Comments

Moderated, nested, privacy-first conversations — plain text only, rendered with textContent, every comment protected by Proof-of-Work and human moderation. No accounts, no emails, no tracking.

Everything included

• Moderation queue — every comment is pending until you approve / unapprove / delete it (search, filters, bulk actions, pagination).
• Nested replies — up to 3 levels with an inline “Reply” form (same PoW + moderation pipeline).
• Owner replies — answer from the admin with an Author badge (nickname configurable).
• Pin — keep any comment at the top of its thread (admin).
• Anonymous likes — one tap, PoW-protected, per-browser guard storing only a token hash.
• Visitor reports — a signed “Report” button surfaces ⚠ counts in your moderation queue (zero data).
• Thread sorting — data-comments-sort="newest|oldest|best" with an in-widget selector; pinned always on top.
• “Read more” for long comments, relative timestamps (“3 h ago”), loading skeletons.
• “Start the conversation” card — the empty state and the form are one polished block.
• Allow/block lists + blocked terms — auto-approve trusted members, ban nicknames, auto-reject words.
• GDPR data export — download comments (CSV) or the full dataset (JSON) from Settings.

Security & privacy

• Plain text only — comments are rendered exclusively with textContent: no HTML, no Markdown, no XSS.
• Proof-of-Work + atomic anti-replay — every submission solves a signed challenge, consumed exactly once.
• Honeypot + time gate — silent bot drops, zero data, on top of the PoW.
• No tracking — no cookies, no IP stored, no fingerprinting. The widget sets nothing in the visitor's browser except (optionally) the anonymous like token.
• You are the data controller — comments live in your D1 database; export them anytime.