when idle, and an alarm survives that. |
declarativeNetRequest | Rules applied by the browser itself, not by us — the extension declares them and never sees your traffic. |
<all_urls> | Comment on any site. A tool for reviewing your own deploys cannot enumerate their hostnames in advance. Nothing is read or sent from a page until you open the overlay on it. |
Retention and deletion
- Local comments, settings and screenshots: kept until you delete them, clear local data, or uninstall the extension
- Synced comments: kept until you or a project owner deletes them
- Waitlist address: kept until we invite you or you ask us to remove it
- Audit records: kept after an account is deleted, with the account removed from them — what the action was, when, and the IP address and browser it came from stay, because they are the record of what happened to a project
Account deletion is not yet self-service. Email support@vibecomments.com and we act on the request within 30 days and confirm when it is done. Deleting your account removes it, your project memberships and your reactions.
What stays is the work other people rely on. Comments you wrote in a project other members use remain in that project, attributed to “Deleted user”, so the team keeps its discussion. A project you created passes to one of its other members. A project nobody else belongs to is deleted, with its comments. We would rather say that plainly than point you at a button that does not exist.
Your rights (GDPR / CCPA)
- Opt out: do not sign in. The extension works without an account and sends nothing while you are signed out.
- Access and portability: write to support@vibecomments.com from the address on the account and we will send you what we hold within 30 days.
- Correction and erasure: same address, and we act on it within 30 days. What deletion removes, and what stays with a team, is described above.
- Objection: you may object to our processing, and you may complain to your local data protection authority.
- No sale of data. We do not sell personal information and never have.
Store compliance
- Single purpose: leaving comments anchored to elements on a web page, and handing those comments to a coding agent or to a teammate.
- No data sold, ever.
- Third parties: only the services needed to run accounts, email and the database, and only the data each one needs. Analytics is self-hosted and shared with nobody, and the extension does not carry it.
- Everything in transit is encrypted with HTTPS.
Children
VibeComments is a tool for professional software teams and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes to this policy
The product is in alpha and this policy will change with it. The effective date at the top of this page always reflects the current version. A change that materially widens what we collect will be announced by email to account holders before it takes effect, not published quietly.
Contact
Questions, privacy requests, or abuse reports: support@vibecomments.com
See also our Terms of Service.