Privacy Policy

1Who is responsible

The short version. We collect what the product needs to work: an email address to sign you in, a birth date to check you are old enough, what you post, and how your posts perform. We do not sell personal data. You can download your data or schedule your account for deletion yourself, from inside the app, without asking anyone.

Apps I Think operates commentrs and decides how the data described here is used. For a privacy request, open a ticket at Support inside the app, or write to support@commentrs.com. A person reads both, and a request sent by either route is valid.

2What we collect

2.1What you give us

Account. Email address and password (stored only as a hash by our authentication provider, never in readable form), handle, display name, bio and avatar.

Birth date. Required at signup to enforce the minimum age of 13. See section 7.

Age verification. Only if you choose to verify your age (Settings → Age verification): Didit records a short selfie video on its own pages and estimates your age from it. Only if you say the estimate is wrong and choose to verify with an identity document instead does Didit ask for a photo of the document, which it matches to a new selfie. We receive an age band (under 13, 13 to 15, 16 or 17, or 18 and over) and the status of the check. We never receive the video, an image, the document, its details, the estimated age or a face template. See section 7.

Content. Videos, photo carousels, sounds, stories, live broadcasts, comments, direct messages and group messages.

Settings. Your privacy, content, notification and region preferences, muted words, blocks and mutes.

Business verification. Company and partnership data provided by users for business verification purposes is processed. When you apply for a business account you give us the company's legal name, its country of registration, its registration number, optionally its entity type and website, and a company email address that you confirm with a code. The rest of the company check, the record in the official company register, the directors and beneficial owners you add, their identity checks and any company document, is collected by Didit on its own pages (section 5). We receive only the outcome: approved, declined or in review.

Applications and claims. Copyright claims and the evidence documents attached to them, support tickets, reports and appeals.

Job applications. If you apply through "I want to work on Commentrs" (open to verified adults only): the role you choose, what you write about yourself and your experience, any links you add, and where and when you could start. We read it together with your handle, the email on your account and your country.

2.2What is generated as you use the platform

Performance data. Views, unique viewers, watch time, completed plays, likes, traffic source and approximate viewer country, per clip and per account.

Wallet activity. Coms and Diamond balances, purchases, tips sent and received, promotions bought, and withdrawal records.

Safety signals. The outcome of the automated checks in section 4, reports filed against content, warnings, and your account standing score, and, for a direct message that is checked automatically (section 4), whether it was delivered or stopped and why.

Technical data. IP address, approximate region derived from it, device and browser characteristics, and push notification subscriptions.

2.3What we deliberately do not do

We do not sell personal data, and we do not share it with data brokers.

We never tell a creator who watched. Viewing is anonymous to the creator, to other users and in every export. The only viewer identity a creator sees is the list of accounts that liked a video, which is a public act.

Small audiences are suppressed, not rounded. Demographic breakdowns hide any bucket below five people, because a breakdown of a small audience identifies individuals.

We do not store card numbers or bank details. Payment credentials are entered on the payment provider's own pages and never reach our servers or our database.

3Why we use it

Purpose: Running your account and delivering the feed, messages and live streams. Data used: Account, content, settings. Basis (GDPR): Performance of a contract.

Purpose: Age assurance. Data used: Birth date, hashed IP. Basis (GDPR): Legal obligation.

Purpose: Age verification, and the rules for accounts under 18. Data used: The age band and status from Didit, your birth date, your country, and the note an automatic message check makes when a message says its sender is under 18. Basis (GDPR): Legal obligation to protect minors; legitimate interests in keeping minors safe and payments lawful; for the face check itself, your explicit consent, which you give by starting it.

Purpose: Checking direct messages before delivery, when someone in the conversation has not verified their age or may be under 18. Data used: The message and its attachment, up to eight earlier delivered messages in the same conversation, and whether each person is a verified adult or may be under 18. Basis (GDPR): Legitimate interests in protecting minors from sexual content, grooming and scams; legal obligation where the law requires it.

Purpose: Deciding copyright claims about music. Data used: The claim and its document, and ACRCloud's identification of the music in the claimed sound. Basis (GDPR): Legal obligation to act on copyright notices; legitimate interests in removing infringing material and refusing false claims.

Purpose: Payments, Coms purchases and creator payouts. Data used: Wallet activity, processor identifiers. Basis (GDPR): Performance of a contract.

