Privacy Policy
Last updated: June 22, 2026
Comark is a Chrome browser extension that lets teams drop comments on any web page, anchored to specific page elements or text. Teams collaborate either over email (sign in and invite teammates by email — no chat platform required) or by connecting a Slack workspace. This policy explains what data Comark collects, how it's used, and who processes it.
What we collect
- Account & identity information — If you sign in by email, we store your email address and a display name. If you sign in with Slack, we store your Slack user ID, display name, and avatar. This identifies you as a comment author to your teammates and lets us send you notifications.
- Comment content — The text of comments and replies you write, any emoji reactions, @mentions, and image attachments you add. This is stored in a private database scoped to your team; only members of your team can access it.
- Page context & anchors — The URL of the page where you place a comment, and a CSS selector or text-selection reference identifying the element or text it's anchored to, so the comment can be shown in the right place.
- Page snapshots (Share for review) — When you choose to create a share-for-review link, Comark captures a snapshot of the page's rendered content (its HTML and styles) so a guest can view that page with your team's comments without installing the extension. A snapshot can include whatever is visible on the page at the moment you capture it. Snapshots are stored privately and served only through an unguessable, expiring share link (see Share-for-review links). Comark only captures a snapshot when you explicitly click "Share for review."
- Notifications — Records of comment activity addressed to you (mentions, replies, reactions, new comments on your projects) and their read/unread state, used to show your unread badge, in-app inbox, browser notifications, and email digests.
- Approximate location — Our analytics provider (PostHog) derives an approximate location (city, region, country) from the IP address of analytics requests. We do not collect precise GPS location.
- Product-usage analytics — Privacy-respecting events about how Comark's features are used (for example, that a comment was shared or an invite was sent). We send only these explicit product events — never your page URLs, page content, or comment text — to analytics.
- Local settings — Filter preferences, toolbar state, and read/unread state stored locally on your device via Chrome's storage API.
How we use your data
- To display comments anchored to page elements and text across your team, and to sync new comments and replies in real time.
- To associate your email or Slack identity with comments you author.
- To notify you of activity that needs your attention — via an extension badge, browser notifications, an in-popup inbox, and optional email digests.
- To generate and serve the page snapshots behind share-for-review links you create.
- To understand which features are used so we can fix issues and improve Comark.
We do not use your data for advertising, to build advertising profiles, or for any purpose unrelated to operating Comark. We do not sell or rent your data.
Share-for-review links
- A share link contains a long, unguessable token. Anyone who has the link can view that page's snapshot and the comments on it — treat a share link as effectively public, and don't share pages that contain private or sensitive information.
- Snapshot artifacts are stored in a private bucket and are reachable only through short-lived signed URLs issued when a valid link is opened.
- Share links expire automatically after 7 days, and you can revoke any link at any time from the extension; revoked or expired links stop working immediately.
Email communications
- Sign-in codes — When you sign in by email, we send a one-time verification code.
- Invitations — When you invite a teammate, we email them an invite to join your team.
- Notification digests — Optional periodic email summaries of activity you missed. You can turn these off with a one-click toggle in the extension; in-app and browser notifications are unaffected.
Data sharing
Your comment and snapshot data is accessible only to authenticated members of your team — plus anyone you deliberately give a share-for-review link to. We do not sell, share, or transfer your data to any third parties except the sub-processors listed below, which act on our behalf to operate the service.
Sub-processors
Comark uses the following service providers to operate:
- Supabase — Postgres database, file storage (comment attachments and page snapshots), authentication, and serverless functions.
- PostHog — privacy-respecting product analytics; derives approximate location from request IP addresses.
- Resend — delivers our transactional and notification emails (sign-in codes, invitations, digests).
- Slack — for teams that connect a Slack workspace, receives the messages we post on your behalf via the Comark bot and provides member directory and channel information.
Security
- All data in transit is encrypted via HTTPS/TLS.
- Authentication uses email one-time codes or Slack OAuth — we never see or store your password.
- For Slack-connected teams, the workspace bot token is held only on Comark's server (encrypted at rest) and is never sent to your browser. Your device holds only a session token used to call Comark's own server, plus the locally cached settings noted above.
- Comment and snapshot data is stored in a Supabase Postgres database / storage with row-level security that enforces team-scoped isolation, so members of one team cannot read another team's data. Snapshot files are kept in a private bucket with no public read access.
- When a team owner removes a member, that member's access is revoked.
Data retention
- Comments and their attachments are retained until you or an authorized teammate delete them, or you delete your team.
- Page snapshots behind share links expire after 7 days (or when you revoke the link).
- Locally cached settings remain on your device until you uninstall the extension.
Your rights
- Delete any comment you authored directly within the extension.
- Revoke any share-for-review link you created, at any time.
- Turn off notification emails with a one-click toggle in the extension.
- For Slack-connected accounts, revoke access via your Slack account settings under Connected Apps.
- Uninstall the extension at any time to remove all locally stored data from your device.
- Request deletion of your account, team, or data by emailing support@getcomark.com.
Children
Comark is a workplace collaboration tool intended for adults and is not directed to children under 13. We do not knowingly collect data from children.
Changes to this policy
We may update this policy as Comark evolves. Material changes will be reflected by the "Last updated" date above.
Contact
Questions about this policy or your data: support@getcomark.com