Privacy Policy

Overview

AI Writing Assistant ("we", "us", or the "Service") is an online collection of AI‑powered writing tools available at aiwritingassistant.net. This Privacy Policy explains what information the Service receives when you use it, why that information is needed, who it is shared with, how long it is kept, and the choices and rights you have.

This policy applies to everything on aiwritingassistant.net — the writing tools, accounts, the help pages, and paid subscriptions. If you have any question about it, email us at info@aiwritingassistant.net.

Your writing content

The text you put into a writing tool is the most sensitive thing you share with us, so it gets the strictest treatment:

• Your documents are never stored on our servers, and notes you choose to sync are encrypted on your device first. When you run an AI‑powered tool, your text and the settings you chose are sent over an encrypted connection to our application server, processed in memory to produce the result, and returned to your browser. We do not keep a copy of your document.
• AI processing uses external model providers. To generate results, our server forwards your text to third‑party AI model providers through the OpenRouter routing service. On the Pro plan, requests are restricted to providers with zero‑data‑retention policies, meaning those providers state they do not store or train on the content they process.
• A short‑lived correction cache. The Grammar Checker keeps a cache of correction fragments — the flagged words, their suggested replacements and the one‑line explanation shown next to them — keyed by a cryptographic hash of each paragraph, so paragraphs you have not changed are not sent for processing again. The cache does not contain your document as a whole and every entry expires automatically after 7 days. Other tools keep no fragments of your text.
• Billing hashes. To avoid charging your daily allowance twice for the same text, we keep a one‑way hash (a fingerprint that cannot be turned back into the text) of each submission for the current day only, together with its word count.
• Only word counts are recorded. To enforce daily plan limits we record how many words a request contained — not the words themselves.
• Word Counter is fully local. It runs entirely in your browser and never sends its text anywhere.
• The Notebook is local, and its optional sync is end‑to‑end encrypted. Notes live in your own browser and are never uploaded unless you switch syncing on. If you do, each note is encrypted on your device with AES‑256‑GCM under a key derived from your account password by PBKDF2, and only the resulting ciphertext is sent to us. We receive no key and hold none, so we cannot read your notes, disclose their contents to anyone, or recover them if you forget your password. What we store alongside each encrypted note is a note identifier, a revision number and a timestamp — no title, no tags, no word count. Turning syncing off deletes the encrypted copies from our servers.

Information we collect

Apart from the writing content described above, the Service handles these categories of information:

How we use information

• To provide the Service — process your text, return results, keep you signed in, and remember preferences like dark mode.
• To enforce plan limits fairly — daily word totals, request counts, and rate limits, using word counts and (for guests) an IP hash.
• To keep accounts secure — verification emails, password reset links, sign‑in throttling after repeated failures, and session management.
• To operate paid plans — activate Pro after verified payment and return your account to a free plan when a subscription ends.
• To respond to support requests.
• To keep the Service reliable — aggregate, text‑free operational metrics such as error rates and latency.
• To show advertising on free plans — see the Advertising section below. The Pro plan is completely ad‑free.
• To comply with law where we are legally required to.

We do not sell your personal information, and we do not use your documents to train AI models.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (providing the tools, accounts, and subscriptions you request), legitimate interests (service security, abuse prevention, fair limit enforcement, and aggregate reliability metrics), consent (optional email updates, analytics cookies, and advertising cookies), and legal obligation (records we must keep by law).

Third parties we work with

We share only what each provider needs to do its job:

Some providers may process data outside your own country. Where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by the provider.

How long we keep data

• Documents: not stored — processed in memory only.
• Grammar correction cache: correction fragments keyed by paragraph hash; deleted automatically after 7 days.
• Billing hashes: one‑way text fingerprints kept for the current day only.
• Unverified accounts: accounts whose email address is never confirmed are deleted after 7 days.
• Account deletion: when you delete your account we remove the account record, its sessions, its usage rows and its entries in our internal event log, and send a confirmation to your email address.
• Daily usage counters: reset each calendar day; aggregate operational records are kept only as long as needed for security, troubleshooting, abuse prevention, and legal obligations.
• Account data: kept while your account exists. Deleting your account removes your account record and active sessions immediately.
• Analytics: if you agree to it, Google Analytics keeps event data for 14 months and then deletes it. Withdrawing consent stops any further collection.
• Our own page counts: we keep a plain tally of how many times each page and blog post was opened, by the hour. It uses no cookie and no identifier, and stores no device details and nothing you typed — only a page name and a number. So one browser cannot inflate a count, the current hour also holds a one‑way, hour‑salted hash of the network address that cannot be turned back into it; that hash is dropped as soon as the hour ends. Hourly tallies are kept for 30 days; daily totals are kept as a long‑term record of how the site is doing.
• Support emails: kept as long as needed to handle the request and for a reasonable period afterwards.

Security

We protect the Service with encrypted transport (HTTPS with HSTS), hashed passwords and one‑time tokens, HttpOnly and SameSite‑protected session cookies, sign‑in throttling after repeated failed attempts, single‑use password‑reset links that expire after one hour, an email notice whenever a password is changed, reset or added or an account is deleted, restricted administrative access, request rate limits, and a content security policy in the browser. No internet service can promise perfect security, but we design the Service so that the most sensitive thing — your writing — is not stored at all.

Your rights and controls

You can exercise the most important rights yourself, instantly, from your Account page:

• Access / portability: download a copy of your account data as a file.
• Correction: update your name and preferences at any time.
• Deletion: permanently delete your account, which removes your account record and signs out all sessions.

Depending on where you live, you may also have rights to object to or restrict certain processing, to withdraw consent, and to complain to your local data protection authority. California residents: we do not sell or share personal information as defined by the CCPA/CPRA. To exercise any right, or ask a question, email info@aiwritingassistant.net — we respond to verified requests within the timelines required by applicable law.

Advertising

To keep the free plans free, pages may show advertising served by Google AdSense — but only for guests and free accounts. Pro subscribers never see ads and no advertising code loads for them. Where the law requires it, ads are shown only with your consent, and the use of advertising cookies by Google is described in our Cookie Policy and the privacy documentation from Google.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If the law of your country sets a higher minimum age for consenting to online services, that higher age applies. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy as the Service evolves. The "Last updated" date at the top identifies the current version, and meaningful changes will be reflected there before they take effect. Continued use of the Service after a change means the updated policy applies.

Contact

The data controller for the information described in this policy is:

Toheed Mehmood, trading as AI Writing Assistant
Street No. 5, Ghazi Town, Near PSO Petrol Station,
Jhumra Road, Jaranwala, Faisalabad, Punjab, Pakistan

AI Writing Assistant is a registered business name operated by a sole proprietor in Pakistan. It is not a limited company.

Privacy questions, rights requests, or anything unclear: info@aiwritingassistant.net. We're glad to explain anything in this policy in plain language.