Namegarage

Blog comments privacy notice

Version 7.0 · . Read the current notice.

Sign in with Google, GitHub, Apple, X, LinkedIn, Discord, or Telegram using the providers offered in the shared sign-in dialog. Open it from the site header or the comment form. The same account keeps you signed in across Namegarage; it does not grant lease, broker, or administrator access. The header displays locally generated initials instead of loading your provider portrait. We receive an account identifier and name, plus an email address, its verification status, and profile image when supplied by the provider. X, Discord, and Telegram sign-ins use a provider-specific placeholder address that cannot receive mail. Discord and Telegram sign-in do not request your email address. We keep a usable name already saved to your account. If Apple supplies a usable name when your account needs one, we save it. If your account still has no usable name, you must enter one before commenting. We save that name to your account, replacing any unusable name. Better Auth runs on our Cloudflare infrastructure and stores this information in a separate sign-in database. OAuth access and refresh tokens are encrypted in that database; ID tokens are verified during sign-in and are not stored. We do not receive your provider password. Google, GitHub, and Apple sign-ins request no access to your posts, repositories, files, or contacts.

X sign-in requests the users.read and tweet.read permissions. X grants the app read access to your profile and to the posts you can view, including posts from protected accounts; X ties profile access to that post permission. We use only the profile read, which returns your account identifier, name, username, and profile image. We do not read or store your posts, never post from your account, and never read your messages. You can remove the app under Connected apps in your X settings.

LinkedIn sign-in requests only openid, profile, and email through LinkedIn's Sign In with LinkedIn using OpenID Connect product. LinkedIn supplies your account identifier, name, profile photo, and email address with its verification status. We keep the email address only when LinkedIn reports it verified; otherwise the account is stored with a placeholder address that cannot receive mail. LinkedIn sign-in requests no access to your connections, posts, or messages, and we never post from your account. You can remove the app under Permitted services in your LinkedIn data privacy settings.

Discord sign-in requests only identify. Discord supplies your account identifier, username, display name, and profile image when available. We store the account identifier, name, and profile image with a placeholder email in the sign-in database. A username may supply the account name; we do not store a separate username field. We use your saved name and provider to attribute comments. We request no email, server membership, messages, or permission to join servers or post as you. You can remove Namegarage in Discord under User Settings > Authorized Apps > Deauthorize.

Telegram sign-in requests only openid and profile. Telegram supplies a unique account identifier, name, username, and profile image URL when available. We store its account identifier and name with a placeholder email in the sign-in database; we do not store its profile image or username. The signed ID token is verified and discarded. We request neither your phone number nor permission for the bot to send you direct messages. Signing in does not subscribe you to the bot or a channel. You can revoke the website authorization from Telegram's login confirmation message or its website-authorization controls in Privacy and Security. Removing provider access does not delete our account or published comments; contact us below for removal.

Google sign-in requests only openid, profile, and email. We use the profile data to identify your account, keep you signed in, and attribute your comments. We do not sell sign-in data, use it for advertising, or use it to train AI models. We share it only as needed to provide sign-in, host the service, and moderate comments as described below, or when required by law.

The comment database stores your account identifier, account name, sign-in provider, comment, post, submission identifier, and time. For GitHub sign-ins, it also stores a public profile link derived from your GitHub account identifier. Your email address and sign-in tokens are not published or sent to Telegram.

Comments stay private until the owner approves them in a private Telegram chat. After approval, your account name, sign-in provider, comment, date, and GitHub profile link when available appear publicly. If your account has no usable name, you must save a name before submitting a comment. A name you enter is self-declared. A provider sign-in confirms control of that account; it does not verify a legal identity. Older comments may have an unverified display name. The Author badge identifies replies from the site owner. Commenting does not subscribe you to messages.

Essential cookies keep you signed in for up to seven days and bind a sign-in attempt to your browser. Signing out ends that session. The comment form stores a draft in this browser tab so it can restore your text after sign-in for up to 30 minutes. Submission clears the saved draft. These features do not track your reading for advertising.

When you sign out, this browser stores a namegarage:auth-changed marker in local storage. It contains a timestamp and random identifier, not an account identifier, name, email, or sign-in token. Other tabs use the marker to request their current session from the server. It is replaced on the next sign-out and remains until replaced or you clear this site's browser data. Operator rehearsals use a separate namegarage:auth-changed:test marker, with the same contents and retention, so rehearsal logout does not refresh ordinary tabs or change their sign-in scope. The markers are not sent to our server and are not used for advertising or reading-history measurement.

Cloudflare hosts the site and databases and checks submissions with Turnstile. It processes connection information for hosting and security. Sign-in sessions store the connecting IP address and browser user agent; expired sessions and sign-in attempts are cleared hourly. Sign-in rate counters are cleared after a day. Comment limits store a keyed hash of the IP address and your account identifier; those counters are cleared once their windows are 48 hours old.

Your chosen provider processes sign-in under its own privacy policy: Google, GitHub, Apple, X, LinkedIn, Discord, or Telegram when offered. Separately from Telegram sign-in, Telegram processes the account name, provider, profile link, and comment sent for moderation under its own privacy policy.

Sign-in account records remain until you request their removal. Approved comments remain until removed. Pending comments cannot be approved after 30 days; cleanup clears their name, text, account identifier, provider, and profile link. Rejecting or removing a comment clears the same fields. A minimal submission and moderation record remains to prevent duplicates and record the owner's action. Clearing our database does not erase previously sent Telegram messages, provider backups, or copies other people made while a comment was public.

To request removal of a comment or sign-in account, write to [email protected] and identify the account or comment. A person reviews requests. Nikolay Kolev operates this blog. This notice supplements the site's Privacy Policy.

Comments and sign-in information are never sent to ElevenLabs. Generating narration sends the published article text to ElevenLabs. Playing a saved recording requests audio from this site and Cloudflare, without a playback request to ElevenLabs.