Privacy Policy

Effective October 20, 2026

1. Who we are

Grainwrite (“we”, “us”) is operated by Gabriel Torres, based in Ontario, Canada. For anything about your data, email support@grainwrite.com.

2. What we collect

Your account

• Email address and an optional display name.
• If you sign up with a password, it's stored only as a one-way hash by our authentication provider. We never see or store the password itself.
• If you sign in with Google, we receive your email address and basic profile name from Google. We don't receive your Google password or access to anything else in your Google account.

What you rewrite

When you click Rewrite, your text travels over an encrypted connection to the GPU that runs the model, is processed in memory, and the result streams back to you. We do not store your text or the rewrite in our database, we do not write it to our logs, and we do not use it to train or improve any model. Our hosting and GPU providers handle it only for the moment needed to deliver the result.

Usage records

For each rewrite we record the time, the number of credits it used, and which plan you were on. We use this to enforce monthly limits and credits. We also record your plan, credit balance, and any promo codes you've redeemed.

Abuse prevention

The free plan is limited to one account per person. To enforce that, we record:

• Your IP address, stored only as a keyed one-way hash. For IPv6 we hash the network prefix rather than your full address.
• A random identifier for your browser, kept in your browser's storage and a cookie named gw_did, and stored on our side only as a keyed hash.
• A normalized form of your email address (for example, treating name+tag@gmail.com and name@gmail.com as the same inbox).

These hashes let us tell that two accounts share a browser or a network without storing the address or identifier itself. If an account looks linked to another free account, it may lose its free allowance. It can still use credits and paid plans.

We also use Cloudflare Turnstile on sign-in and sign-up forms to check that requests come from a person rather than an automated script. Turnstile may process technical information about your browser and device to do this.

Proofreader

The Proofreader first checks your text with a grammar checker that runs entirely in your browser; that step sends nothing to us. Its program files are downloaded from the jsDelivr content network, which sees your IP address like any website you load files from. When you click Proofread, your text and the browser check's findings are sent to an AI provider (Groq, or DeepSeek if Groq is unavailable) to find errors. We don't store the text. The providers process it to return results under their own terms.

Payments

When paid plans are available, payments are handled by Stripe. We receive a customer reference and the status of your plan. We never see or store your full card details.

Technical information

Like any website, the servers that deliver Grainwrite receive standard request information such as your IP address, browser type, and the pages you request. Our hosting provider uses it for delivery and security.

3. How we use it

• To provide the service: rewriting your text, keeping you signed in, and tracking your credits and plan.
• To prevent abuse, such as multiple free accounts, automated sign-ups, and attacks on the service.
• To email you about your account, such as sign-in links, password resets, and important changes. We don't send marketing email without asking first.
• To answer you when you contact us, and to meet legal obligations.

We don't sell personal information, share it with advertisers, or use it to build advertising profiles.

4. Who processes your data

We use these providers to run Grainwrite. Each processes data only to provide its service to us.

Some of these providers store or process data outside Canada, including in the United States and, for DeepSeek, in China. Where that happens, your information may be subject to the laws of that country.

5. Cookies and browser storage

• Sign-in session: kept in your browser's storage so you stay signed in.
• gw_did: the random browser identifier described above, kept for up to two years, used only for abuse prevention.
• Cloudflare Turnstile: may set cookies needed for the bot check.

We don't use advertising cookies or third-party tracking.

6. How long we keep it

Everything we hold about you is kept only while your account exists: your login, profile, usage records, abuse-prevention hashes, credits and promo code redemptions. Your text isn't kept at all.

You can delete your account at any time in Settings → Account. Deletion is immediate and permanent: your login and every record linked to it are removed from our database at the same time, and can't be recovered. If we close your account for breaking our Terms, the same deletion applies.

One record kept until the end of the month

If you used any credits in the month you delete your account, we keep a single record until the end of that month (UTC) with exactly two things in it:

• a one-way keyed hash of your email address. It's computed with a secret key and can't be turned back into your email address. It can only confirm a match if the same address signs up again;
• the number of credits you used that month.

It contains no email address, name, account ID, text or anything else. If the same email address signs up again that month, those credits still count towards the free allowance, so deleting and re-creating an account can't reset it. It's deleted automatically at the start of the next month. If you used no words in the month you delete your account, nothing is kept.

Separately, our payment provider keeps information it's legally required to keep, such as invoices for tax purposes. That stays with Stripe under its own retention rules.

The browser identifier stored on your own device (gw_did) is cleared when you delete your account from that browser, and you can also clear it yourself through your browser settings.

7. Your rights

You can ask us to:

• see the personal information we hold about you;
• correct anything that's wrong;
• delete your account and personal information. You can do this yourself, instantly, in Settings (see section 6 for the one temporary record kept);
• give you a copy of your data in a portable format;
• withdraw consent where we rely on it.

Email support@grainwrite.com from the address on your account, and we'll respond within 30 days. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.

8. Security

Connections to Grainwrite are encrypted. Database access is restricted so that each user can only read their own records, server credentials never reach your browser, and abuse-prevention signals are stored only as hashes. No system is perfectly secure, but we take reasonable steps to protect your information, and we'll tell you if a breach affects you.

9. Children

Grainwrite isn't intended for children under 13, or under 16 in the European Economic Area and the United Kingdom. We don't knowingly collect their information. If you believe a child has created an account, contact us and we'll delete it.

10. Changes to this policy

If we make significant changes, we'll update the date at the top and tell signed-in users by email or a notice on the site before the change takes effect.

11. Contact

Questions or requests: support@grainwrite.com.