Purpose: Screening purchases and payouts for fraud and money laundering. Data used: The payment or payout itself (amount, currency, what it was for, our reference), your account identifier, the name you gave at checkout, on your profile or on your payout details, your country and the country of the card or account used, the IP address of an in-app purchase, and a keyed pseudonym standing in for the bank account or email a payout goes to. Basis (GDPR): Legitimate interests in preventing fraud, money laundering and payouts to stolen or borrowed accounts.

Purpose: Safety, moderation and fraud prevention. Data used: Content, safety signals, technical data. Basis (GDPR): Legitimate interests; legal obligation.

Purpose: Ranking and recommending content. Data used: Performance data, region, interaction history. Basis (GDPR): Legitimate interests.

Purpose: Verifying business accounts. Data used: The company and partnership data given for business verification, and the outcome of the company check. Basis (GDPR): Performance of a contract, the business account you applied for; legitimate interests in preventing fraud and the impersonation of companies.

Purpose: Considering your job application. Data used: The application, your handle, account email and country. Basis (GDPR): Steps taken at your request before entering into a contract.

Purpose: Notifications you have switched on. Data used: Push subscription, notification preferences. Basis (GDPR): Consent.

Where the basis is consent, push notifications, and the camera and microphone permissions used for recording and live streaming, you can withdraw it at any time in Settings or in your browser's site settings, without losing access to the rest of the platform.

4Automated checks

Some decisions are taken automatically, because a person cannot review every upload before it is seen:

Uploads pass an automated safety review. A clip is visible to you immediately and to others once it passes.

Comments containing terms blocked for your region, or terms a creator has filtered, are refused as they are written rather than hidden afterwards.

Copyright claims about a sound are checked automatically in two steps. The document: can it be read, is it real proof of ownership, does it name the claimant. Then the music: ACRCloud identifies the recording in the sound and it is compared with the work claimed. An unreadable document is sent back once; a plainly wrong document, or a sound ACRCloud identifies as a different song, rejects the claim with the reason; a match with the claimant as the artist or label on record takes the sound down. Everything else goes to a person.

What is said on a live stream is transcribed as it is said, to show captions (which every viewer can switch off) and so that an AI model can read the transcript against the Community Guidelines. A clear, serious violation pauses the stream until a person reviews it; nothing is ended or struck automatically.

Direct messages in a conversation where someone has not verified their age, or may be under 18, are read by an AI model before they are delivered. It looks for sexual content, grooming and other risks to minors, threats, harassment and scams. A message it stops is not delivered and its sender is told why; a message that points to a child being at risk is also reviewed by a person. If a message says its sender is under 18, the sender's account is treated as under 18 until an age check says otherwise. If the model cannot answer, the message is not delivered unchecked: it is tried again, and stopped after three attempts.

Age verification is automated by Didit: an age estimate from a selfie video and a check that a live person is present. If you say the estimate is wrong, you can verify with an identity document instead, which Didit matches to your face; your age then comes from the document. A failed check can be tried again.

Spam, bot activity and VPN or proxy use are detected automatically and may lead to review or suspension.

Every purchase and every payout is screened by Didit, our transaction-monitoring provider, before the money moves. A purchase it declines is not credited and is refunded. A payout is sent only once Didit approves it; one it holds for review, and any payout while one of your own purchases is still being reviewed, waits until the review ends, with your Coms reserved rather than taken. Didit may ask you to finish a short check on its own pages first, and we send you the link when it does.

The content and message checks use a third-party AI model, the payment and age checks use Didit, and music identification uses ACRCloud (see section 5). Every automated outcome can be appealed to a person, appeals are free whatever the result, and the reason for the decision is stated rather than withheld. Your account standing, every warning on it, and what each one was for are shown at Settings → Account standing.

5Who else processes it

Provider: Supabase. Function: Database, authentication, file storage, realtime. What it receives: Account, content, settings, wallet, the primary data store.

Provider: Netlify. Function: Website hosting and content delivery. What it receives: Request metadata, including IP address.

Provider: Polar. Function: Payment processing for Coms, Pro and promotions. What it receives: Payment details, entered on Polar's own pages; email address.

Provider: LiveKit. Function: Live video and audio transport, and speech to text for live captions (LiveKit's own service, which uses Google's Gemini transcription model). What it receives: Stream audio/video and connection metadata while broadcasting, including the speech of the host and guests for captions.

