NostrComments has no server. There is no account, no email, no tracking and no
analytics, and the developer never receives your data — there is nowhere for it to go.

NOTHING HAPPENS UNTIL YOU ENABLE IT
On first use you get a disclosure screen. No relay is contacted before you accept it,
and you can disable NostrComments per site at any time. Since v22.53 relays are only
contacted for pages you actually read — a tab you never look at, or a page you leave
within a couple of seconds, is never mentioned to anyone.

WHAT THIS UNAVOIDABLY REVEALS
To show a thread for a page, the extension has to ask relays about that page. The relays
you have configured therefore see which pages you read, along with your IP address, and
your public key if one of them asked you to identify yourself. That is inherent to how a
comment system attached to URLs works, rather than a choice made on your behalf, and it
is the thing worth understanding before installing. The relays are yours to choose:
remove any you do not trust in Settings, or point the extension at one you run yourself.

SENT TO PUBLIC NOSTR RELAYS (third parties you choose)
- Loading comments: the address of the page you are on, so the extension can show that
page's thread.
- Posting a comment or vote: your comment or vote, the page address, and your Nostr
public key. Relays are open servers not operated by NostrComments; anything published
there is public by design.
- Extra relays for what you post (on by default, posting only): a comment held by a single
relay is gone the day that operator decides so. What you post therefore also goes to three
relays that are never read from or queried - purplerelay.com, relay.nostrplebs.com and
nostr.bitcoiner.social. They get exactly what your own relays get, plus your IP address as
any contacted server does, and are told nothing about pages you only read. Switch it off in
Settings to use only the relays you listed.
- Sharing your own comment (only when you press Share, and confirm): an ordinary Nostr note
carrying that comment and a link to the page it was written on. This is the one thing here
that reaches the feeds of people who follow you; comments themselves never do. Nothing is
shared unless you ask, per comment, and the confirm exists so a stray click cannot broadcast.
- Your own threads (only when you open Settings): the extension asks your relays for comments
written by your public key, so it can list the pages you have commented on. Fetched when
Settings opens, not on every page you read.
- Deleting your own comment: a signed request naming it. It is a request — relays that
honour it drop the comment, and some will not. Copies already fetched by other people
are beyond anyone's reach, including yours.
- Reply notifications: while you are connected, the extension keeps a subscription open
on up to three of your relays asking for events that mention your public key. Unlike
everything else here this is not tied to a page you are reading: those relays see your
public key and that you are online for as long as it is open, even in a session where
you never post. It starts only once you connect an identity, and removing your key
stops it.
- Identifying yourself to a relay (NIP-42): some relays refuse to serve anything until a
client proves which key it is. When one of yours does, the extension signs a short
event that tells that relay your public key. Only ever in response to an actual
refusal, never because a relay merely offered it.

SENT TO OTHER THIRD PARTIES
- Verified names (off by default): if you switch this on, the extension asks the domain
a commenter claims whether that name really belongs to their key. That domain then
sees your IP address and knows somebody is reading a page where that person commented.
- Profile pictures and images in comments: these are loaded by your browser from
whichever server the person who posted them chose, which gives that server your IP
address and browser version. For an avatar that happens on every page where that
person has commented. Nobody in that chain is picked by you. This is how Nostr clients
generally work; no relay operator and no developer is involved. Since v23.0.2 these
requests withhold the address of the page you are on, and load only as they scroll
into view.
- Zapping (optional): if you tip a commenter, or the developer, your browser contacts
that recipient's Lightning provider to fetch an invoice and your own wallet pays it.
That provider sees the request, including your IP address. No payment code is bundled
and no money passes through the developer. Supporting the developer is voluntary and
unlocks nothing.

STORED ON YOUR DEVICE ONLY, NEVER TRANSMITTED
- Your Nostr key, if you generate one here. You can protect it with a password, in which
case it is encrypted at rest (PBKDF2 + AES-GCM).
- Your relay list, muted users, muted words, per-site disable list, theme, which signer
to use, whether verified names are checked, your consent choice, and flags recording
that you confirmed your key backup, that you were offered key encryption, and that you
sent a support zap.
- A list of the 300 most recent pages where you opened the comment panel, with a
timestamp, so comments posted since your last visit can be marked "new". Older entries
are discarded. This never leaves your browser.

WHAT IT DOES NOT DO
No data to the developer. No collection, transmission or profiling of your browsing
history. No analytics or telemetry. Nothing transmitted before you explicitly enable it.

Full policy: https://github.com/briskness-byte/NostrComments/blob/main/PRIVACY.md