Privacy Policy

Peanut Gallery is a Chrome extension and companion website that lets web developers and agencies collect visual feedback from clients directly on a live website. This policy explains what information we collect, why we collect it, and the choices you have. Peanut Gallery is operated by Matchsticks (matchsticks.online), referred to below as "we" or "us".

The short version: we collect the minimum needed to run the service — your email, your projects, and the comments you and your clients leave. We don't track your browsing, we don't sell data, and you can delete everything by asking.

1. Information we collect

Account information

• Your email address and a password, used to create and sign in to your account. Passwords are handled by our authentication provider (Supabase) and are never visible to us in plain text.

Project and feedback content

• Projects you create, including the website URL being reviewed.
• Comments, replies, and resolve/re-open status, along with the page URL and the on-page element each comment pin is anchored to.
• Invite codes and the membership of each project (which accounts have joined).

Payment information

• If you upgrade to a paid plan, payment is handled by our payment processor. We receive confirmation of your plan and billing status but never see or store your full card number.

Technical basics

• Standard server logs (IP address, timestamps, request data) kept by our hosting and backend providers for security and reliability.

2. What the extension can — and cannot — see

To place and display comment pins, the extension reads the structure of the page you are actively reviewing so pins can anchor to the right element. It runs on pages where you use it and stores only what is needed to position and display comments.

• We do not collect your browsing history.
• We do not read pages where you aren't using Peanut Gallery.
• We do not capture form inputs, passwords, or keystrokes on reviewed pages.

3. How we use information

• To provide the service: sync comments between collaborators in near-real-time, enforce plan limits, and show your projects on any machine you sign in from.
• To send essential service emails, such as password resets.
• To keep the service secure and prevent abuse.
• To improve the product using aggregate, non-identifying usage patterns.

We do not sell your personal information, and we do not use your project content for advertising.

4. Where your data lives

Comments, projects, and account data are stored in our cloud backend, hosted by Supabase. Data is encrypted in transit, and access is protected by row-level security so collaborators can only see projects they belong to. Our marketing website is served from our hosting provider and loads fonts from Google Fonts, which involves your browser requesting font files from Google's servers.

5. When we share information

• Service providers — Supabase (authentication and database), our hosting provider, our payment processor, and Google Fonts (font delivery on the website). Each receives only what it needs to perform its role.
• Your collaborators — people who join a project with your invite code can see the comments, replies, and display names within that project. That's the product working as intended.
• Legal requirements — if required by law or to protect the rights, safety, or integrity of the service.

6. Retention and deletion

We keep your data for as long as your account is active. Deleting a comment or project removes it from the service. If you delete your account, or email us asking us to, we will delete your account data and content within 30 days, except where a longer period is required by law (for example, billing records).

7. Your rights

Depending on where you live (including under the GDPR, UK GDPR, POPIA, and CCPA), you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Object to or restrict certain processing.
• Data portability.
• Complain to your local data protection authority.

To exercise any of these rights, email us at the address below. We'll respond within 30 days.

8. Children

Peanut Gallery is a professional tool and is not directed at children under 16. We do not knowingly collect personal information from children.

9. Changes to this policy

If we make material changes, we'll update the date at the top of this page and, where appropriate, notify you by email or in the extension. Continued use of the service after changes take effect means you accept the updated policy.

10. Contact

Questions, requests, or complaints: [email protected].

See also our Terms of Service.