diff --git a/data/config.ini b/data/config.ini
index 7d711a56..75ebd703 100644
--- a/data/config.ini
+++ b/data/config.ini
@@ -94,16 +94,25 @@ listPosts.safe=anonymous
 listPosts.sketchy=registered
 listPosts.unsafe=registered
 listPosts.hidden=moderator
+
+;privilege to view post page, e.g. example.com/post/53
 viewPost=anonymous
 viewPost.safe=anonymous
 viewPost.sketchy=registered
 viewPost.unsafe=registered
 viewPost.hidden=moderator
+
+;privilege to download post file, e.g. example.com/8ca21cb48aaf6ba5d361e6bebebc8cfe/retrieve
+;note that the hash cannot be guessed with basic url manipulation. giving
+;anonymous access in this case is reasonable - it allows privileged users to
+;share permalinks with unprivileged folks, also it allows to properly feature
+;posts otherwise unavailable to unregistered people.
 downloadPost=anonymous
 downloadPost.safe=anonymous
 downloadPost.sketchy=anonymous
 downloadPost.unsafe=anonymous
 downloadPost.hidden=moderator
+
 retrievePost=anonymous
 favoritePost=registered