What should a writing tool's privacy policy tell you?
Private Writing Assistant
Check grammar and rewrite text with AI that runs on your device. Free.
Add to Chrome
Add to Safari
You're about to install a writing tool. The store page says it respects your privacy, the policy link opens a long page of legal text, and the Add button is right there. Most people click Add. Six questions, asked of that long page, tell you what “respects your privacy” actually means.
In short
A writing tool's privacy policy should tell you where your text is processed, what else is collected, who else receives it, how long it's kept, whether it trains any model, and how to turn things off. If a policy doesn't answer these six questions plainly, you don't know what happens to your writing.
Why writing tools are a special case
Most apps collect data about you: what you click, where you are, which device you use. A writing tool sees something more personal. Everything you type in the fields where it runs, such as emails, contracts and messages to your doctor, passes through it.
So the most important part of its privacy policy is about your content, not your account. Here are six questions to ask of any policy, answered for our own extension so you can see what a plain answer looks like.
1. Where is my text processed?
This is the question that decides the rest. If text is processed on a server, everything else in the policy is about what happens there. If it's processed on your device, most of the remaining questions answer themselves.
Our answer: on your computer, by Chrome Built-in AI. Text you write on websites is never transmitted to us, stored on a server or shared with anyone. The language detection runs locally too.
2. What else is collected?
Look for the list of everything that does leave your device, not just the reassurance about what doesn't. A vague phrase such as “technical data” should make you look further.
Our answer: two things, and neither contains your text. Usage stats: which features you use, the website's name such as mail.google.com, Chrome's language, the language checked, the extension version and a random ID. And feedback, only when you write it and press Send.
3. Who else receives it?
A policy should name the services that handle your data, or at least the kinds of services, and say what they're allowed to do with it.
Our answer: usage stats go to PostHog, on its servers in the EU, which doesn't store your IP address. Feedback goes through Cloudflare and Resend, only to deliver it to our inbox.
4. How long is it kept?
“As long as necessary” is common and tells you little. Look for a period, or at least a rule you can hold the company to.
Our answer: your text isn't kept anywhere but your own device. Feedback emails are kept as long as needed to handle them and deleted on request. Usage stats follow PostHog's standard retention period.
5. Is my text used to train AI?
A clear policy says yes or no and names any exceptions. If it only mentions “improving our services”, read on: that phrase often covers training. Our post Do AI writing tools train on what you type? lists the words to look for.
Our answer: no. Your text never reaches us, so it can't be used to train anything.
6. What can I switch off?
A policy should tell you how to opt out of anything optional and what happens when you do.
Our answer: the “Share usage stats” switch on the settings page stops all sending and deletes the random ID. You can also turn checking off on any website.
Two more things worth checking
- A date. A policy with an effective date tells you when it last changed. Read it again when the date moves.
- A promise about changes. Good policies say how they'll tell you before data handling changes, not just that the page may be updated.
Our full privacy policy has both, in all 50 languages of this site.
See how our own privacy policy answers all six, then decide whether Private Writing Assistant belongs in your Chrome.