Grammarly is an AI writing-assistance product (browser extension, keyboard, desktop/web editor, and Microsoft Office/Google Docs integrations) whose core function requires sending the text a user types to Grammarly's servers for analysis. In October 2025/2026 the parent corporate entity rebranded as "Superhuman Platform Inc. (formerly Grammarly)", now also encompassing Coda (docs) and Superhuman Mail, acquired in 2025; Grammarly itself was founded in 2009 by Max Lytvyn, Alex Shevchenko, and Dmytro Lider and remains privately held. The privacy policy states the company does not sell uploaded content and monetizes via subscriptions rather than advertising of its own, but its browser extensions require the broad "access your data for all websites" permission, its policy discloses cookies/pixels used for interest-based advertising, and it self-declares disclosures to advertising and social networks that "may be considered 'sales', 'sharing'" under U.S. state privacy laws (with an opt-out). Users can opt out of having their content used for AI-model training. A 2018 Google Project Zero-discovered vulnerability (CVE-2018-6654) exposed the browser extension's authentication tokens to any website for a period before it was patched within hours; no other regulatory action, breach, or independent audit was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
The Firefox add-on listing for Grammarly (494,985 users) shows the required permissions include 'Access your data for all websites' and 'Access browser tabs', plus optional permissions to exchange messages with other programs and read the clipboard — an unqualified, sitewide data-access grant rather than a narrower per-site permission model.
As assessed by PrivacySpy on 2021-08-21 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Grammarly's privacy policy defines 'User content' broadly as content the user uploads or enables Grammarly's products to access — including emails, drafts, text, screen content, web pages, documents, files, calendars, and images — and separately discloses collection of voice recordings for users of Notetaker/transcription features, including recordings of other call participants.
Grammarly's own About page states the company was founded in 2009 by Max Lytvyn, Alex Shevchenko, and Dmytro Lider; that in 2025 it acquired Coda and Superhuman Mail; and that in October the company's corporate name changed to Superhuman, with Grammarly continuing as the writing-assistance product under the unified brand.
As assessed by PrivacySpy on 2021-08-21 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.
The privacy policy names the current legal-entity structure directly: the policy is issued by 'Superhuman Platform Inc. (formerly Grammarly) and our subsidiaries (such as Grammarly Inc., Coda Project LLC, and Superhuman Labs LLC) and affiliated companies (collectively, ‘Superhuman’...)' — confirming the rebrand and the multi-entity corporate structure from a primary legal document rather than press coverage alone.
Grammarly's own Trust page states the company does not and will not sell the content users upload to its products, that it makes money from subscriptions rather than by monetizing content, and that it does 'not help third parties advertise their own products to our users' — a narrower no-sell commitment specific to uploaded writing content, distinct from the broader personal-information disclosures described in the sales/sharing section of the privacy policy.
As assessed by PrivacySpy on 2021-08-21 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
Grammarly's privacy policy contains a 'Sales, Sharing, and Targeted Advertising' section stating that, to promote its products on third-party sites, it discloses personal information to advertising networks and social networks, and that 'these disclosures may be considered "sales", "sharing", or use of personal information for "targeted advertising" under State Privacy Laws' — a self-declared sale/share position under U.S. state privacy statutes, with an opt-out mechanism offered via a footer link.
Grammarly's Trust page states its product does not function as a keylogger ('A keylogger records every keystroke and sends data to a third party for the benefit of that party and does so without the user's knowledge. Grammarly's product doesn't fit any of these descriptions') and that users can opt out of allowing Grammarly to use their content to train its AI models via an account setting.
A GitHub Security Advisory (CVE-2018-6654, citing the underlying Google Project Zero bug tracker issue) documents that the Grammarly browser extension for Chrome, before it was fixed on 2018-02-02, exposed authentication tokens to any website via a crafted request, rated High severity with a CVSS score of 8.8 — a real, dated, named security incident affecting the extension's authenticated-session data.
As assessed by PrivacySpy on 2021-08-21 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
The privacy policy states Grammarly uses cookies, pixels, and local storage technology to collect technical/usage information and 'to recognize your browser or device', and separately says these Cookies are used, among other purposes, for advertising; the same policy's 'Technical information' section lists IP address, device type, apps installed on the device, browser plugin types/versions, operating system, and platform as automatically collected.