Privacy Policy

GramProof ("we," "us," or "our") operates the website gramproof.com and provides AI detection, plagiarism detection, grammar checking, readability analysis, fact-checking, content quality analysis, guideline checking, humanizer, citation generation, and related writing tools (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information that applies to our Service, as well as your choices regarding the collection and use of your information.

By accessing or using the Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy.

1. Information We Collect and Receive

1.1 Information You Provide to Us Directly

We collect the following information that you voluntarily provide when using the Service:

• Account information: When you create an account, we collect your email address and password. Your password is never stored in plaintext — it is hashed using salted scrypt before storage.
• Content you submit for analysis: When you use our AI detection, grammar checking, plagiarism detection, readability analysis, fact-checking, content quality, guideline checking, humanizer, or deep scan tools, you submit text for analysis. This text is transmitted through our server to the configured analysis provider and is not stored by GramProof after the response is returned to you.
• Uploaded documents: If you upload a document (such as a .docx file), the document is converted to plain text entirely within your browser. The original file is never transmitted to or stored on our servers.
• Citation data: When you use the Citation Generator, all formatting is performed entirely in your browser. No citation metadata is sent to our servers.

1.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information:

• Session identifiers: We set an HttpOnly cookie (gramproof_session) to track your anonymous scan quota. This cookie is signed with an HMAC server secret and expires after 24 hours.
• Authentication tokens: If you have an account, we set an HttpOnly cookie (gramproof_auth) to maintain your authenticated session. The token is stored server-side only as a SHA-256 hash and expires after 7 days.
• Hashed IP address: During authentication (login and signup), your IP address is hashed using SHA-256 and used solely for rate limiting. We do not store your IP address in plaintext.

1.3 Information We Do Not Collect

We want to be clear about what we do not do:

• We do not use third-party analytics, advertising trackers, remarketing pixels, or social media tracking tools.
• We do not collect device fingerprints, browser profiles, geolocation data, or telemetry.
• We do not access or store your clipboard content.
• We do not sell, rent, or trade your personal information to any third party.
• We do not use your submitted text to train any AI or machine learning model.

2. Our Use of Your Information

We use the information we collect for the following purposes:

• To provide and operate the Service: Process your submitted text through configured AI detection, grammar, readability, fact-checking, guideline, content quality, plagiarism analysis, humanizer, and deep scan providers and deliver results back to you.
• To authenticate your account: Verify your identity when you sign up, log in, and access your dashboard and scan history.
• To enforce usage limits: Track anonymous and authenticated scan quotas to ensure fair use. Anonymous users receive up to three free AI detection scans per UTC day.
• To prevent abuse and protect security: Rate-limit authentication attempts (10 per email per 15 minutes; 30 per IP per minute) to guard against brute-force and credential-stuffing attacks.
• To maintain and improve the Service: Diagnose technical issues and improve reliability. Server-side logging of submitted text is disabled by default.

3. Cookies

GramProof uses only essential cookies required for the Service to function. We do not use advertising, marketing, preference, or analytics cookies of any kind.

• gramproof_session — Essential, HttpOnly, SameSite=Strict. Expires after 24 hours. Used to identify your anonymous scan quota across page refreshes. Signed with a server-side HMAC secret.
• gramproof_auth — Essential, HttpOnly, Secure (in production), SameSite=Strict. Expires after 7 days. Used to maintain your authenticated session. The token value is hashed before server-side storage.

You can clear your browser cookies at any time. Clearing the session cookie resets your anonymous scan quota identity. Clearing the authentication cookie signs you out.

4. Sharing of Your Information with Third Parties

We do not sell your personal data. We share information only in the following limited circumstances:

4.1 AI Analysis Providers

When you run a scan, your submitted text is transmitted through our server to third-party AI analysis providers for processing. We currently use OpenRouter, which routes requests to appropriate AI models via its Auto Router. Only your submitted text and the analysis prompt are included — no personal account information, email address, or identifying details are sent to these providers.

