Privacy Policy

Grammario provides a visual grammar analysis tool for language learners. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using Grammario you agree to the collection and use of information as described here. If you do not agree, please discontinue use of the service.

Account information

When you sign up we collect the email address and display name provided by your authentication provider (e.g. Google). We do not store passwords—authentication is handled by Supabase Auth.

Usage data

When you submit text for analysis we store the sentence, the target language, and the resulting analysis (part-of-speech tags, dependency trees, difficulty scores, vocabulary data, and AI-generated explanations). This data is linked to your account so you can review past analyses and track vocabulary over time.

Technical data

We automatically collect standard technical information such as IP address, browser type, device type, and pages visited. This data is used for security, debugging, and aggregate analytics.

• Provide and improve the grammar analysis service
• Power the spaced-repetition vocabulary review system
• Cache analysis results to improve response times
• Generate aggregate, anonymized statistics (e.g. most-studied languages)
• Detect and prevent abuse or unauthorized access
• Communicate service updates when necessary

We do not sell your personal data to third parties, and we do not use your data to train machine learning models.

We rely on the following third-party services to operate Grammario:

• Supabase — authentication and PostgreSQL database hosting. Stores your account data and analysis history.
• Vercel — frontend hosting, edge functions, and CDN delivery.
• OpenRouter / OpenAI — large language model API calls for pedagogical explanations. Only the raw sentence text is sent; no account information is included.
• Stripe — payment processing for Pro subscriptions and lifetime purchases. We never see or store your full card details. Stripe's privacy policy governs financial data.
• PostHog — product analytics. We collect anonymized behavioral events (e.g. pages visited, features used) to understand how the product is used. No personally identifiable information is sent unless you are signed in.
• Resend — transactional email delivery (welcome emails, password resets, billing confirmations). Your email address is shared solely for the purpose of sending messages you have requested.
• Redis (Upstash) — in-memory cache for analysis results and rate-limit counters. Cached data is automatically purged after 24 hours.

Each provider processes data in accordance with their own privacy policies. We encourage you to review them.

We use cookies and browser local storage solely for authentication session management and user preferences (e.g. selected language). We do not use advertising or cross-site tracking cookies.

Your account data and analysis history are retained for as long as your account is active. Cached analysis results are automatically purged after 24 hours. If you delete your account, we will remove your personal data within 30 days. Anonymized, aggregate data may be retained indefinitely.

All data is transmitted over HTTPS. Database access is restricted by row-level security policies enforced by Supabase. While we take reasonable precautions to protect your information, no method of electronic storage is 100% secure.

Regardless of where you are located, you may contact us at any time to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable format
• Withdraw consent at any time

EU / EEA residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local supervisory authority. Our legal basis for processing your data is performance of a contract (providing the service you signed up for) and legitimate interests (security, fraud prevention, and service improvement).

California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion of that information, and to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us at the address below.

Grammario is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Continued use of Grammario after changes constitutes acceptance of the updated policy.

This Privacy Policy and any disputes arising from it are governed by the laws of the Commonwealth of Massachusetts, United States of America, without regard to its conflict of law provisions. By using Grammario you consent to the jurisdiction of the state and federal courts located in Massachusetts for the resolution of any such disputes.

If you have questions or concerns about this Privacy Policy, please reach out via our contact page.