uier
Sign in

Privacy policy

Effective 25 October 2026

This policy explains what uier.io collects, why, where it is stored and for how long. uier is a signalco project: signalco runs uier.io and is responsible for the data described here (“we”).

In short

  • Reading the site sets no cookies and stores nothing in your browser.
  • Comments you leave with the toolbar on uier.io are public. Anyone who opens the page can read them.
  • Visitor threads are deleted automatically 90 days after their last change. Our starter threads and their replies stay until we remove them.
  • Comments in a project, on a site that uses uier, are visible only to the people the project allows, and stay until they are deleted.
  • Commenting on uier.io needs no account. If you sign in to the uier app, we store your email address and name to sign you in and show who you work with.
  • We do not show ads, sell data or follow you to other sites.

What we collect

Comments and replies

When you post a comment or a reply with the toolbar, we store:

  • the text you write and, for a comment on selected text, the words you selected;
  • the page it belongs to and where it is pinned. By default this is the domain and path. A project owner can additionally choose non-sensitive query fields and hash routes that identify a view. Tracking, review activation and recognized credential fields are excluded; unapproved query fields are not stored.
  • if you or an allowed editor reattach a comment, the new position, original and immediately previous anchors (including selected text), last change time and change count. This context follows the comment’s visibility and retention. Reattachment keeps messages and saved images;
  • when it was posted or edited, and the time in your browser when feedback capture started;
  • details about the device it came from: its size (desktop, tablet or mobile), the window size, the pixel ratio, the browser name and version, and the operating system;
  • an author id: your account id when signed in on uier.io, otherwise a hash of the random token in your uier_visitor cookie;
  • a screenshot of the part of the page the comment is about, when capture succeeds. Capture starts automatically in your browser when you start a comment, rewrite, feedback or bug report. It can include what is visible in that part of the page. The image is sent only when you post the feedback; discarding an unsent comment saves no image. Replies keep the original screenshot. On saved feedback, its author or a workspace admin can supply an uploaded or pasted image, or save a redacted replacement. We read clipboard images only when you choose Paste image or paste an image into saved feedback. Supplied images follow the same visibility and retention rules. The original stays until replacement succeeds, then its stored bytes are overwritten. We expose no image history. Replacement cannot remove copies another person already downloaded. Image editing stays in memory in your browser until saved.

Other visitors see the text, the time, the device size, the window size (so a reviewer can see the page as you saw it), the screenshot if there is one, and a guest name such as “Guest 3F2A”, derived from the author id. If you are signed in on uier.io, comments and replies show your current account name. Feedback on app pages is private to its author and the uier team. Public and guest views never expose the author id, browser, operating system, pixel ratio or capture-start time. Authorized members of a project can view and copy those reproduction details for that project, except the author id. Unsupported browser details are shown as unknown. The copied page link contains only the stored page path and any approved view state, with no review tokens. Comments on the public site are public, so do not put personal information in them.

Unsent drafts and retries

The toolbar stores draft text and anchors in the current site’s local storage for seven days after the last change, scoped to the project, authorized reviewer, page and item. Edit drafts also retain the original message text to detect conflicting edits. Discard, posting and toolbar sign-out clear relevant drafts. Expired data is removed when the toolbar next opens. Site scripts can read local storage. If storage is unavailable, drafts remain only while the page stays open.

Draft images and device details are kept only in memory. Reopening a draft refreshes automatic capture from the current page and viewport, without a composer image preview. Nothing is sent automatically after reload. The server keeps submission hashes and item ids for 30 days to prevent duplicate comments and replies when a response is lost. Receipts contain no message text or images.

The visitor cookie

Starting a draft keeps a random visitor token in local storage to recover a lost response. Your first comment, reply or read acknowledgement sets the uier_visitor cookie. It holds a random token that lets the server recognise your comments and read state, so only you can resolve or delete your comments. We store a hash of the token, never the token itself. The cookie policy has the details.

Project feedback keeps its recorded source origin. Removing a site address does not delete its feedback or move it to another site. The inbox environment filter is saved in browser storage until you clear site data; app filters stay in the page URL.

Your account in the app

When you sign in to the uier app at uier.io/app, we store:

  • your email address, and the name shown with your work (it starts as the part of your email before the @, and you can change it);
  • when your account was created;
  • your workspace and the projects in it: their names, optional client names, the site addresses you add, their environment labels and explicit alias groups, and their settings.

To sign you in, we email you a link. We store only a hash of the token in the link, and delete it when you use it or after 15 minutes. Signing in sets the uier_session cookie, which keeps you signed in; the cookie policy has the details. We count sign-in emails per address and per IP address to stop abuse, in the same way as comments below.

