Published: 10/04/2026. Last updated: 10/17/2026. In this document: "We" refers to the Commentify service and its operators. "You" refers to you as a Commentify user.
When you create a Commentify account, we collect your name, email address, and profile picture. If you sign up with an email and password, your password is stored in hashed form and we never see it.
When you connect a tool such as Figma, Jira, or Notion, we receive an access token for that account and use it to collect the comments, the names of the files, projects, issues, and pages they belong to, and the names and profile pictures of the people who wrote them. We also use it to post the replies you write and to register the webhooks that keep your comments current. You can revoke a connection at any time in Settings, and with the tool itself.
We keep what you do with your comments in Commentify: the status you give a thread (open or checked), the comments you save, the tags you give them, the replies you send, and the summaries Commentify generates for a thread when you ask for one.
When you connect an AI agent (Claude, ChatGPT, Cursor, and others) to Commentify, we keep a log of each tool call it makes: which tool, when, how long it took, and whether it succeeded. We do not keep the agent's conversation with you, and we do not read anything from the agent beyond the call itself.
Payments for the Pro plan are processed by Stripe. We keep a record of your subscription status and payment history, but we never receive or store your card number.
We keep basic records of how the service is used, such as server logs, to keep Commentify running and to fix problems.
If you choose to sign in with Google, we receive your name, email address, and profile picture from your Google account. We do not request access to Gmail, Google Drive, Google Calendar, or any other Google data.
We use this information only to create your Commentify account, sign you in, and show your name and picture inside the app.
We do not sell Google user data, we do not use it for advertising, and we do not use it to develop, improve, or train AI models. We do not share it with anyone except the service providers listed below that host your account.
Commentify's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove Commentify's access to your Google account at any time from your Google Account permissions.
We use the information we collect to provide Commentify: signing you in, showing the comments from your connected tools in one place, sending the replies you write back to those tools, generating summaries and answering questions about your feedback when you or a connected agent ask, processing payments, and answering your support requests. We do not sell your personal information, we do not use it for advertising, and we do not use your comments to train AI models.
We share information only with the companies that help us run Commentify, and only as far as they need it to do that work.
Stores your account and the data in your workspace, and handles sign-in. See the Supabase Privacy Policy.
Hosts the Commentify website and app. See the Vercel Privacy Policy.
Processes payments. See the Stripe Privacy Policy.
When you use an AI feature such as a thread summary, proofreading, or a question about your feedback, in the app or through a connected agent, the text of the comments involved is sent to OpenAI for processing. OpenAI does not train on data sent through its API. See the OpenAI Privacy Policy.
When you reply to a comment from Commentify, your reply is posted to the tool the comment came from. See the Figma Privacy Policy, the Atlassian Privacy Policy, and the Notion Privacy Policy.
An AI agent you connect receives the feedback it asks for on your behalf, through Commentify for agents (see the guide). What that agent does with it is covered by that agent's own privacy policy. You can revoke an agent at any time in Settings → Agents.
We may disclose information if the law requires us to.
Data is encrypted in transit. Access tokens for your connected accounts are kept on our servers and are never sent to your browser or to a connected agent. Agents sign in with OAuth and a short-lived token you can revoke. No system is perfectly secure, but we use industry-standard practices to protect your data.
We keep your data for as long as your account is active. Removing a team, project, or page removes its comments; revoking a connection removes its tokens; the log of agent tool calls is kept for 90 days. You can ask us to access, correct, or delete your personal information, or to delete your account and the data in it, by emailing support@oneslash.io.
We use cookies that are needed to keep you signed in. We do not use advertising or third-party analytics cookies.
Commentify is not directed to children under 13, and we do not knowingly collect personal information from them.
We may update this Privacy Policy from time to time. When we do, we will change the date at the top of this page.
For any questions about this Privacy Policy or your data, please reach out to us at: support@oneslash.io