Privacy Policy.

1. Controller and contact

The controller of personal data is Michał Kluska, ul. Widokowa 15, 32-085 Modlnica, Poland, NIP (tax ID) 9492114948.

Contact for personal data matters: prywatnosc@englisher.app.

We have not appointed a data protection officer. For personal data matters, write to the address above.

2. What data we process

• Email address given when signing in. It is stored encrypted (AES-GCM) in the database, alongside an HMAC-SHA-256 hash used only to look up the account. The address cannot be recovered from the hash alone.
• Sign-in codes — the database holds not the code but its HMAC. The code is valid for 10 minutes and is limited to three attempts.
• Sessions — session ID, time of creation and last use, and the HMAC of the token. We do not store the token itself. A session expires after 90 days.
• Entitlement token — information about the plan and purchased features, signed with an Ed25519 key and valid for 30 days. The application verifies it offline, without asking the server.
• Purchase data from Stripe — customer and payment IDs, the purchased product, subscription status and expiry date. We do not receive or process card data.
• Cloud usage counters — for each request: the number of input, output and total tokens, cost, model name, status, request ID and the SHA-256 hash of the system instruction (see point 6).
• Content of the selected text — only in cloud mode, and only for the time needed to handle the request. We do not store it (see points 4 and 5). The exception is the tester programme, which you join with separate consent (point 7).
• Reports — the content sent via the form on the website or by email, optionally a screenshot, an indicated text fragment, the application version, the browser name and an email address for the reply (encrypted like the account address) or the account ID. To limit the number of reports, we store an HMAC hash of the IP address, not the address itself.

3. What we do not do

• We do not run telemetry — neither advertising, behavioural nor product telemetry.
• We do not record keystrokes. The application reads the selection only after the shortcut is used.
• We do not store the content of corrected texts or model responses — except for accounts in the tester programme, with their explicit consent (point 7).
• We do not profile, display ads or sell data.
• We do not train models on your texts and we require that the model provider does not either. Exception: examples from testers who agreed to it may be used to fine-tune englisher’s own models (point 7).

4. Two modes of processing text

This is the most important point of this document. You choose the mode yourself in the settings and can change it at any time. The widget shows a badge with the current provider, so you can see when text leaves your computer.

Local mode (default)

Basic correction is done by Harper, and advanced suggestions are prepared by AI on your computer. The engine is part of the application — you do not need to install anything separately. The selected text reaches neither us nor any provider.

The engine listens only on 127.0.0.1, the address at which the computer sees itself, on a port assigned at each start. It cannot be reached from outside and cannot be pointed at another computer — in this mode there is no address field, because there is nothing to enter. The application starts the engine only when the shortcut is first used and frees the memory after half an hour of inactivity.

Advanced correction requires downloading a package. When you set up this mode, the application downloads a file with the trained AI mechanism (the model) from Hugging Face (huggingface.co). It is an ordinary file download — it reveals only as much as downloading anything from a website, that is your IP address and which file you are downloading. None of your text, no account data and nothing that would let us link the download to you goes there. This happens once; after that, local mode works without the internet.

englisher Cloud mode

The selected text goes to our API and from there to the model provider. It is a paid feature switched on deliberately — without active cloud access the request is rejected. We do not store the content of the request or the response; only the counters described in point 2 go into the database — unless you join the tester programme (point 7). The terms on which the text travels further are described in point 5.

5. No storage of content at the cloud provider (ZDR)

ZDR stands for Zero Data Retention. The text goes to the cloud service so that it can prepare the correction, but the provider does not store the content of the request or the response in any history and does not use them to train its solutions. We enforce these rules on every request.

The protection is set by the englisher server. The application on your computer cannot switch it off. If no service meeting these conditions is available, we do not send the text to another provider with less strict rules — you will see an error instead.

ZDR does not mean that the text does not reach the cloud: it has to be processed in memory, and the provider may briefly keep it in a cache according to that service’s rules. This is not a permanent request history or training material. Details of the provider’s ZDR rules.

On englisher’s side we store usage counters without content. A separate exception applies to the tester programme and Contributor mode: with explicit consent, we store texts and responses in our database to improve the application (point 7). The cloud provider still operates with ZDR.

6. Why we store a hash of the system instruction

With every cloud request we store the SHA-256 hash of the system instruction, that is the part of the request that we compose, not you. The instruction changes with the application version, and the model changes independently, on the server side. Without this hash we would not know which combination of instruction and model actually works for users, and we could not catch a drop in quality.

Your text is not used to calculate the hash — only the content with the system role. The hash is one-way and does not allow anything you wrote to be recovered.

7. Tester programme — storing requests with your consent

The tester programme (alpha, later Contributor mode) gives free access to the cloud and the local version in exchange for us storing your cloud requests and the model’s responses. You join it only yourself: with an invitation code and by ticking your consent in the account panel. We store the date of consent and the version of the terms you accepted. Full terms: tester programme (in Polish).

• What we store: the text sent for correction, change of tone or translation, the application’s system instruction, the model’s response, response time, number of tokens, cost and which endpoint handled the request.
• What we do not store: texts processed in local mode (they do not leave the computer) or anything from before you joined the programme.
• Why: assessing the quality of corrections, finding errors, building test sets and examples for fine-tuning englisher’s own models. We do not sell this data or share it with other companies.
• Who has access: the englisher team. For assessment we may use language models operating with zero retention, as in point 5.
• For how long: until you withdraw consent or delete your account. Withdrawing with one button in the account panel immediately deletes the stored requests and ends the free access from the programme. Examples previously included in the training set after anonymisation (without the account ID) may remain in it.

