Privacy Policy

1. Who we are

Rephrasely is an AI writing assistant delivered as a Chrome extension that rewrites text you select, and optionally checks spelling and grammar as you type. This policy covers the Rephrasely Chrome extension and the rephrasely.app website (together, the “Service”).

• Operated by: Sourav Suman, an individual developer based in Bangalore, India (“Rephrasely,” “we,” “us”). Rephrasely is not incorporated as a company.
• Contact: support@rephrasely.app
• Website: rephrasely.app

2. What we collect

We collect only what the Service needs to function. There is no anonymous “guest” mode: an account is required to use Rephrasely.

• Account information. When you sign in with Google, on the website or in the extension, we receive and store your email, name, profile picture URL, and a unique account ID, through Supabase Auth. We never see or store your Google password. The website and the extension share one account, so your plan and preferences are the same in both places.
• Draft text you submit for rewriting. When you click rephrase, the text in that field is sent to our backend and then to our AI provider (Google Gemini, or Groq as a fallback, see Section 5) to generate the rewrite or translation. This only happens on that explicit action: we don’t send whole pages, and we don’t target password fields or any other single-line <input>, only text areas and rich-text editors, enforced in code, not just policy. Where technically possible we try to exclude email signatures and quoted reply chains (for example, Gmail and HubSpot signature blocks) from what’s sent; this is a best-effort filter, not a guarantee, so avoid rewriting fields that contain information you don’t want processed by our AI providers.
• Live spelling and grammar checking, if you enable it. Off by default. If you turn on live underlines, text in the field you’re focused on is sent automatically, in small chunks, to our grammar-checking API as you type. You can disable this at any time.
• Preferences. The role you write as, who you write to, the tone you pick, a custom prompt if you save one, and your preferred language, so they carry over between sessions and are used only to personalize rewrites.
• Usage and billing data. How many free rewrites you’ve used and your plan status. Paid plans are processed through Dodo Payments, our payment processor: see Section 5.
• What we don’t collect. The extension itself uses no cookies, web beacons, or third-party analytics/advertising trackers. We don’t sell your personal information, and we don’t use your content to train AI models we operate (Section 5 covers what our AI sub-processors do with content, since they are separate companies with their own terms).

3. How we use it

To authenticate you and maintain your account, generate rewritten text and grammar suggestions in response to your actions, apply your saved preferences to those requests, enforce free-tier limits and track plan status, provide support if you contact us, detect abuse and maintain security, and comply with legal obligations. We don’t use your information for advertising, and we don’t build advertising profiles.

4. Legal basis for processing (EU/UK/EEA users)

• Contract (Art. 6(1)(b)): processing your account and content is necessary to provide the rewriting service you signed up for.
• Consent (Art. 6(1)(a)): enabling live grammar checking is opt-in, and you can withdraw consent at any time by disabling it.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, rate limiting, and service security.
• Legal obligation (Art. 6(1)(c)): where we must retain or disclose information to comply with law.

5. Who we share it with

We share information only with service providers (“sub-processors”) who help us operate the Service, under contracts limiting their use of your data to providing that service to us. We don’t sell your data or share it for cross-context behavioral advertising.

• Google (Gemini API). Text you submit for rewriting or grammar checking, to generate the rewrite or suggestions.
• Groq. The same text, only if Gemini is unavailable, as a fallback provider.
• Supabase. Account info, preferences, and usage data, for authentication and database hosting.
• Vercel. Requests passing through our backend and website, for hosting. Vercel also provides Web Analytics for the rephrasely.app website: aggregate page views, referring sites, and general device/location, to see how the site is used. It’s cookieless and doesn’t track you individually across sites.
• Upstash. Your account ID and request timestamps, not your content, for rate limiting to prevent abuse.
• Google (Sign-In). OAuth authentication data, so you can sign in with your Google account.
• Dodo Payments. Your email and payment details when you upgrade, to process payment and manage your subscription. We never see or store your card details ourselves.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may also disclose information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Rephrasely, our users, or others. If Rephrasely is acquired, merges, or sells its assets, your information may transfer as part of that transaction; we’ll notify you before your information becomes subject to a different privacy policy.

6. How long we keep it

We keep your account and preference data for as long as your account is active. When you ask us to delete your account or personal data, we delete it within 7 days, except where we’re required to keep it longer for legal, tax, or fraud-prevention reasons. Server logs from our backend API are kept for 7 days and then deleted automatically. Draft text you submit for rewriting is sent to our AI providers to generate the result and isn’t stored by us beyond that; see each provider’s own policy for their retention practices (Section 5).

7. International data transfers

Our service providers may process data in the United States and other countries outside your own. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on Standard Contractual Clauses or an equivalent safeguard with that provider, as set out in each provider’s own data processing agreement.

8. Your privacy rights

If you are in the EEA, UK, or Switzerland (GDPR)

You have the right to access the personal data we hold about you, correct inaccurate data, delete your data (the “right to be forgotten”), restrict or object to processing, receive your data in a portable format, withdraw consent at any time for consent-based processing like live grammar checking, and lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA/CPRA) or in another U.S. state with a comprehensive privacy law

You have the right to know what personal information we collect, use, and disclose; delete or correct it; opt out of the sale or sharing of personal information (we don’t sell or share it, so there’s nothing to opt out of); and not be discriminated against for exercising these rights.

How to exercise these rights

Email support@rephrasely.app with your request. We’ll verify your identity, typically via the email on your account, and respond within the time required by applicable law (generally 30 days under GDPR, 45 days under CCPA). There’s no self-service delete flow yet: email us and we’ll delete your account and data by hand, within 7 days.

9. Children’s privacy

Rephrasely isn’t directed at children, and we don’t knowingly collect personal information from anyone under 16 (or under 13 in the United States, per COPPA). If you believe a child has provided us with personal information, contact us and we’ll delete it.

10. Data security

We use industry-standard measures to protect your information: encrypted connections (HTTPS/TLS), Row Level Security on our database so users can only access their own data, and scoped API credentials. No method of transmission or storage is 100% secure, and we can’t guarantee absolute security.

11. Cookies

The Rephrasely Chrome extension doesn’t use cookies. The rephrasely.app website uses Vercel Web Analytics (see Section 5) to see aggregate traffic; it’s cookieless and sets no advertising cookies. Signing in stores your session in your browser’s local storage, not a cookie. Google’s own sign-in page may set its own cookies during that flow, governed by Google’s privacy policy, not ours. If we ever add cookie-based analytics or advertising, we’ll update this section and add a consent banner.

12. Chrome Web Store permissions

Rephrasely requests the following Chrome extension permissions, used only as described:

• storage: to save your preferences and session locally for fast access.
• identity: to let you sign in with Google.
• tabs: to open the settings popup and the upgrade page when you request them.
• Host permissions (quill-assist.vercel.app, our backend, and orfxjvtujnzktxhvfssm.supabase.co, our authentication service): to communicate with those two services and nothing else.

We request the minimum permissions necessary and don’t request broad host access to all websites for data collection: the extension only reads content from a field you’ve actively focused, when you choose to use a feature.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll update the “Last updated” date above and, where required by law, give additional notice such as an in-extension notification or email.

14. Contact

Rephrasely is operated by Sourav Suman, Bangalore, India. All privacy questions and requests go to support@rephrasely.app.