Provider: Google (Gemini). Function: Automated content, copyright and support checks, the live speech check, the check on direct messages described in section 4, and writing what Commentrs starter accounts say (Terms, section 15). What it receives: The specific content or document being checked; the transcript of a live stream; a direct message being checked, with its attachment and up to eight earlier messages of the same conversation, and whether each person is a verified adult or may be under 18, but no names, handles or account identifiers; and, when you comment on a starter account's video or reply to one of its comments, your comment, so it can write the reply.

Provider: ACRCloud. Function: Identifying commercial music in the videos you publish, so that music we are not licensed to show in a country can be handled under our Copyright policy. What it receives: A link to each video you publish, valid for six hours, which it downloads to fingerprint the audio. It sends back which recordings it heard and for how long. For a copyright claim about a sound, it receives a six-hour link to that sound's audio file in the same way. It receives no account details.

Provider: Didit. Function: Age verification, business verification (know your business) for business account applications, and transaction monitoring of purchases and payouts. What it receives: For age verification, on its own pages, a short selfie video and, only if you dispute its age estimate and choose to verify with an identity document, a photo of that document and a second selfie; from these it estimates your age, checks that a live person is present, matches the document to the face, and checks whether the same face was used for another account. We receive only the age band and the status, and as soon as the check is decided we have Didit delete the whole session (section 7.1). For a business application, the company's legal name, country of registration and registration number, from us; on its own pages, the official register record, the directors and beneficial owners you add and their identity checks, and any company document it asks for. Didit may screen the company and those people against sanctions and anti-money-laundering lists, and tells us only whether the company was approved, declined or put in review. For each purchase and payout, from us: the amount, currency, what it was for and our reference, your account identifier, a name (the one given at checkout, on your profile or on your payout details), your country and the card's or account's country, the IP address of an in-app purchase, and a keyed pseudonym in place of the bank account or email a payout goes to, never the account number or the address itself. It answers approved, in review, declined or waiting for you, with a risk score. Didit keeps what it collected under its own privacy policy.

Provider: GIPHY. Function: The GIF picker in the comment box. What it receives: What you type into the GIF search, and your IP address, when you open that picker. A GIF is never copied to us; we store the link, so a comment containing one loads from GIPHY later too.

Provider: OpenStreetMap Foundation. Function: Map tiles and place name search for location attachments. What it receives: Your IP address and the part of the map you are looking at, while a map is open, plus what you type when searching for a place. A map inside a comment is a card that fetches nothing until you tap it.

Provider: YouTube (Google). Function: Playing a YouTube link somebody attached to a comment. What it receives: Your IP address and which video you played, when you press play. We use the no-cookie form of the embed and it is click to load, so nothing reaches YouTube unless you start the video.

Provider: Browser push services. Function: Delivering notifications when the app is closed. What it receives: An encrypted payload they cannot read, plus your subscription endpoint.

Provider: Phone push services: Expo, Google Firebase Cloud Messaging and the Apple Push Notification service. Function: Delivering notifications to the Commentrs phone app when it is closed, only on a phone where you switched them on. What it receives: The notification's text (for example "@someone liked your clip"), the screen it opens, and that phone's push token. Unlike browser push, the text is not end-to-end encrypted on its way through these services, which is why push stays off until you turn it on.

Provider: Resend. Function: Sending account emails: the one-time code for email two-step verification, and the code that confirms a business account's email address. What it receives: Your email address and the email itself.

We use a small number of service providers. Each receives only what its function requires, and none of them is permitted to use your data for their own purposes.

The last three in that list differ from the others in a way worth stating plainly: they are reached by your own browser when you use a particular feature, rather than by us on your behalf. That is why each is described with the thing that triggers it. None of them runs on page load, none of them runs a script on our pages, and the Cookies and Local Storage policy lists them again alongside what your device stores.

These providers operate internationally, so your data may be processed outside your country, including in the United States. Transfers out of the EEA and the UK rely on the European Commission's Standard Contractual Clauses.

6What other people can see

Public by default: your handle, display name, avatar, bio, follower and following counts, public posts and the comments you leave on them.

Private posts are served through short-lived signed links and are not readable by other users.

