Privacy and security
Your words are yours.
A grammar checker sees what you write, so it has to earn your trust. Here is exactly what happens to your text, in plain words.
The life of a check
Four steps, then gone
You ask
You select text and click the tick, press the shortcut, or tap ✓ Check on the keyboard. Nothing happens before that.
Sent encrypted
The text travels over HTTPS to our service, with your sign-in token. Nobody in between can read it.
Checked in memory
Our service passes the text to the grammar model and gets the fix back. Nothing is written to disk.
Forgotten
The fix goes back to you and the text is dropped. We add one to today's count of checks, and that's all.
Data
What we keep, and what we don't
We keep
Only what we need to run your account.
- Your email address and a random account ID
- Your plan, and how many checks you made each day
- Purchase records that tax law requires
- Anonymous app events and crash reports, to fix bugs
We never keep
And never sell, share for ads, or use for training.
- The text you check, or the fixed text
- What you type on the GrammarDeck keyboard
- Your card, UPI or bank details
- Your text inside analytics, logs or crash reports
Permissions
Why the apps ask for access
Each device asks for one permission so GrammarDeck can read the text you choose. Here is what each one does.
macOS: Accessibility
macOS asks before any app can read the selected text in other apps or paste into them. GrammarDeck uses it only when you click the tick, press the shortcut or use the menu. You can turn it off any time in System Settings → Privacy & Security → Accessibility.
Windows and Linux: reading the selection
GrammarDeck copies the selected text when you press the shortcut, puts the fix back after you click Accept, and then restores what was on your clipboard. It does nothing in the background.
iPhone and iPad: Allow Full Access
iOS does not let keyboards reach the internet without "Allow Full Access", and a check needs the internet. Apple shows a general warning for this. The GrammarDeck keyboard sends text only when you tap ✓ Check, and never records what you type.
Android: the keyboard warning
Android warns that any keyboard can see what you type. The GrammarDeck keyboard sends text only when you tap ✓ Check, never records keystrokes, and does not check password fields.
Browser extension: reading web pages
Browsers ask extensions for access to the pages you visit, so the GrammarDeck button can appear next to your selection. The extension sends text only when you click the button, use the right-click menu or press the shortcut. It ignores password boxes.
Security
How we protect your account
Encrypted everywhere
Every connection between the apps, this website and our service uses HTTPS (TLS).
Trusted sign-in
Sign-in is handled by Google Firebase Authentication. We never see your Google or Apple password.
Locked-down data
Account data lives in Google Cloud. Only our own service can read it; the apps can't read anyone else's.
No card data
Payments go through Razorpay, Paddle, Apple or Google. Card and bank details never reach us.
Short sessions
Website sign-ins end after an hour without use, and after 12 hours at most. The session lives in a secure, HTTP-only cookie.
Few hands
Only the people who run GrammarDeck can open the admin tools, and they never see your text, because it is never stored.
Report a security problem
Found a vulnerability? Please email security@grammardeck.com with the steps to reproduce it. We will reply within 2 working days, keep you updated, and credit you if you wish.
Please give us a reasonable time to fix it before you tell anyone else, and do not access other people's data, disrupt the service or run automated scans that overload it. If you act in good faith under these rules, we will not take legal action against you.
Our contact details are also in security.txt. For the full details, read our privacy policy and the list of subprocessors.
Private by design. Ready when you are.
Start free with 5 credits a day. No card needed.