Your writing.
Your data.

The short version

• Spelling and grammar checks run on your PC. They never send your text anywhere, on any plan.
• AI features send your text to our server and on to an AI model, the free plan's AI rewrites included, an OpenAI model run by Microsoft Azure in the EU, reached through OpenRouter, to get suggestions and rewrites. We never store or log that text, and neither OpenRouter nor Azure keeps it or trains on it (see below).
• We keep your account: your email address, your plan and subscription, your signed-in devices, a password if you set one (only as a hash), daily counts of how much AI you used, and how you heard about Emend if you tell us. We never keep what you wrote.
• Polar sells Pro. If you buy it, you pay Polar, which handles your card and sends your receipts. Your card never reaches us.

What Emend reads on your PC

Emend reads the text of the field you're typing in only when you ask it to, with the check or rewrite shortcut, the tray menu or the card's buttons. It doesn't watch what you type in the background. When you accept a fix, Emend writes it straight into the field, not through your clipboard. It puts text on your clipboard only when you press a Copy button, and never reads it.

Emend doesn't read password fields, password managers or terminals.

What stays on your PC

• Spelling and grammar checking runs entirely on your PC and sends nothing anywhere.
• Your settings, personal dictionary and custom styles are in a file in your Windows profile. Uninstalling Emend deletes it.
• Your sign-in is a session token, stored on your PC in a file that Windows encrypts for your account. Uninstalling Emend deletes it.
• Whether Emend asked you to rate it in the Microsoft Store, and up to three dates on which you accepted fixes, so it asks only after you've used it a while. They're in a small file in your Windows profile, which uninstalling Emend deletes.
• Recent AI results are kept in memory while Emend runs, so text you haven't changed isn't sent again. They're never written to disk.
• A diagnostic log (%LOCALAPPDATA%\Emend\diag.log) is written only while you have Diagnostics on in Settings › About, which turns itself off after 24 hours, or while Emend runs with the EMEND_DIAG=1 setting. It records the apps you checked text in, the steps, timings and error codes, never your text. It stays on your PC unless you send it to us.
• A crash log (%LOCALAPPDATA%\Emend\crash.log) gets a short note if Emend crashes: its version, the time and where in Emend's code it stopped. Never your text. It also stays on your PC unless you send it to us.

What leaves your PC

To sign in. Everyone signs in once, including on the free plan. You give us your email address, or sign in with Google.

• Email sign-in: we email you a one-time code.
• Password: if you set one, you can sign in with it instead of a code. We keep only a hash of it, and email you each time a password is set or changed.
• Google sign-in: Google tells us your email address and an account ID. We don't get your password or anything else from your Google account.

When a sign-in makes your account, we ask how you heard about Emend, with a list to choose from. Answering is optional.

Emend also sends your PC's name (for example "DESKTOP-1234 (Windows)"), so you can tell your signed-in devices apart.

From Emend to your account page. When you choose Upgrade or Manage account in Emend, the app asks our server for a one-time code and opens getemend.com with it in your browser, so the page opens signed in to the same account. Your browser passes through Emend on your PC on the way, so the code works only on the computer that asked for it. The code works once, within a minute, and our server keeps only a hash of it.

For AI features. AI checks are part of Pro. Rewrites are part of Pro, and the free plan includes a few each month. When you run an AI check or a rewrite, Emend sends the paragraphs involved to our server over an encrypted connection. With them go your writing goals, the English variant and kinds of suggestions you chose, the style or instruction you chose, and the app's version. Our server sends the text and instructions to the AI model through OpenRouter and passes the results back to you.

• We don't send OpenRouter or Azure your email address, your name or your account ID.
• Our server never stores or logs your text or the results. Once your results are sent, the text is gone from our server.

Each request to our server carries the app's version, so we can tell very old versions to update.

Your account on getemend.com

You can sign in on getemend.com to see your plan, buy or manage Pro, set a password, see and sign out your devices, download your data or delete your account. You sign in there on the same pages of our server as in the app.