Direct messages are visible to the participants and, where a message is reported, to the reviewer handling that report.

Business lead forms: anything you submit to one is readable by that business and by the team members it has granted the "leads" permission. Deleting a lead form does not delete submissions already collected.

7Age, accounts under 18, and age verification

You must be at least 13 years old to use Commentrs, and older where the law of your country sets a higher minimum (in Australia, for example, 16). The platform is not directed at children under 13 and we do not knowingly collect their personal data.

Signup asks for a birth date. If the date entered is under 13, the attempt is recorded against a hashed fingerprint of the device and network so the same visitor cannot simply restate their age to get through. We store a hash computed with a per-installation secret, not the IP address itself, so a copy of that table is not a list of IP addresses. It is an age gate that asks nobody for identity documents.

7.1Age verification, and what happens to your face

Verifying your age is optional. It is what unlocks going live, buying, sending and receiving Coms, and direct messages without an automatic check (Terms, section 16). It is a face check run by Didit on its own pages: a short selfie video from which it estimates your age and confirms that a live person is present, and, only if you say the estimate is wrong and choose to verify with an identity document, a photo of that document that it matches to your face. Starting either check is your explicit consent to that processing of your face.

What we keep: the age band (under 13, 13 to 15, 16 or 17, or 18 and over), the status of the check and its dates, for as long as your account exists. What we never receive: the video, any image, the document or its details, the estimated age, or a face template.

What Didit keeps: nothing, once the check is decided. At that moment we tell Didit, through its API, to delete the whole session, which removes every image and video, the extracted data and the face template, permanently. A check that is started and never finished is deleted eight days after it was opened. A check that Didit sends to its own human review stays with Didit until the review ends and is then deleted the same way. If a deletion fails it is retried every hour, and in every case the session is gone within 30 days of being opened.

This is our written policy for biometric information, including for the purposes of the Illinois Biometric Information Privacy Act and the laws of Texas and Washington: face data is collected only by Didit, only for the age check you start, is never sold, leased, traded or used for anything else, and is permanently destroyed on the schedule above.

7.2Accounts under 18

An account is treated as under 18 when the age check says so; without an age check, when its sign-up birth date says so; and when an automatically checked message said its sender is under 18, until an age check says otherwise.

Under 18: direct messages only with people you follow and who follow you back, and every one of them, sent or received, is checked automatically before it is delivered (section 4); no hosting live streams; no buying, sending or receiving Coms, and no cashing out. The rules of your country can add more, such as a higher minimum age or no direct messages at all, and the Terms (section 16) say how they apply. Age Rules by Country lists every country and why.

A parent or guardian can ask us to see, correct or delete the account of a child under 18 by writing to support@commentrs.com. We will ask only for enough to confirm the relationship.

If you believe a child under 13 has created an account, report it from Support or write to support@commentrs.com and we will remove it.

8How long we keep it

While your account is open: for as long as you keep it, since it is the account.

After you delete your account: 30 days, then permanent erasure. See section 9.

Content archived on an upheld copyright claim: deleted after 3 days, unless the uploader objects, which freezes the clock while a person reviews it.

Transaction records: 7 years, which is the longest retention the tax authorities we operate under require. Read section 8.1, after your account is deleted these records no longer contain your name, your email address or your handle.

Business applications: kept with the account. Switching a business account back to a personal one deletes the application outright, and deleting the account deletes it with everything else after 30 days. Didit keeps the company check under its own retention policy.

Payment screening results: the verdict, its score and Didit's reason code for each purchase or payout, kept for as long as the transaction record they belong to, and like it they no longer point to your account once it is deleted. Didit keeps its own copy under its own retention policy.

Live stream transcripts: 30 days after the words were spoken, then deleted automatically. If the automatic check flags a stretch, a short quote of it is kept with the moderation record, for the reviewer and for your appeal.

Age verification: the age band, the status of the check and its dates, for as long as the account exists. The face check itself is deleted at Didit as described in section 7.1.

Job applications: 12 months from when you send one, then deleted automatically; read only by the owner of Commentrs.

Direct messages stopped by the automatic check: kept like any other message, visible only to their sender, who can delete them. The record that a message was stopped, with the reason and the kind of risk but not the text, is kept for 180 days.

The note that a checked message said its sender is under 18: until an age check says otherwise, or the account is deleted.

