Contents
A privacy policy tells you what a company has decided to allow itself. It cannot tell you what the software did the moment you pressed paste. So on 23 and 24 September 2026 we stopped reading policies and recorded the network traffic instead, using a marked paragraph we could search for byte by byte. This is what we saw, what we could not see, and which of the two each sentence below is.
Quick answer
The controlled text went to the tool’s own servers, and we did not observe it reaching anywhere else. That is true for all three surfaces we tested.
In our 24 September 2026 test of Grammarly for Windows on a free signed-in account, a document was transmitted when it was opened, before anything was typed into it. We confirmed that with a deliberate test rather than inferring it.
Both Grammarly surfaces sent the text inside a WebSocket, not a normal upload. If you had checked in your browser’s network tab, you would most likely have concluded nothing was being sent.
Four hosts refused inspection. We record those as unreadable, which is not the same as empty.
Surfaces tested
3
Not tested
4
Tested on
23 to 24 Sep 2026
Network records
1,596
What we tested, and what we did not
This is the first thing you should read, because it decides how much the rest is worth.
| Surface | Tested | Account used |
|---|---|---|
| Grammarly, web editor | Yes, 24 Sep 2026 | Free, signed in |
| Grammarly for Windows, desktop app | Yes, 24 Sep 2026 | Free, signed in |
| ChatGPT, web, as a capture control | Yes, 23 Sep 2026 | No account, signed out |
| Grammarly browser extension | Not tested | |
| QuillBot, Rytr, Copy.ai | Not tested |
An untested tool is not a safe tool. It is a tool we have no evidence about. Four of the seven surfaces we planned to cover are in that category, and nothing below says anything about them.
How we checked this
The method matters more than the results, because it is what tells you which sentences to trust.
Our method, 23 to 24 September 2026
✓ We wrote one control paragraph of about 90 words of ordinary office prose, with two deliberate errors so a grammar tool had a real reason to process it.
✓ Each document carried a unique marker string, so finding it in a request is a mechanical match, not a judgement call. Markers were always copied, never retyped: one wrong character produces a clean-looking result that is simply wrong.
✓ We recorded every request the machine made, searching for the marker in plain text and in every encoding it could be wrapped in on the way out.
✓ We recorded WebSocket traffic as well as ordinary requests. This turned out to matter more than anything else we did.
✓ We recorded every host contacted, including hosts that refused to be read, so a host that blocks inspection cannot silently vanish from the results.
✓ We separated the browser’s and Windows’ own background traffic from the tool’s, and counted it separately.
✓ Throwaway accounts on free plans, our own machine, our own traffic. Nothing was decompiled and nobody else’s traffic was touched.
We are not going to show you how to do this yourself. The setup involves telling your computer to trust a certificate that can read your encrypted traffic. Installing one of those on the advice of an article is bad security advice however well the article means it. What you can safely do is at the end.
The finding that changes how you would check this yourself
Most people who want to check something like this open the browser’s developer tools, click the Network tab, and look for their text going out. On both Grammarly surfaces, that method would have shown you nothing useful.
The text did not leave as a normal upload. It left inside a WebSocket.
In plain terms: a normal request is like posting a letter. You can see each envelope leave, and you can open it and read what was inside. A WebSocket is more like an open phone line that stays connected while you work, with messages passing in both directions continuously. The tools that list “requests” often do not show you what travelled down that open line, and the line itself just looks like one connection that opened when the page loaded.
So if you check a writing tool by watching for a request containing your text and you see none, the honest conclusion is “I did not see it”, not “it was not sent”. In our test, the text had already gone.
What we observed, surface by surface
The table below deliberately separates three different things that are easy to blur together: where our marked text was actually seen going, which other domains were contacted for any reason at all, and which domains we could not read.
Read the middle column carefully
“Other domains contacted” means exactly that: the machine opened a connection to them during the session. It does not mean they received your document. Where our marked text was observed going is a separate column, and in every case it names the tool’s own domain and nothing else.