The model provider still operates with zero retention — the storage concerns only our database (Cloudflare D1 in the EU).

8. Purposes and legal bases

• Running the account, signing in, issuing licences and providing the cloud service — Art. 6(1)(b) GDPR, performance of a contract.
• Handling payments and subscriptions — Art. 6(1)(b) GDPR; as regards accounting and tax records, Art. 6(1)(c) GDPR.
• Issuing and storing invoices and other tax obligations — Art. 6(1)(c) GDPR, legal obligation.
• Service security, request limits and preventing abuse — Art. 6(1)(f) GDPR, legitimate interest in keeping the service running and protecting accounts against abuse.
• Monitoring costs and model quality based on counters — Art. 6(1)(f) GDPR, legitimate interest.
• Tester programme — storing requests and responses — Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time in the account panel.
• Handling reports and correspondence — Art. 6(1)(f) GDPR, and where the report concerns how the service works — point (b).

9. Recipients and subprocessors

• Cloudflare — API hosting (Workers) and the service database (D1).
• Resend — delivery of messages with the sign-in code.
• Stripe — payments, subscriptions and the billing panel.
• Language model infrastructure providers — handling requests in englisher Cloud mode. We use an API intermediary and a short, pinned list of compute endpoints with measured identical results; the next one on the list takes over a request only if the previous one does not respond. All of them are bound by the zero retention policy from point 5. We will name these entities at the request of the data subject.

10. Transfers of data outside the EEA

Stripe and Resend are United States entities; the language model infrastructure providers serving the cloud mode also operate outside the EEA. Data is transferred on the basis of standard contractual clauses included in the data processing agreements with these providers, supplemented by the technical measures described in points 2 and 5. The model provider receives the content of a single request, which it may not retain — the application does not attach your email address or account ID to it, and our server does not add them.

The database — both test and production — runs in Cloudflare’s Western Europe region, that is within EU jurisdiction. Your account, entitlements and usage counters do not leave this region. Only the data needed to handle payments (Stripe), send sign-in codes (Resend) and a single request to the model leaves the EEA — on the terms described above in this point.

11. How long we keep data

As things stand, the program’s behaviour results in:

• sign-in code — valid for 10 minutes;
• session — 90 days from signing in, shorter if you sign out;
• entitlement token in the application — 30 days, after which it is renewed.

Target periods for the remaining data:

• used sign-in codes — 30 days;
• cloud usage entries — 13 months, that is a comparable year plus a month’s margin for settling a dispute;
• account data — until you request deletion, carried out within 30 days;
• requests and responses from the tester programme — until you withdraw consent or delete your account (point 7);
• reports with screenshots — 24 months from sending;
• billing documents — 5 years, in accordance with tax and accounting regulations; deleting the account does not shorten this period.

Sign-in codes and sessions expire automatically. For now we delete older cloud usage entries manually — after the stated period or earlier, at your request. Automatic cleanup of these entries is being prepared.

12. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa).

You can yourself: sign out (which invalidates the session on the server side), switch the text processing mode to local, clear the site data in your browser and cancel the subscription in the Stripe panel available from your account.

13. Is providing data mandatory

No. Providing an email address is voluntary, but without it you cannot create an account, buy a licence or use the cloud. The application itself works in local mode without an account and without providing any data. You give billing data to Stripe when you decide to make a purchase.

14. Automated decisions

We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. Only technical limits are automatic — the number of requests per minute and the monthly token limit in the cloud — and exceeding them results in a temporary refusal to handle the request, not an assessment of you.

15. Data on your device and in the browser

The web panel does not use cookies, but it stores two values in the browser’s local storage (localStorage): the session token under the key englisher_session and the email address under the key englisher_email, so you do not have to sign in on every visit. They disappear after you sign out or clear the site data in your browser.

The desktop application keeps your email address together with the session refresh token and the signed entitlement token in Windows Credential Manager.

The settings.json file contains only configuration: keyboard shortcuts, the chosen mode, the model address and name, autostart and update checks. We do not store an API key in it — it goes to Credential Manager. The only exception is an unavailable Credential Manager: a key saved in the file by an older version of the application then stays where it was, because rewriting the file would delete its only copy. The file is in your user profile and is not sent anywhere.

16. The application’s network traffic

Apart from the chosen text processing mode, the application connects to the network only when you sign in or refresh entitlements, buy a licence or check for updates. An update check downloads a small file describing the latest release; the installer itself is downloaded only after you click. Automatic checking can be switched off in the settings. In the Microsoft Store version, updates are managed by the Store and the built-in update mechanism is inactive.

The application does not load resources from a CDN and does not send usage reports.

17. Children

The service is not directed at children and we do not knowingly collect data from people under 16. If it turns out that a child has created an account, we will delete it after a report to the contact address from point 1.

18. Changes to the policy

We will inform you of significant changes in the application, on this page or by email, if the law requires it. Effective date of the current version: 12 October 2026.

Report a model response that looks inappropriate, or a fault, via the report form.