What the service receives
When you comment, the service collects the display name and plain-text comment you provide. Both fields are required.
Email is optional and private. It is used only for approval and author-reply notifications that you choose to receive.
A hidden honeypot field, a Cloudflare Turnstile result, an anonymous session, idempotency records, and keyed abuse-control hashes help reject automated or repeated misuse.
This information is used to receive comments, hold them for review, publish approved discussion, remember an anonymous reaction, prevent abuse, and deliver requested notifications.
Moderation and processors
Every guest comment begins as pending. Paulo reviews it before it can appear in the public discussion or approved-comment count.
A Cloudflare Worker processes the engagement API, D1 stores its data, and Turnstile performs the security check. Resend processes low-volume notification emails when delivery is available.
The newsletter is separate from commenting. If you subscribe or ask for a guide PDF, your email address, your first name if you give it, which guide you asked for, and the campaign link you arrived from go to Brevo. Brevo stores them, sends the double opt-in confirmation, and delivers the guide link and future updates. Nothing is sent until you confirm, and every email carries an unsubscribe link.
Privacy safeguards
Before storage, an optional email address is encrypted by the Worker with a versioned application secret. The email is never public, returned by the public API, or intentionally written to application logs.
The service does not store raw IP addresses. It derives short-lived keyed hashes for rate limits and abuse controls so the original network address is not retained.
The browser holds an opaque first-party identifier for the anonymous session, and only its keyed hash is stored in D1. It remembers one reaction per update but is not an account, verified identity, or unique-person count.
Retention
Approved public comments and reactions remain until they are removed. A reaction can be changed or removed from the same anonymous session.
Anonymous reaction sessions expire after one year of inactivity.
Rejected or spam comment bodies are kept for 30 days, then erased. A minimal content-free status tombstone remains for 90 days to prevent accidental notification or republication.
When a comment is removed, its public content and encrypted email are erased immediately. A content-free tombstone remains for 90 days.
Keyed network-abuse and consumed security-token hashes expire after 7 days.
Idempotency records that prevent duplicate submissions expire after 24 hours.
Terminal notification-delivery metadata, such as sent, failed, or cancelled status, expires after 30 days.
A moderation audit record does not retain the guest comment body or email. It may retain the action, actor, target, and an optional editorial reason for one year.
Unsubscribing erases the email ciphertext immediately and retains only a keyed suppression hash for one year to honour that choice.
Private signed unsubscribe and removal links expire after 30 days. They are operational controls, so they should not be forwarded.
Your controls and service limits
Unsubscribe stops future optional emails but leaves an approved comment public. Removal takes the comment out of public responses and records the removal action in the moderation audit.
The service is designed to use capped free tiers from Cloudflare and Resend and become read-only or unavailable instead of automatically incurring paid usage. The update itself stays usable and no failed action is presented as accepted.
Already approved comments and reactions remain in D1 during a temporary service failure and can return to the page after service recovers.