• Cookies. The website sets three cookies, all needed to sign you in, and no others. One holds your session while you're signed in. It lasts 30 days after your last visit, and goes when you sign out. Another holds a sign-in while it's under way, for up to 15 minutes, and goes when the sign-in ends. The third holds Emend's one-time code while your account page opens, for up to 2 minutes, and goes as soon as it's used. None of them tracks you, and the website shows no ads.
• Counting visits. The website's public pages load Cloudflare Web Analytics, which counts visits and measures how fast the pages load. The sign-in and account pages don't load it. It records the page's address without anything after a "?", the site that linked you there, your browser, operating system and type of device, and your country, which Cloudflare works out from your IP address. It sets no cookies, stores nothing on your device and doesn't follow you to other sites. We see only totals, never a single visit.
• Your browser's name. The website tells our server a short name for your browser, such as "Chrome on Windows", so you can tell your devices apart. It never sends or keeps your browser's full details.
• Cloudflare. The website runs on Cloudflare's servers, so what your account page shows and sends passes through them, over encrypted connections. The website keeps no logs of your visits.

Paying for Pro: Polar

Polar Software, Inc., in the United States, sells Emend Pro as our merchant of record. Polar takes your payment, adds any tax and sends your receipts.

• What you give Polar. On Polar's checkout page you give your card and billing details, such as your name and billing address. Stripe, Polar's payment processor, handles the card. Your card never reaches us, and we don't keep your name or billing address.
• What we send Polar. Your email address and a random ID we made for your account, so the subscription belongs to your account.
• What Polar tells us. Your subscription's status, when its paid month or year starts and ends, and whether it's set to end. We keep that with your account.
• When you delete your account, we ask Polar to delete your customer record, which ends your subscription at once. Polar keeps the records of past payments that the law requires of a seller.

Polar's privacy policy: https://polar.sh/legal/privacy-policy

What we keep

Our server's logs record which kind of request was made, whether it worked, how long it took and your account number. They never record your text, your IP address or what your app sent.

Backups. Our server keeps a copy of its database from each night for 14 days, OVHcloud keeps backups of the server for a shorter time, and we keep a weekly copy on an encrypted computer of ours for 30 days. They hold everything in the table above. When you delete your account, or something above reaches the end of its time, it can stay in those backups for up to 30 days longer, until they're replaced. We only use backups to recover from a failure, and if we ever restore one, our server deletes again, by itself, every account deleted before it.

We don't sell your data, show ads, or use your text to train AI models.

How we protect it

• Everything between Emend, our website and our server is encrypted (HTTPS, TLS 1.2 or newer).
• Sign-in codes and session tokens are stored only as keyed hashes, so a copy of our database can't sign anyone in.
• We store passwords only as Argon2id hashes, which are slow to guess on purpose. After 10 wrong passwords for an email in an hour, that email can sign in only with a code.
• On the website, setting a password or deleting your account needs a sign-in in the last 10 minutes, and changing a password needs that or the current password. Opening the account page from the app doesn't count as a sign-in.
• The database can't be reached from the internet. Only our server talks to it.
• The weekly copy of the database is kept on an encrypted disk.

The AI model: OpenRouter and Microsoft Azure

AI features use an OpenAI model that Microsoft runs on Azure in the EU. Our server reaches it through OpenRouter, a company in the United States that passes each request on to Azure and the answer back.

• Nobody keeps your text. Every request we send requires zero data retention: OpenRouter only passes it to an endpoint that keeps neither the text nor the answer, and fails the request rather than send it anywhere else. OpenRouter doesn't store the text or the answer itself.
• Nobody trains on it. Neither OpenRouter nor Azure uses what we send to train or improve models.
• What OpenRouter does keep is a record of each request without its content: when it was made, which model answered, how many tokens it used, how long it took and what it cost. To rank models, it also sorts a small sample of requests into topics, using a model that keeps no data, and keeps only the topic, never tied to our account.
• Where it goes. Azure runs the model in the EU. On the way, a request may pass through OpenRouter's systems outside the EU.