When an admin of a workspace invites you, we store your email address, the role and projects they chose, and who invited you, and we email you the invitation link. We store only a hash of the token in the link. The invitation is deleted when you accept it, when the admin revokes it, or after 7 days. Accepting it creates your account if you don’t have one yet.

Every account automatically joins the uier feedback project as a commenter, so you can review uier and find your feedback in the app. No invitation email is sent for this membership. Other members can see your display name on public feedback; your email is not included in toolbar participant suggestions. Private app feedback remains visible only to its author and the team.

Comments in projects

When you comment with the toolbar on a site that uses a uier project, we store the same details as for comments above, and the address of the site you commented on. Members comment under their account name, guests under the name they give. Who sees the comments is the project’s choice: its members, or anyone with its review link. A comment an admin makes private is visible only to the project’s admins and its author. Members can assign comments to eligible members and mark them done. We store the assignee’s account id. A selected @mention stores the recipient’s account id and its range in the message text, so names can change without changing the recipient. Unsent selections are kept with the browser-local draft for up to seven days and are cleared on discard, submission or sign-out. Only signed-in project members can look up participants; suggestions contain names and opaque account ids, never email addresses. Assignments and mentions do not invite anyone or change access. Private threads can only target people who can already see them. Removed participants appear as former members and cannot receive new assignments or mentions.

On that site, the toolbar keeps in the browser’s local storage a review token while you are signed in to the project, or, as a guest, a random visitor id that recognises your comments and the name you gave. Signing out in the toolbar removes them.

If you are already signed in to uier.io, an empty frame can authenticate you in the background on a configured project site. A separate HttpOnly, Secure cookie authorizes only this review handoff; we check the requesting site and your current project membership. Browsers that block cross-site cookies or frames keep the explicit sign-in link. We do not open a popup or request storage access. Toolbar sign-out disables automatic sign-in on that site until you use an authenticated review link. A pending link code is kept in tab storage for up to ten minutes to survive the reviewed site’s own authentication redirects. The cookie policy describes these keys and controls.

Read activity

We store the last activity you have read for each thread, the time you acknowledged it and your member or hashed visitor identity. This lets the inbox distinguish unread feedback from open work. Reading a thread does not resolve it. Members share their read state wherever they sign in. Guest read state belongs to that browser and site; signing out clears that identity. Clearing identity storage, including the public site’s visitor cookie when present, starts a new identity. The toolbar refreshes comments while it is in the foreground.

Optional reply notifications

Authorized project owners and admins receive new feedback by email. Members follow threads they post in and can follow or unfollow threads or mute a project. Guests can leave feedback with only a name. If a guest separately chooses Email me replies, we store the address with that browser identity and thread, and send a confirmation link. The address is used for replies and status changes only after confirmation. Pending addresses expire after 24 hours; unsubscribing removes the address from the subscription. Signing out of the toolbar does not unsubscribe email.

We store notification preferences, activity sequence metadata and delivery records in Cosmos DB. We use the same read cursor as the toolbar and app to skip activity you have already read. Related activity is batched for five minutes and processed by a scheduled GitHub workflow using our existing Azure Communication Services email sender. Emails contain project names and authorized thread links, without comment text or images. Every digest links to unsubscribe or manage notifications. Preferences and delivery evidence remain until revoked or the associated data is removed. Delivery records can include the recipient address and the exact email while a send is pending or its result is uncertain. Unsubscribe prevents further sends. We do not add notification cookies or store guest email addresses in your browser.

Coding tool access

You can create a named credential in Account to let a coding tool access selected projects and operations as your account. We store its hash, your account and workspace ids, name, project selection, scopes and expiry in Cosmos DB. The credential expires after 30 days when created in the app and can be revoked immediately. We do not store the credential itself. Replies and activity record your identity and the credential’s name and id, so other reviewers can recognize changes made through your coding tool. These records stay with the feedback. Request counters expire after two minutes. Retry receipts contain hashes and feedback ids and expire after 30 days.

Only the access you explicitly grant is available, subject to your current membership and private feedback permissions. The client you choose receives the feedback and any screenshots you authorize; its own terms and retention rules apply to copies it receives. Revocation prevents further access but cannot remove copies already received by that client. MCP requests use the scoped credential and rate limits instead of the browser’s BotID challenge.

Rewrite suggestions

When you ask for rewrite suggestions for selected text, that text and your instruction (if you give one) are sent to Anthropic, whose Claude model writes the suggestions. We do not store the request; only a suggestion you post is saved, like any comment.

