Loading your page…
The details
Last updated November 2, 2026 · For tell.st, the widget, and the browser extension.
We store your feedback, comments, votes and the page address you report. Visual reports may include a screenshot or wireframe, the selected element’s text and HTML, its selector and position, viewport details, browser information and captured console errors. Review this context before submitting; do not include passwords, access tokens or other people’s sensitive information.
When you sign in, we store your email address and account information. We use email for verification, site notifications, owner replies and resolution updates. We also keep ownership, subscription and delivery records needed to operate these features.
Anyone can read and share public feedback. Private feedback may appear as a locked entry on the board. Its text, discussion, page markers and attachments are accessible to the authorized author, the verified site owner, the platform administrator and tools using a valid private token for that site. An AI agent connected to the owner’s account can read the site’s private feedback through MCP.
On verified sites, the owner and their configured alert addresses can receive new private feedback and visitor comments by email. These emails include the feedback text, reported page path and any new comment. Receiving an email does not grant access to the report or its attachments.
For private feedback, replies from the owner and status updates go to the author if an email is linked. Private Webhook notifications share event details and links while withholding the feedback text, comment, author, page path and markers.
After posting anonymously, choose Get replies within 24 hours to verify your email, receive reply notifications, and keep access to private feedback across sessions.
Cloudflare hosts the application, database and screenshots. Email uses Cloudflare when its email binding is available. If the binding is absent and Resend is configured, we use Resend. Each delivery stays with its selected provider, including retries. Site owners can connect Webhooks and authorize tools. These services process the information they receive under their own policies.
For daily backups, a GitHub-hosted Actions runner reads the database export and referenced screenshots in plaintext, encrypts them and uploads the encrypted archive for up to 30 days. The decryption private key stays outside the workflow. Live screenshots expire after 180 days, including after a restore. Accounts and feedback have no automatic deletion deadline during the pilot.
We use cookies for sign-in, language preferences, and a site-scoped anonymous visitor identifier (tellst_vid) to keep a consistent anonymous persona and prevent duplicate votes, local storage for widget preferences, and temporary tab storage to complete anonymous feedback claiming. We do not sell user data or add advertising trackers.
The extension requests activeTab and tabs for page context and user-initiated capture, storage for preferences, and access to website pages to run its feedback controls. The widget accepts images you choose or paste. The extension can capture the visible page when you choose to mark an element.
When you first open the interaction space, it loads a tell.st frame, sends the page address without query parameters or fragments, and requests feedback and discussion. The extension popup also requests recent feedback. These requests can happen before you submit feedback. Hosting providers process network information such as your IP address.
Use Delete on feedback or comments where your account has permission. This removes them from active boards and APIs. For account removal, other associated records, or an inaccessible anonymous report, contact us with the relevant account email and feedback or site links. We verify your identity and authority before acting; there is no self-service account deletion button yet.
Deletion is not instantaneous across all retained copies. Encrypted backups can retain earlier data until they expire within 30 days, and live screenshot storage has a 180-day expiry. Recovery must reapply confirmed deletion requests before reopening the service. Copies already delivered to email recipients or connected tools are outside our direct control.
For privacy or data removal requests, email privacy@tell.st. Never send a password, verification code or private API token with your request.