Third-party providers operate under their own privacy policies and data retention practices. We select providers that do not use submitted content for model training, but we cannot guarantee their internal data handling. We encourage you to review the privacy policy of OpenRouter and any other provider whose services may process your content.

4.2 Infrastructure

GramProof is hosted on Cloudflare Workers with Cloudflare D1 for database storage. Cloudflare processes requests as part of delivering the Service and operates under its own privacy policy.

4.3 Legal Requirements

We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to comply with applicable laws, respond to a court order, judicial or other government subpoena or warrant, or cooperate with law enforcement or regulatory agencies.

5. Data Storage and Security

We implement the following security measures to protect your data:

• Password hashing: Passwords are hashed using salted scrypt (N=32768, r=8, p=3) with a 256-bit random salt. Plaintext passwords are never stored, logged, or accessible to our team.
• Session token security: Session tokens are generated from 256 bits of cryptographically secure randomness and stored only as SHA-256 hashes. The raw token is never retained server-side.
• Timing-safe verification: All password and session token comparisons use constant-time algorithms to prevent timing-based attacks.
• Rate limiting: Brute-force protection is enforced per hashed email and per hashed IP on all authentication endpoints.
• Database permissions: Authentication databases are created with restricted file permissions (mode 0600). Production deployments use Cloudflare D1 with encrypted-at-rest storage.
• Transport encryption: All connections to gramproof.com use HTTPS/TLS. Authentication cookies include the Secure flag in production environments.
• Cookie hardening: All cookies are HttpOnly (inaccessible to client-side JavaScript) and SameSite=Strict (mitigating CSRF attacks).
• Input validation: All request bodies, origins, text lengths, and API response sizes are validated and bounded on every endpoint.
• No persistent text storage: Submitted text is processed in-transit and discarded after the analysis response is returned. It is not written to any database or log file.

While we employ commercially reasonable security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data. If you discover a security vulnerability, please contact us promptly at the address in Section 11.

6. Data Retention

We retain your information only as long as necessary for the purposes described in this policy:

• Submitted text: Not retained. Processed in-transit and discarded immediately after the analysis response is delivered.
• Scan results and history: Stored in your browser session memory only. Not persisted on our servers. Cleared when you close or refresh the browser tab.
• Anonymous session cookies: Expire after 24 hours. Server-side quota records reset daily at UTC midnight.
• Authenticated sessions: Expire after 7 days. Expired sessions are deleted automatically. A maximum of 10 concurrent sessions per account is enforced.
• Rate-limit records: Expire after 15 minutes (per-email) or 1 minute (per-IP) and are purged on the next rate-limit check.
• Account data: Your email address and password hash are retained until you request account deletion.

7. Your Rights and Choices

Depending on your location and applicable laws, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your account and all associated personal data.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Request your personal data in a structured, commonly used, machine-readable format.
• Right to object: Object to the processing of your data where we rely on legitimate interests as the legal basis.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@gramproof.com. We will respond within 30 days of receiving your request.

You may also use the Service without creating an account. Anonymous usage relies solely on a session cookie for quota tracking purposes.

8. Children’s Privacy

The Service is not directed to individuals under the age of 13 (or the applicable minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under this age. If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at privacy@gramproof.com and we will take steps to delete such information.

Educators using GramProof in a classroom setting are responsible for ensuring compliance with applicable student data protection laws (including FERPA and COPPA in the United States) and should not submit personally identifiable student information through the Service.

9. International Data Transfers

GramProof is hosted on Cloudflare’s global network. Your data may be processed in data centres located outside your country of residence. When your text is sent to third-party AI providers, it may also be processed in other jurisdictions.

By using the Service, you acknowledge and consent to such transfers. We use providers that implement appropriate data protection safeguards consistent with applicable data protection laws.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Effective" and "Last updated" dates at the top of this page.
• We will post the revised policy at this URL.
• For material changes, we may notify registered users by email or through a prominent notice on the Service.

Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

GramProof
Email: privacy@gramproof.com
Website: gramproof.com

We will endeavour to respond to all legitimate requests within 30 days. If you are unsatisfied with our response, you may have the right to lodge a complaint with your local data protection authority.