privacy policy

the short version

• gram can't see the pages you visit until you open it (right-click → find a word here, or Alt+Shift+G). it does not watch what you type or browse.
• when you ask for a word, it sends a short snippet around your cursor plus your description to our server, which passes it to an AI model to get suggestions.
• we don't save your text or descriptions to a database.
• for accounts, we store a one-way hash of your email, never the address itself.
• no ads, no analytics, no tracking, and we don't sell or share your data for marketing.

1. what gram reads on the page

gram doesn't ask for access to the websites you visit. when you open it, your browser gives it temporary access to that one tab (chrome's activeTab permission), and gram adds the tooltip there. the access ends when the tab navigates to another page or closes. gram does not log keystrokes, record browsing history, or read pages in the background.

when you open the tooltip in a text field, an editable area, or a google docs document, gram reads up to 30 words before and 30 words after your cursor (at most 900 characters on each side). if you've selected text, the selection marks the gap to fill and is left out of what gets sent.

gram never reads password fields. if you close the tooltip without asking for a word, nothing leaves your browser.

2. what gets sent when you ask for a word

when you submit a description, the extension sends this to our server at api.gramext.dev:

• the snippet from section 1, with the gap marked by an underscore,
• your description of the word you want (up to 500 characters),
• which model you picked (claude or gemini), and
• your session token, so we know you're signed in.

the request does not include the page's address, its title, or anything else about the site you're on.

our server forwards the snippet and description to openrouter, which routes them to the model you chose: anthropic's claude or google's gemini. those companies process the text to generate suggestions under their own privacy policies and data-retention terms. the request we send them doesn't include your email, account id, or ip address.

please don't use gram on text you aren't comfortable sharing with these AI providers.

3. what our server keeps

suggestion requests

• not saved to a database. your snippet and description are used to answer the request, then discarded.
• short-lived cache. the suggested words are cached in server memory for up to 10 minutes so that sending the same request again returns the same results. the cache is keyed by a one-way hash of the snippet and description, not the text itself, and it is cleared whenever the server restarts.
• diagnostic logs. for each request, our server logs the suggested words and the model's brief note on what kind of word fits the gap and its tone. these notes can paraphrase what you wrote. the log entries aren't linked to your account, email, or ip address.

accounts

you need an account to use gram. we store:

what	how
email	a sha-256 hash of your lowercased email, never the address itself. we use it to find your account at sign-in.
password	an argon2id hash, if you signed up with email. we can't see your password.
google account id	if you sign in with google, the numeric id google assigns your account.
sign-in sessions	a hash of each session token, plus when it was created and when it expires (30 days). signing out deletes it.
account creation date	when the account was created.

because we only keep a hash of your email, we can't read your address or send you email.

sign in with google

google sign-in asks only for the openid and email permissions. our server sends the access token to google once to confirm your account id and that your email is verified, then throws the token away. gram can't see your google contacts, files, docs, or anything else in your google account.

abuse protection

to slow down password guessing, our server keeps the ip address of sign-in and sign-up requests in memory for up to 15 minutes. it isn't written to disk or tied to your account. like most web services, our hosting provider may also keep standard network logs, such as ip addresses and request times.

4. what's stored in your browser

the extension uses your browser's extension storage (on this device only, not synced) to keep:

• your session token and its expiry date,
• the label shown in the extension menu: your email address if you signed in with email, or "google account" if you used google, and
• which model you last picked.

signing out deletes the session and label. removing the extension deletes all of it.

5. who we share data with

we share data only with the services needed to run gram:

• openrouter, and through it anthropic or google, to generate suggestions (section 2),
• google, to verify google sign-ins,
• neon, which hosts our database (section 3, accounts), and
• our hosting provider, which runs the server.

we don't sell your data, use it for ads, or share it with data brokers. we'll disclose data only if the law requires it.

6. limited use

gram's use and transfer of information received from google apis adheres to the google api services user data policy and the chrome web store user data policy, including their limited use requirements. we use data only to provide gram's word suggestions and sign-in. we don't transfer it for any other purpose, use it for advertising or creditworthiness, or let humans read it except when you ask us to, for security, or to comply with the law.

7. this website

this website has no cookies, analytics, or tracking. its pages load some fonts from google fonts, which receives your ip address when those fonts load.

8. your choices

• don't send it. nothing is sent until you submit a description.
• sign out from the extension menu to delete your session on our server and in your browser.
• delete your account by emailing [email protected] from the address you signed up with. we'll delete your account and all its sessions.
• remove the extension to delete everything gram stored in your browser.

depending on where you live, you may have rights to access, correct, or delete your data, or to object to how it's used. email us and we'll help.

9. security

everything between the extension, our server, and our providers travels over https. passwords are hashed with argon2id, session tokens and emails are stored only as hashes, and only the extension is allowed to call our api from a browser. no system is perfectly secure, but we keep as little as we can, so there's less to lose.

10. children

gram isn't directed at children under 13, and we don't knowingly collect data from them. if you think a child has created an account, email us and we'll delete it.

11. changes

if we change what gram collects or how it's used, we'll update this page and the date at the top. we'll ask for your permission before using data in a materially different way.

12. contact

questions or requests: [email protected]