Commentary privacy & data

Provider account and profile data needed to authenticate you, such as GitHub user IDs, Azure DevOps or Microsoft Entra identifiers, logins or display names, granted scopes, and token metadata.

Repository, pull request, branch, document, and review metadata needed to render Git-hosted Markdown in Commentary

Comments, replies, thread status changes, review summaries, and related app-native review data you create in Commentary.

Operational logs and request data such as IP address, browser or device hints, route usage, timestamps, errors, and session identifiers.

We use collected information to operate the service, including to:

protect the service against abuse, security incidents, and misconfiguration

measure service reliability and product usage with privacy-safe telemetry

OAuth state records are retained for up to 1 day.

Expired sessions and expired or revoked provider connections are retained for up to 30 days.

GitHub webhook deliveries are retained for up to 30 days.

Completed or failed background jobs are retained for up to 14 days.

Thread sync events are retained for up to 90 days

Pull request refresh events are retained for up to 30 days.

Deleted Draft Review Sessions are removed from active Commentary storage, including uploaded or pasted draft artifacts, within 24 hours of the deletion request.

Review threads, replies, document projections, and related repository metadata may remain in Commentary while the corresponding review surface is active.

Platform backups may retain deleted data for their normal backup retention window

The current infrastructure and service-provider inventory is listed on the Subprocessors page.

To request deletion or a privacy review, contact privacy@commentary.dev

you may have rights to request access, correction, deletion, restriction, portability, or objection