Privacy and security
What Nuni stores, who can see it, and how to lock it down.
Who can see comments
The widget is visible to everyone who can open your site, and comments are readable by anyone who knows the project ID (which is in your page source). Treat comments like a public issue tracker: don’t put passwords, customer data or secrets in them.
What is stored
For each comment: the text, the author name (as typed), a hash of the commenter’s browser key (used to let them edit and delete their own comments), the page URL and title, the element details described in How pins stay put, the viewport size and the browser user agent. No cookies are set on your site and no IP addresses are stored (they are used briefly for rate limiting).
For owners, and commenters who sign in: the name, email and avatar from GitHub via WorkOS. A signed-in commenter’s comments show their GitHub name and avatar; their email is never shown.
An owner’s email address is also where Nuni sends the activity emails for their projects. These emails include the text of new comments and replies, and are sent through Cloudflare. Commenters are never emailed.
Images commenters attach
On a claimed site, a commenter can attach up to 3 images to a comment: their own (picked or pasted), or the screenshot of the element after drawing boxes, arrows or lines on it. These images are public, like the comment: everyone who can see the comment sees them, and the comment box says so. Images are scaled down and re-encoded in the browser before they are sent, which also removes their metadata (such as location). They are deleted with the comment. Turn them off with the images option.
Page context (owner only)
To help you, or your coding agent, act on a comment, the widget also attaches what it saw when the comment was left:
- Screenshot of the element with a small margin around it (not the rest of the page), with the element outlined. Nuni’s own UI is left out.
- Console: the latest console errors and warnings, and uncaught errors.
- Failed requests: method, status and the URL’s origin and path.
- Element: the element’s markup and a few computed styles (font, color, spacing and size).
Query strings and hashes are removed from every URL, in failed requests, console messages and the element’s markup (links, images), since they often carry tokens. The server removes them again, whatever the browser sent.
Unlike the comment itself, this context is only visible to the project owner, in the dashboard and in the widget’s owner tools. It is deleted with the comment.
What is never captured
- Form values: text fields, text areas and selects are painted over in the screenshot, and their values and option lists are removed from the markup.
- Areas you mark private: add
data-nuni-maskto any element (an account summary, a card number). It is painted over in the screenshot, its contents are removed from the markup, and its text and labels are never stored with the pin, including for elements inside it.
<div class="account" data-nuni-mask>Balance: $1,234</div>Turning it off
Turn any of it off with the capture option:
init({ project: "nuni_...", capture: { screenshot: false, console: false } })Abuse protection
Comment creation is rate limited per IP and per project, and unclaimed projects are capped at 500 comments. Comment text is always rendered as plain text, never HTML.
Content Security Policy
If your site sends a CSP, allow:
connect-src https://*.convex.cloud wss://*.convex.cloud https://*.convex.site;
script-src https://cdn.jsdelivr.net; /* only for the script tag */The widget renders inside a Shadow DOM, so its styles never touch your page and your styles never break it.