The “of those, unreadable” column is a subset of the contacted count, not an addition to it. A Grammarly web row of 10 contacted and 3 unreadable means ten domains in total, three of which we could not inspect.
| Surface | Where our marked text was observed going | Other domains contacted | Of those, unreadable | Transport observed | Key limitation |
|---|---|---|---|---|---|
| Grammarly web editor free, signed in, 24 Sep 2026 |
grammarly.com only |
10, none of which we observed receiving the text | 3 | WebSocket | Proxy capture only |
| Grammarly for Windows free, signed in, 24 Sep 2026 |
grammarly.com only |
2, none of which we observed receiving the text | 0 | WebSocket | App version not recorded |
| ChatGPT web no account, signed out, 23 Sep 2026 |
chatgpt.com only |
1, which we could not read | 1 | Normal request body | Signed out, so not comparable to the two above |
Counts exclude the browser’s and Windows’ own background traffic. Chrome contacts around a dozen Google endpoints on a cold start before any website has loaded, and counting those against a writing tool would be misleading.
The actual records
Here are the real capture records, with authentication tokens and document identifiers redacted. This is the evidence the table above is built from.
Grammarly web editor, 24 September 2026
websocket coda.grammarly.com /collab/?params=[REDACTED] marker found websocket capi.grammarly.com /freews marker found websocket capi.grammarly.com /freews marker found
ChatGPT, signed out, 23 September 2026
http chatgpt.com POST /backend-anon/f/conversation/prepare marker found http chatgpt.com POST /backend-anon/f/conversation marker found
That /backend-anon/ path is OpenAI’s own name for a signed-out session, so the capture confirms the account state rather than us simply asserting it.
Grammarly for Windows: what happened with more than one document open
This is the part we were most careful with, so here is exactly what was on screen and exactly what the network showed, kept separate from what we think it means.
What was open, 24 September 2026
Windows Notepad restored a previous session, so three of our text files were open as tabs: the desktop control paragraph, the paragraph we had earlier pasted into Grammarly’s web editor, and the paragraph we had earlier pasted into ChatGPT. Each carried a different marker.
Actively edited: only the desktop control paragraph, into which a sentence was typed by hand.
Never edited in this session: the web-editor paragraph and the ChatGPT paragraph.
What the network showed, in order
record #123 websocket capi.grammarly.com 604 bytes marker: desktop paragraph record #199 websocket capi.grammarly.com 604 bytes marker: web-editor paragraph record #212 websocket capi.grammarly.com 604 bytes marker: ChatGPT paragraph record #220 (the freshly opened document appears at about this point) record #230 websocket capi.grammarly.com 604 bytes marker: desktop paragraph
Each frame was the same size, 604 bytes, which is one document’s worth of text. Three of the four were sent before the document that was about to be edited had even been opened.
The ChatGPT paragraph is the one worth pausing on. That text had never been given to Grammarly by any route. It was not in the Grammarly account. It was not on the clipboard, which by then held something else. The only place it existed on that machine was a local text file sitting in a Notepad tab.
So we tested it deliberately
Rather than reason about why, we ran a controlled test. Two fresh files with two new markers. We opened the first, opened the second on top of it, and typed only into the second.
record #115 websocket capi.grammarly.com 604 bytes marker: the file we never typed in record #142 websocket capi.grammarly.com 604 bytes marker: the file we did type in record #156 (baseline taken here, BEFORE any typing)
The observation
Both documents had been transmitted in full before a single character was typed. In our 24 September 2026 test of Grammarly for Windows on a free signed-in account, opening a document was sufficient. Editing was not required.
The limit of that claim, stated precisely: the file we never typed into was briefly the front window when it opened. So what we observed is that a document which was opened and then left alone, never edited, was transmitted in full. We did not test, and are not claiming, that a window which is never focused at all behaves the same way.
What we did not establish: whether a background document continues to be transmitted while you work in a different one. No further marker-bearing frame appeared afterwards, but the sentence we typed did not contain a marker, and an incremental edit would not carry one. So that question is open, and we are not going to answer it from silence.
When traffic cannot be read, that is not the same as nothing being sent
Four of the hosts contacted across our captures refused to let us inspect what passed between them and the machine. That is a normal and often sensible thing for software to do. It also means we genuinely do not know what went across those connections.
| Surface | Host | Status |
|---|---|---|
| ChatGPT | oaistatsig.com |
Contacted, contents unknown |
| Grammarly web | codacontent.io, imgix.net, unsplash.com |
Contacted, contents unknown |
We are listing these rather than quietly dropping them, because dropping them is how an article ends up saying “this tool contacted nobody else” when the truth is “we could not see”. If we had not recorded the connection attempts themselves, those four hosts would simply be missing from this article.