Moderation records: 12 months after your account is deleted, then erased automatically. Longer only for the two categories where the law requires a referral record to survive, content involving children, and terrorism, and those are retained to the period the relevant authority specifies, not indefinitely. Read section 8.2 for what a retained moderation record actually consists of, which is not a profile of you.

8.1What we do so that a deleted account cannot be leaked

There is a real problem underneath this section and it deserves stating plainly rather than being hidden behind "as required by law". If we keep financial and moderation records after you leave, then a future breach of this company exposes data about a person who is no longer a user and cannot do anything about it. Deleting your account would not protect you from our mistake. That is a fair criticism and the answer is not to promise better security; it is to make sure the retained records are not worth stealing.

So deletion does not merely stop at the financial rows. It rewrites them. At the end of the 30 days we pseudonymise every record that has to survive: your name, email address, handle, profile text, IP addresses, device identifiers and payment-method details are erased from them, and what remains is an opaque internal reference plus the facts accounting law actually asks for, the amount, the currency, the date, the tax jurisdiction and the invoice number.

This is the whole trick, and it works because tax law requires the transaction, not the taxpayer's social media profile. A revenue authority auditing us needs to see that a payment of a given size happened on a given date in a given jurisdiction and was accounted for. It does not need to know which handle made it. A leak of the pseudonymised ledger therefore discloses a list of amounts and dates attached to reference numbers that resolve to nobody, because the table that could resolve them was deleted with your account.

Two limits on that promise, because a policy that overclaims here is worse than one that does not claim at all. First, if a specific payment is under an open dispute, chargeback, fraud investigation or legal order when you delete, that one record keeps its identifying details until the matter closes, we cannot answer a chargeback about a payment we can no longer identify, and it is pseudonymised as soon as it does. Second, your payment provider keeps its own records under its own policy; we do not control them, and deleting your Commentrs account has no effect on what Polar or your bank holds.

8.2What a retained moderation record is, and what it can never do

The second fair criticism is about starting again: if we remember the device and the identifiers behind a removed account, then you can never open a genuinely fresh one, and we could quietly hold your past against a new account you open years later.

What a retained moderation record contains after deletion is a salted one-way hash and nothing else, no address, no device string, no email, no readable identifier of any kind. The salt is held separately from the hashes. A hash of that shape can answer exactly one question, "is this the same value as one on the list", and it cannot be read backwards into an identity, cannot be joined to anything on another platform, and cannot be assembled into a profile of a person. If it leaks, it leaks a column of meaningless strings.

We also bind what that answer may be used for:

Only to enforce a live permanent ban. A match blocks the creation of an account by someone who is currently permanently removed for the reasons in section 6.3 of the Terms, child safety, terrorism, attacks on our systems, fraud. Nothing else produces a retained hash at all: an ordinary strike, a suspension that has expired, a refused copyright claim and a closed report leave nothing behind once the account is gone.

Never to grade a new account. A new account never starts with reduced standing, reduced reach, a lower ranking or hidden restrictions because of a hash match. There is no shadow score. Either the account is blocked outright, with a reason, and you can appeal it, or it is treated as what it is, a new account.

Never for advertising, ranking or recommendation. This data is not available to those systems and is not in the same store as them.

It expires. 12 months from deletion for everything except the two legally mandated categories above. "While relevant to platform safety" used to be the rule here, and an open-ended condition that we ourselves assess is not a retention period at all.

Records that outlive an account live in a restricted store that ordinary staff tooling cannot query, and each access is logged and attributable. If you want to know whether anything at all is retained about you after a deletion, ask at Support, we will tell you, and we will tell you when it expires.

9Your rights, and the buttons that exercise them

Depending on where you live you have rights under the GDPR, the UK GDPR, the CCPA/CPRA or comparable law: access, correction, deletion, portability, restriction, objection, and the right not to be discriminated against for exercising them. Two of those are wired directly into the product, so you do not have to ask us and wait:

Export, Settings → Data. Downloads a JSON archive assembled on the server: your account details and settings, your posts, your comments, the messages you sent, who you follow and who follows you, and your blocks, mutes and muted words. It contains what is yours, not everything the platform knows, because that would include other people's messages to you, which are data about them. To prevent client memory issues and API abuse, exports are capped at 5,000 items per section, the most recent 5,000 comments and the most recent 5,000 messages. Both halves of that are real. An account with 200,000 comments produces an archive the browser has to hold in memory to hand you as a file, and the tab dies before the download starts; and an uncapped export endpoint is a way for anyone with an account to make the server assemble an unbounded amount of data on demand, repeatedly. The cap is on how much arrives in one file, not on what you are entitled to: if you need everything, ask at Support and we will produce the complete archive by hand.