Rate limits and bot protection

To stop spam we count new comments, replies and rewrite requests per visitor and per IP address (an IPv4 address, or the /64 network of an IPv6 address), and new comments per page. A counter is stored under a keyed hash, not under the address itself, and is deleted shortly after its time window ends: after about an hour, or about a day for the count per page. Comments never contain your IP address.

Browser requests that post, change or delete comments are checked by Vercel BotID, which runs a challenge in your browser and inspects the request to tell people from bots. On reviewed sites this challenge runs in an empty frame on uier.io. It returns a signed proof tied to the reviewed site, project and reviewer, valid for five minutes and kept only in the toolbar’s memory. It does not need third-party cookies.

Analytics

We count page views with Vercel Web Analytics. It uses no cookies and stores nothing in your browser. Vercel discards the hash it uses to recognise a visit after 24 hours, and we only see totals: pages, referrers, countries, browsers, operating systems and device types.

Request logs

Like any website, our hosting provider receives the usual request details (IP address, browser user agent, the address requested) to deliver the site, and keeps them in short-lived logs.

Why we use it

  • To post your comments and show them to other visitors, as you asked by posting them, and to suggest rewrites when you ask for them: the performance of the service you use (Article 6(1)(b) GDPR).
  • To sign you in to the app, keep your account, workspace and projects, and send the invitations an admin asks for: the performance of the service you use (Article 6(1)(b) GDPR).
  • To protect uier from spam and abuse with rate limits, bot protection and request logs: our legitimate interest in a safe service (Article 6(1)(f) GDPR).
  • To understand how the site is used, in totals only: our legitimate interest in improving it (Article 6(1)(f) GDPR).

Where it is stored and who processes it

  • Comments, accounts, projects and rate-limit counters: Microsoft Azure Cosmos DB in the West Europe region (the Netherlands).
  • Sign-in, invitation and review notification emails: sent by Microsoft Azure Communication Services, with its data stored in Europe.
  • Review delivery: GitHub-hosted workflow runners temporarily process recipient and delivery records. Workflow logs contain delivery ids and failure codes, without recipient addresses, comment text or images.
  • Hosting, analytics and bot protection: Vercel. The server code runs in Dublin, Ireland; pages are delivered from Vercel’s global network.
  • Rewrite suggestions: Anthropic receives the selected text and your instruction to write them.
  • DNS: Cloudflare answers DNS queries for uier.io. It does not see the pages you visit.

These providers process the data on our behalf. Microsoft, Vercel and Anthropic are US companies; where data leaves the European Economic Area, it is protected by the safeguards in their data processing terms, such as the European Commission’s standard contractual clauses. We share data with no one else unless the law requires it.

How long we keep it

  • Visitor threads: 90 days after their last change, then they are deleted automatically. Our starter threads and their replies do not expire. You can delete your own messages earlier in the toolbar.
  • Member read cursors: until removed with the account or project on request. Guest read cursors: one year after the last acknowledgement that advances the cursor.
  • Screenshots: as long as their comment, and on uier.io at most 90 days after they were taken. Deleting a comment, or its text, deletes its screenshot.
  • Coding tool credentials: until revoked, at most 90 days through the credential service (30 days in the app). Expired hashes and grant metadata are deleted automatically. Attribution stays with the feedback.
  • Submission receipts: 30 days. Unsent drafts: seven days in the reviewed site’s browser storage, removed on next use after expiry.
  • Rate-limit counters: about an hour, or about a day for the count per page.
  • Your account, workspace and projects: until you ask us to delete them.
  • Comments in projects: until their author or a project admin deletes them.
  • Sign-in links: until you use them, at most 15 minutes.
  • Invitations: until they are accepted or revoked, at most 7 days.
  • The uier_visitor cookie: one year after it is set. The uier_session cookie: 30 days after you sign in.
  • Analytics: Vercel discards the visit hash after 24 hours; the totals remain.

Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, and to receive it in a portable format. You can delete your own comments and replies with the toolbar at any time. For anything else, email gdpr@signalco.io. Comments on uier.io are anonymous, so tell us the page and the comment you mean: we have no other way to link a comment to you. For your app account, write from the email address you sign in with.

You can also complain to the data protection authority where you live or work.

Children

uier.io is not meant for children under 16.

Changes

When what we collect, where we store it or how long we keep it changes, we update this page and the date at the top.

Contact

Privacy requests: gdpr@signalco.io. Anything else: contact@signalco.io.