Privacy Policy

🗺️ Data Flow by Mode — At a Glance

Grambo operates in three distinct modes. The table below summarises exactly what data flows where in each mode:

📋 1. Introduction & Scope

This Privacy Policy ("Policy") describes how Grambo App ("Grambo", "we", "our", or "us") collects, uses, and protects information when you use the Grambo macOS application ("App") and the Grambo website at gramboapp.com (the "Website").

By downloading or using Grambo, you agree to the practices described in this Policy. If you do not agree, please discontinue use of the App and Website.

This policy applies to all users of Grambo, including those using the free trial, Monthly subscription, and Lifetime license.

✍️ 2. Your Writing Data — The Most Important Section

2.1 Offline / Local AI Mode

When you use Grambo in Offline or Local AI mode, all AI processing happens exclusively on your Mac using on-device models (e.g., Llama, Qwen via Ollama). Your text is never transmitted to Grambo's servers or any external service. This is the default mode and offers the highest level of privacy.

2.2 BYOK (Bring Your Own Key) Mode

In BYOK mode, the text you select for grammar checking is sent directly from your Mac to the AI provider whose API key you have configured (e.g., OpenAI, Anthropic, or Google). This communication occurs entirely between your device and the third-party provider — it does not pass through Grambo's servers at any point.

Your API keys are stored securely in your Mac's system keychain. Grambo never transmits your API keys to our servers.

2.3 Grambo Cloud Mode

When you opt in to Grambo Cloud (available on the Monthly subscription plan), the text you select for processing is transmitted to Grambo's backend infrastructure. Our backend then securely forwards the request to the appropriate AI service provider to generate a correction. The corrected text is returned to your device.

• What is sent: Only the text you explicitly select and submit for grammar checking.
• What is NOT sent: Your full document, clipboard contents, background keystrokes, or any other data outside the selected text.
• Retention: Processed text is used solely for fulfilling the correction request. We do not store your text after the request is completed.
• No training: Your writing is never used to train, fine-tune, or improve any AI model.

🌐 3. Website & Analytics Data

When you visit gramboapp.com, we collect standard web analytics data to understand how the website is being used and to improve our product. This includes:

• Analytics (Google Analytics 4): Page views, session duration, referral sources, geographic region (country/city level), device type, and browser type. This data is anonymised and aggregated. Google Analytics may set cookies in your browser in accordance with Google's Privacy Policy.
• Log data: IP addresses, HTTP request logs, and server access logs may be retained for up to 30 days for security and operational purposes.
• Cookies: We use first-party and Google Analytics cookies for session management and analytics. No advertising cookies or trackers from ad networks are used.

💳 4. Account & Payment Data

Grambo uses Lemon Squeezy as its payment processor and subscription management platform. When you purchase a subscription or lifetime license:

• Payment details (credit/debit card information) are collected and processed by Lemon Squeezy, not by Grambo directly. We do not store or have access to your raw card details.
• We receive from Lemon Squeezy: your email address, subscription status, license key, and transaction ID. This information is used to manage your subscription and provide customer support.
• Your email address may be used to send transactional emails (e.g., receipt, license key delivery, subscription renewal reminders). We do not send marketing emails without your explicit consent.

Lemon Squeezy's handling of payment data is governed by the Lemon Squeezy Privacy Policy.

🤖 5. No AI Training — Explicit Commitment

We want to be unambiguous about this:

• Grambo does not use any of your writing or text data to train, fine-tune, evaluate, or otherwise improve any AI or machine learning model.
• This commitment applies to all modes: Offline, BYOK, and Grambo Cloud.
• When using Grambo Cloud, we act as a conduit between your device and the AI service provider. We do not retain or repurpose your text for our own benefit.
• We do not sell, license, or otherwise commercialise your writing data.

🔐 6. Data Security

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS / TLS encryption for all data transmitted to and from Grambo's servers.
• Keychain storage for API keys on your Mac — they are never transmitted to our servers.
• Minimal data collection — we only collect what is necessary to provide the service.
• No logging of text content — request payloads (your selected text) are not written to our application logs.

Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.

🤝 7. Third-Party Services & Data Sharing

We do not sell your personal data. We may share limited data with the following third-party services solely to operate Grambo:

• Lemon Squeezy – Payment processing and subscription management.
• Google Analytics – Anonymised website usage analytics.
• AI Service Providers (Grambo Cloud only) – Your selected text is forwarded to the AI provider (e.g., OpenAI, Anthropic, Google) via our backend to generate the correction. Text is not retained by us after the response is delivered.
• Cloud Hosting Provider – Our backend infrastructure is hosted on a reputable cloud platform. Hosting providers may have access to server-level data under their own privacy policies.

We do not share your data with advertisers, data brokers, or any other third parties beyond those listed above.

🧒 8. Children's Privacy

Grambo is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will delete it promptly. If you believe we have inadvertently collected such information, please contact us at support@gramboapp.com.

🌍 9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal obligations.
• Right to restriction of processing: Request that we limit how we use your personal data.
• Right to data portability: Receive your personal data in a structured, machine-readable format.
• Right to object: Object to processing of your personal data for certain purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at support@gramboapp.com. We will respond within 30 days.

🔗 10. Links to Third-Party Websites

Our website and app may contain links to third-party websites (e.g., OpenAI, Anthropic, Google, GitHub). These links are provided for your convenience and do not imply our endorsement of those websites. Grambo has no control over, and takes no responsibility for, the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any third-party sites you visit.

📝 11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Post a notice on our website for a reasonable period.

We encourage you to review this Policy periodically. Continued use of Grambo after changes are posted constitutes your acceptance of the updated Policy.

⚖️ 12. Legal Basis for Processing (GDPR)

Where the GDPR applies, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to deliver the service you subscribed to (e.g., processing payment data, managing your licence).
• Legitimate interests: Anonymised analytics to improve the product and detect abuse.
• Consent: Where we rely on consent (e.g., marketing communications), you may withdraw it at any time.
• Legal obligation: Where required to comply with applicable laws.

🏠 13. Data Retention

We retain your personal data only as long as necessary for the purposes described in this Policy:

• Subscription & account data: Retained for the duration of your subscription and for up to 3 years thereafter for tax, legal, and dispute resolution purposes.
• Analytics data: Retained in aggregated form for up to 26 months via Google Analytics standard data retention settings.
• Server logs: Retained for up to 30 days.
• Writing / text data (Grambo Cloud): Not retained. Discarded immediately after the correction response is returned to your device.