What was left on the machine afterwards
After the tests we uninstalled Grammarly for Windows and looked at what remained.
The uninstaller removed the application, its autostart entry and its main data folder. It left behind a second folder of about 42 MB, whose logs contained the test account’s email address, and a registry key.
What the registry key contained, and what that does and does not mean
Observed: the key held a Microsoft Universal Event Tracking (UET) visitor identifier, an install identifier and a referral identifier. These remained on the machine after the application had been uninstalled, until we removed the key by hand.
Not observed, and therefore not claimed: that any tracking event was sent, that Microsoft received anything, that data was shared or sold, or that advertising profiling took place. What we found is that these identifiers existed locally. That is the whole of it.
We also searched everything that remained on disk, including both small databases and the embedded browser cache, for the marked text from our tests.
No detectable copy of the controlled document text was found in the local stores we examined. That sentence is deliberately narrow. It says nothing about what is held on Grammarly’s servers, about cloud storage, backups, retention periods, deletion, or whether anything is used for training. A network capture and a disk search cannot see any of that.
What the vendors’ own documentation says
This section is documentation, not observation. Everything above came from our own capture. Everything here is what the companies publish about themselves. We are not using either one to prove the other.
Checked on 24 September 2026: Grammarly’s privacy policy URL now redirects to a policy published by Superhuman Platform Inc., with an effective date of 6 July 2026, covering Grammarly alongside other products. That is consistent with something we saw independently in the capture: the Windows application ships a component signed by Grammarly and named for Superhuman.
That policy states that individual users “can decide whether Superhuman can use your user content to train our AI models by adjusting the available training control(s) in your account settings”, and that the company makes money “when users purchase our paid products and not by selling or monetizing user content”. Content in organisational accounts is covered by separate agreements rather than by that policy.
We have not verified any of those statements, and a network capture could not verify them. They describe intent and contractual position. Our capture describes what happened on one machine on one day.
Limitations, in full
1. Four of seven surfaces were not tested. The Grammarly browser extension, QuillBot, Rytr and Copy.ai. We have no evidence about them.
2. One machine, one day, free accounts. Windows, 23 to 24 September 2026. Paid tiers may behave differently and we did not test them.
3. The Grammarly for Windows version was not recorded before the application was uninstalled, so we are not stating one.
4. Proxy capture only. We did not run a second, lower-level capture. Software that deliberately avoided the path we were watching would not appear here.
5. The ChatGPT comparison is not like for like. ChatGPT was signed out with no account; Grammarly was a free signed-in account. ChatGPT is here as a control to prove our capture method worked, not as proof that one product protects privacy better than another.
6. Nothing here describes what happens after your text arrives. Retention, staff access, training use, sharing and deletion are all invisible from outside.
7. Vendors change things. These are dated observations, not a description of the products today.
What to do with this
Worth doing
Decide in advance what you will never paste. Client names, unreleased work, anything under an NDA. Deciding in the moment always goes the permissive way.
Close the documents you are not working on. On the evidence here, having a file open was enough for it to be sent.
Quit the desktop assistant before you open anything confidential, rather than trusting yourself to remember mid-sentence.
Check the training control in your account settings. It is a real setting and it is yours to set.
Not worth relying on
Private or incognito browsing. It changes what your browser stores locally. It does not change what the tool receives.
Staying signed out. Our ChatGPT capture was signed out and the text was still transmitted, which is how the product works.
Checking the browser’s network tab and seeing nothing. On both Grammarly surfaces the text went by a route that view does not show well.
Assuming a paid plan changes transmission. It usually changes retention and training terms, which is a different thing.
If you want to work out whether a specific piece of text is risky before you paste it anywhere, our AI Privacy Risk Checker walks you through it in about two minutes.
Choosing a writing tool in the first place? See the best free AI writing tools, and which AI tools train on your data by default.
Sources
- Superhuman Platform Inc. privacy policy, which Grammarly’s own privacy policy URL now redirects to. Effective 6 July 2026. Checked by us on 24 September 2026.
- OpenAI privacy policy. Linked for reference. OpenAI’s site blocked our automated check, so we are not claiming a verification date for it.
Our own capture records, with authentication tokens and document identifiers redacted, are reproduced in full above. We do not publish raw capture files: they contain live session credentials.