Deletion, Settings → Danger zone. Schedules your account for permanent deletion in 30 days and hides it immediately: to everyone else you are already gone. Your profile, videos, comments, messages, conversations, Coms balance and badges are then erased, and any open marketplace listing is cancelled at once.

Signing back in during those 30 days cancels the deletion. Coming back is the undo, there is no separate form to fill in and nobody to email. After 30 days the erasure is permanent and cannot be reversed by us or by you.

One exception exists: an account that other accounts are attached to cannot delete itself while they are alive, because they have no password of their own and deleting the only key would silently orphan them. Delete or hand those over first; the app says so at the time.

What deletion cannot reach is stated in section 8, not buried. Two categories survive it, pseudonymised financial records and, only for permanent removals, a one-way hash, and sections 8.1 and 8.2 say exactly what each contains, how long it lasts, and what it is forbidden from being used for.

For anything not covered by those two buttons, correction, restriction, objection, or an export larger than the cap, open a ticket at Support or write to support@commentrs.com. We answer within 30 days. If you are in the EEA or the UK you may also complain to your national data protection authority.

10Security

Access to data is enforced in the database itself with row-level security, so a rule about who may read a row is applied by the database rather than by whichever screen happens to request it. Passwords are stored only as hashes. Private media is served through short-lived signed URLs. Payment credentials never touch our servers. Gift API keys are stored hashed, and are shown once at creation and never again.

No system is perfectly secure. Where a breach is likely to result in a high risk to you, we will notify you and the relevant regulator within the deadlines the law sets.

11Cookies and local storage

We use browser storage for the things the app cannot work without: your login session, your own choices such as theme and settings, the limits that apply to a signed out visitor, and a service worker cache that lets the app open offline. We do not use third-party advertising or cross-site tracking cookies, and no third-party script runs on this site at all, which is why you are not asked to dismiss a consent banner on arrival.

The complete list, item by item, is in the Cookies and Local Storage policy rather than here. It is kept in one place on purpose: two lists of what a browser stores means one of them is out of date, and the one that is out of date is always the one inside a longer document.

12Privacy rights in US states

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a consumer privacy law, this section is written for you. Some of those laws apply only to businesses above a certain size; we describe our practices here either way.

What we collect, in the categories those laws use: identifiers (email address, handle, account identifier, IP address); customer records and commercial information (purchases, Coms, payouts); internet and app activity (views, likes, comments, messages, settings); approximate location (the country derived from your IP address, never a precise location); audio and visual information (the videos, photos, voice messages and live streams you publish); and inferences (your age band). Sensitive personal information: your login, the content of your messages (used to deliver them, and to check them where section 4 says so), and, for the age check only, face data that Didit processes and deletes (section 7.1) and that we never receive.

Where it comes from: you, your device and browser, and the providers in section 5 (for example Didit's age band and screening results, and ACRCloud's music identification). Why: the purposes in section 3. Who receives it: only the service providers in section 5, under contracts limiting them to providing their service. How long: section 8.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we have not done either in the past 12 months. We do not sell or share the personal information of anyone under 16. Because there is nothing to opt out of, there is no "Do Not Sell or Share" link; a Global Privacy Control signal from your browser is honoured anyway. We use sensitive personal information only to provide the service and keep it safe, which is why there is no separate request to limit it.

Your requests: to know what we hold, to get a copy, to correct it, to delete it, and to appeal our answer to any of those. Two ways to make one: in the app (Settings → Data, for a copy and for deletion), or by writing to support@commentrs.com. We confirm a request within 10 days and answer within 45, usually within 30 (section 9), after checking that it comes from the account holder. Someone you authorise in writing may make a request for you. Using any of these rights never changes how we treat you.

13Changes to this policy

Minor corrections take effect on publication. For a material change we give at least 3 days' notice by in-app notification, push notification or email before it takes effect, matching the notice period in the Terms of Service.

© 2026 Commentrs. All rights reserved.