If you don't want your text to leave your PC, use Emend without AI features: spelling and grammar checks never send your text anywhere.

OpenRouter's policies: https://openrouter.ai/privacy and https://openrouter.ai/terms

Who else handles your data

Why we may use your data

The GDPR and the UK GDPR ask us to name the legal basis for each use of your data.

• To give you Emend under our terms of use. This covers your account and sign-in, your plan and subscription, your signed-in devices, your account page and the app's one-time codes for it, AI checks and rewrites, Pro's AI allowance, and the email address and account ID we send Polar.
• Our legitimate interest in keeping Emend safe and running. This covers the sign-in limits (the IP addresses and email counts in "What we keep"), our server's logs, what AI costs us each day, ignoring a message Polar sends twice, the backups, and answering emails you send us.
• Our legitimate interest in keeping our promise to delete. This covers the record of deleted accounts and its copies, so that restoring a backup can't bring a deleted account back.
• Our legitimate interest in learning how people find Emend. This covers your answer to "How did you hear about Emend?" and the website's visit counts.
• The law. Polar keeps records of past payments because the law requires them of a seller, under its own privacy policy.

We don't use your data for anything that would need your consent, such as marketing emails or following you across other sites. Emend makes no decisions about you by automated means that have legal or similarly significant effects.

Data that leaves the UK and the EU

Our server is in the United Kingdom, which the EU recognises as protecting personal data to its standard. Azure runs the AI model in the EU. Your data also goes to two other countries.

• The United States. OpenRouter, Polar, Resend and Cloudflare have each agreed to the European Commission's standard contractual clauses in their data processing terms with us, with the UK's addendum for data from the UK. Google is certified under the EU-US Data Privacy Framework and its UK extension.
• Jordan. Emend is run from Jordan. We look after the server from there, and keep the weekly copy of the database there, on an encrypted disk. Neither the EU nor the UK has recognised Jordan as protecting personal data to its standard.

Your choices and rights

• Use Emend without AI. If you don't use AI checks or rewrites, your text stays on your PC.
• Sign out in Emend's settings, or on your account page at getemend.com, where you can sign out any device or browser, or all of them at once. Our server deletes each session you sign out.
• Cancel Pro on your account page, with Manage billing. Pro stays until the end of the month or year you've paid for.

Wherever you live, you have the rights below, which the GDPR and the UK GDPR give people in the EU and the UK. Use your account page, or write to privacy@getemend.com from the address you signed in with. We answer within a month.

• See your data, and take it elsewhere. Download my data on your account page gives you a copy of what "What we keep" lists for your account, in a file other services can read (JSON). It holds your email address, plan, subscription, devices, daily AI use, and the sign-in emails and wrong passwords we still keep for your email. It has no text, because we never keep any, and no hashes of your password, codes or tokens. To get a copy by email, write to us.
• Correct it. Write to us to correct your data, such as a change of email address.
• Delete it. Delete your account on your account page, after signing in again, or by emailing us. On the page it's deleted at once, and by email within 30 days. Your account, password, plan, subscription record, devices and usage counts go, and a Pro subscription ends at once, with no refund for the rest of the month or year. Our backups keep them up to 30 days more (see "Backups"). We keep your account's random ID and the date for 35 days, so that restoring a backup can't bring your account back.
• Limit what we do with it. While you challenge whether your data is right, or whether we may use it, you can ask us to keep it without otherwise using it.
• Object. You can object to the uses that rest on our legitimate interest (see "Why we may use your data"). We'll stop, unless our reason outweighs yours, as stopping abuse of sign-in usually does.
• Complain. You can complain to the data protection authority where you live or work, such as the ICO in the UK. Please write to us first, so we can try to put it right.

Children

Emend isn't meant for anyone under 16.

Changes

If we change this policy, we'll update the date at the top. If a change affects what leaves your PC, we'll tell you in the app first.

Contact

H.Sami (Emend), Jordan. privacy@getemend.com