Privacy Policy

Comet is a web-based PDF review and annotation service. This Privacy Policy describes how Comet collects, uses, stores, and protects information when you use the service.

Some processing is necessary to provide the service. Optional analytics is handled according to the choice saved in your browser, as described below.

We may collect the following types of information:

• Account information, such as email address and profile name.
• Authentication information provided through Supabase Auth.
• PDF files uploaded to the service.
• Annotations, comments, document settings, and review data.
• Cloud save metadata, such as file names, storage paths, file sizes, and timestamps.
• Basic technical information, such as browser type, device information, and usage logs.
• Where analytics is enabled, page views, session information, approximate region, and selected feature interaction events.
• Your analytics consent choice, which is stored locally in your browser.

We use collected information to:

• Provide PDF upload, review, annotation, sharing, and export features.
• Save documents and annotations to cloud storage where enabled.
• Authenticate users and manage account access.
• Apply plan limits and paid feature access.
• Improve service reliability, performance, and usability.
• Understand how public pages and selected product features are used when analytics is permitted.
• Investigate errors, abuse, security issues, or technical problems.

You retain ownership of the documents, annotations, and comments you upload or create in Comet.

Comet stores and processes uploaded files only as needed to provide the service, including displaying PDFs, saving review data, generating thumbnails, exporting annotated PDFs, and enabling share links.

Please avoid uploading highly sensitive or confidential documents during the alpha stage unless you understand and accept the risks of using a developing service.

When you generate a share link, anyone with access to that link may be able to view the shared PDF and associated annotations depending on the current feature settings.

You are responsible for managing who receives share links and for avoiding the accidental disclosure of sensitive information.

Comet may use third-party services to provide authentication, database, storage, hosting, analytics, and payment functionality.

These services may include:

• Supabase for authentication, database, and storage.
• Cloudflare for hosting, routing, and serverless infrastructure.
• Google Tag Manager and Google Analytics 4 for tag delivery and usage measurement.
• Microsoft Clarity for interaction analysis on public marketing pages only.
• Stripe for payment processing after paid plans are connected.

Third-party services process information according to their own privacy policies and security practices.

Comet uses Google Tag Manager to manage Google Analytics 4. Depending on your consent choice, Google Analytics may process page views, session statistics, approximate region, browser and device information, and selected feature interaction events.

Selected events may include opening a PDF, opening a whiteboard, making a first annotation, creating a comment, sharing, saving to the cloud, exporting, starting a trial, starting checkout, and starting a subscription. We do not intend to send PDF contents, annotation contents, comment text, share IDs, or authentication credentials as analytics event parameters.

Google Consent Mode is configured so that analytics storage is denied unless you allow analytics. Advertising storage, advertising user data, and advertising personalization remain denied. When analytics storage is denied, Google tags may receive limited cookieless measurements.

If you allow analytics, Comet also uses Microsoft Clarity on publicly accessible marketing pages to understand interactions such as navigation, clicks, and scrolling. Clarity may provide session-replay and heatmap functionality. Clarity is not enabled in the Editor, Shared Editor, Cloud Files, account pages, authentication callbacks, checkout completion pages, or other user-specific pages.

For more information, see the Google Privacy Policy and the Microsoft Privacy Statement.

When paid plans are enabled, payment information may be processed by Stripe or another external payment provider. Comet does not intend to directly store full credit card numbers.

Payment status may be used to update your account plan, enable paid features, and manage subscriptions.

We may retain account data, uploaded documents, annotations, and related metadata for as long as necessary to provide the service, comply with legal obligations, resolve disputes, prevent abuse, or maintain backups.

Free and paid plans may have different storage limits and retention policies. Additional retention rules may be added before public launch.

We use reasonable technical and organizational measures to protect user data. However, no online service can guarantee complete security.

You are responsible for protecting your account access and for carefully managing documents that contain confidential or sensitive information.

You may choose not to create an account for features that do not require sign-in. You may also delete cloud-saved documents where the service provides deletion controls.

You can allow or disable optional analytics using the controls in Section 7. Your choice is stored in your browser and can be changed later.

Additional account deletion, data export, and privacy request workflows may be added before public launch.

Comet is not intended for use by children. We do not knowingly collect personal information from children.

Comet may be accessed from different countries. Your information may be processed and stored in countries or regions different from your location, depending on the infrastructure and third-party services used.

We may update this Privacy Policy from time to time. When we make significant changes, we will update the “Last updated” date and may provide additional notice where appropriate.

For questions or requests concerning this Privacy Policy, contact the Comet operator at info@urbanpatch.llc.