Privacy policy

Summary

• Only the text you choose to rewrite is sent, and only when you ask for a rewrite.
• That text goes through our server to our AI provider to create the suggestion. We do not store it and never write it to logs.
• Text templates you choose to save are stored on your account until you delete them.
• We do not collect page content, browsing history or conversation history, and never touch password fields.
• No advertising, no tracking cookies, no sale of data.
• You can delete your account and all associated data at any time from your dashboard.

Who we are

Wordmend (“we”, “us”) is a Chrome extension and website that help you rewrite, correct and translate the text you write in web text fields. It is published by an individual based in France, who is the data controller for the processing described here. Contact: privacy@wordmend.com.

What we process, why, and on what legal basis

Account data

Your email address and a securely hashed password (never stored in plain text), to create your account, sign you in and secure it. Legal basis: performance of our contract with you (the terms of the service).

Text you submit for rewriting

When you ask for a rewrite (floating button, toolbar icon or keyboard shortcut), the extension sends the text of that field — or only the part you selected — with the options you chose (operation, tone, target language, your own instruction) to our server, which forwards it to our AI provider and returns the suggestion. We do not store this text or the suggestion after the request completes, and they are never written to our logs. Legal basis: performance of the contract.

Usage metadata

For each request we record the time, operation, tone, number of characters, AI model, token counts, estimated cost, and whether it succeeded — never the text itself. We use it to apply daily limits, prevent abuse, keep the service reliable and understand its costs. Legal basis: our legitimate interest in running a secure and sustainable service.

Settings

Your preferences (default operation and tone, preferred language, floating button setting and sites where Wordmend is turned off) are stored with your account so they follow you on every device. The extension also keeps them in Chrome's own storage; if you use Chrome sync, Google syncs them between your browsers. Legal basis: performance of the contract.

Text templates

If you save a template, its name and text are stored on your account so you can insert it on any device, with how often and when it was last used to sort your list. Templates are only saved when you choose to save one. Inserting a template does not send it to the AI provider. Legal basis: performance of the contract.

Emails we send you

Only account and security emails: a welcome email when you sign up, password reset links, a notice when your password changes and a confirmation when you delete your account. No newsletters or marketing. Legal basis: performance of the contract and the security of your account.

Billing data

If you subscribe to Pro, payment is handled by our payment provider, Stripe. We receive your subscription status and renewal date, never your card details. Legal basis: performance of the contract and our legal accounting obligations.

What we do not collect

• The content of the pages you visit, other fields on the page, or text you did not choose to rewrite.
• Your browsing history or the list of sites you use.
• Conversation or message history from the sites you write on.
• Anything typed in password, payment or one-time-code fields. The extension never reads or modifies them.

Who processes data for us

We use a small number of providers, each only for the purpose below:

• Anthropic (United States) — the AI model that writes the suggestion. Under its commercial terms, Anthropic does not train its models on the text we send, and deletes API inputs and outputs within 30 days, unless longer retention is needed to enforce its usage policy or to comply with the law.
• Railway (United States) — hosting of our server and database (account, settings, templates, usage metadata).
• Vercel (United States) — hosting of this website.
• Resend (United States) — delivery of the account and security emails above (your email address and the content of those emails).
• Stripe — payment processing, once paid plans are available.

Some of these providers are located outside the European Union. Transfers rely on the safeguards they offer, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. The website's fonts are served from our own domain: no third-party font or analytics service sees your visit.

Cookies and local storage

The website sets a single essential, HttpOnly cookie that keeps you signed in; scripts cannot read it. There are no advertising, analytics or third-party tracking cookies, so no consent banner is needed. The extension stores your session and preferences in Chrome's extension storage, which websites cannot access.

How long we keep data

• Text submitted for rewriting: not kept after the request (our AI provider: up to 30 days, as described above).
• Account data, settings, templates and usage metadata: while your account exists; deleted when you delete it.
• Password reset links: expire after one hour and can be used once.
• Technical server logs (no message text): kept for a short period by our hosting provider for security and troubleshooting.
• Billing records: kept for the period required by French accounting law.

Your rights

Under the GDPR you can access, correct, export or delete your data, restrict or object to its processing, and give instructions about what happens to it after your death. You can delete your account and all associated data yourself from the dashboard. For any other request, write to privacy@wordmend.com; we answer within one month.

If you think your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or the authority of the EU country where you live.

Children

Wordmend is not intended for children under 15, and we do not knowingly collect their data.

Security

All connections are encrypted (HTTPS). Passwords are hashed, sessions expire after a short time and can be revoked, and the extension's interface is isolated from the pages it runs on.

Changes to this policy

We will update the date above and, for significant changes, let you know by email or in the product.