also searched as: is grammarly safe · is grammarly legit · is grammarly legitimate · is grammarly safe to use · is grammarly safe to download · is grammarly safe for confidential information · is grammarly secure
Kinda: Grammarly is well secured, but on Free and individual Pro accounts your writing can train its AI until you switch that off. Patient data is allowed only on Enterprise, with a signed agreement. Whether its AI detector is accurate is a separate question, with its own page.
Use it if you turn training off and use it for email, essays and everyday writing.
Be careful if you type client files or anything under NDA with the extension switched on.
Skip it if you handle patient records and your employer has no Enterprise plan with a signed Business Associate Agreement.
sources checked 2026-10-13 · by dan scutaru
| what we checked | what we found |
|---|---|
| Who owns it | Superhuman Platform Inc. Formerly Grammarly; its privacy policy, effective July 6, 2026, covers the whole Superhuman suite from a San Francisco address. source |
| Training on your writing | On by default for individuals Free, Premium and single-user Pro text can train its models; Enterprise, Education and plans bought through Sales start with it off. source |
| Selling data | Not your writing, it says The policy says your content is not used for advertising, but ad cookies on its sites may count as selling under some state laws. source |
| Certifications | SOC 2 Type 2, five ISO standards Grammarly lists SOC 2 Type 2 and SOC 3 reports plus ISO 27001, 27017, 27018, 27701 and 42001; the SOC 2 report is available on request. source |
| HIPAA | BAA on Enterprise only Grammarly signs a Business Associate Agreement only for Enterprise plans, and says no health data should go in without one. source |
| Google Project Zero, 2018 | Token leak, fixed in hours On February 2, 2018 a Google researcher showed any website could grab the Chrome extension's login token and read your documents; he marked it fixed three days later. source |
| Lawsuit | Pending, about writers' names Angwin v. Superhuman Platform, filed March 11, 2026 in New York federal court, alleges the Expert Review feature used real writers' names without consent. source |
Superhuman, which is Grammarly under a new name. Grammarly bought Coda in December 2024, making its founder Shishir Mehrotra chief executive, bought the email app Superhuman in July 2025, and renamed itself after it that October. The product kept its name.
Your account and documents stay put. What moved is the paperwork: grammarly.com/privacy-policy now redirects to one Superhuman policy covering Grammarly, Coda, Superhuman Mail and the Go assistant.
Not by the usual meaning. Grammarly says it does not record every keystroke and sees text only while you actively use one of its products. In practice that is any text box where the extension or desktop app is on, and that text goes to its servers to be checked.
Some features record what you type or paste, but only with your explicit permission. Websites can also switch Grammarly off on their own pages.
Only with a signed Business Associate Agreement, which Grammarly signs only for Enterprise plans. Its own rules say no protected health information without one, so Free and Pro are out.
The same logic applies to other confidential work. On Enterprise, training starts off, admins can block Grammarly on chosen domains and apps, and customers can bring their own encryption keys. On a personal account, you are the admin.
Not your writing, by its own account. Its privacy policy does say ad cookies on its websites may count as selling or sharing under some state laws, with an opt-out where those laws apply.
Yes on Free, Premium and single-user Pro, until you turn off Product Improvement and Training. It covers what you write wherever Grammarly runs, not only your AI prompts. Enterprise, Education and plans bought through Sales start with it off.
Open your Profile page and choose Delete Account at the bottom. It removes your personal information and Grammarly Editor documents, for good. With an active paid plan you need a support ticket; on a company plan, the admin removes you first.
Journalist Julia Angwin's class action says Expert Review, a paid feature, gave AI feedback under real authors' and academics' names without consent. Superhuman pulled the feature the day the suit was filed and calls the claims without merit. It is about other people's names, not users' documents.