Fix English — Privacy

Support and privacy: fixenglish.support@gmail.com

Last updated: 15 October 2026. This notice describes the hosted service and the extension, including on-device Private mode in extension 0.5.0. Usage metrics described below apply only to versions that include the optional metrics setting, when the user enables it and the service enables metrics.

Support and privacy contact: fixenglish.support@gmail.com. Please do not include API keys or confidential text in support requests.

What happens when you use Fix English

Fix English corrects English while trying to preserve your meaning and voice. It corrects the text you explicitly select in an editable field only after you invoke Fix English, using its keyboard shortcut, context menu, or extension button. It does not continuously read everything you type, scan pages in the background, or automatically transmit keystrokes.

When a correction uses the cloud, only the selected text is sent for correction. It may contain personal or confidential information if you select such information. The extension does not send the page's URL or title, surrounding field text, browsing history, or clipboard contents. Password and read-only fields are unsupported.

When Chrome's on-device model is already available, Private mode is on and that same selected text is corrected on your device and is not sent to the Fix English service. When the model is not already downloaded, or this computer cannot run it, the correction uses the cloud. Fix English does not start that download by itself. A choice you make on the options page is saved and overrides that default. See Private mode below.

The extension temporarily holds the selected text, editor state needed to detect intervening changes, and the correction in browser memory. For the conflict check, editor state can include the field's full value or rich-text markup, but that state is not sent to our service or saved to extension storage. A pending selection expires after 28 seconds, or 30 seconds while a Private-mode toast is offering a one-time cloud correction; Undo retains a temporary restoration state for up to eight seconds, or until an intervening edit/focus change. The website where you edit text can of course observe and store changes in its own editor under its own privacy policy.

Private mode

Private mode is a setting on the extension's options page. The on/off control is shown only when Chrome reports that its built-in on-device model is ready to use. It starts on in that case, until you turn it off. If the model still needs to be downloaded, the options page offers that download and shows progress, and corrections use the cloud until the model is ready. The extension does not begin the download unless you click that button. If this computer cannot run the model, the options page explains that briefly and cloud correction remains the only available mode. Turning the control on or off stores that choice, and the stored choice is used instead of the default.

When Private mode is on:

• The selected text is processed in the extension with Chrome's built-in Prompt API (LanguageModel). The extension does not send that text to our Cloudflare service or to a cloud model provider for that correction.
• Chrome may download the on-device model the first time it is needed. That download is performed by Chrome, can be several gigabytes, and does not include text you select. Chrome's documentation says that using the on-device model does not send prompts to Google. Fix English does not control Chrome's download or later model updates.
• The extension checks the model's reply and leaves your text unchanged if the reply is empty or strays too far from the selection: words that are not close edits of the original, a large change in length, new line breaks, or a new sentence made of new words. A sentence full of spelling fixes still passes, including added commas and periods, when the words stay close. Capitalization and a short abbreviation are not treated as a rewrite. A failed check, a missing model, or a model error does not fall back to the cloud. When a check fails, the extension writes the reason (for example, the portion of words that changed) to the service worker console. That line does not include the selected or corrected text.
• While Private mode is in use and the model is already available, the extension prepares Chrome's on-device session when its background worker starts. That includes browser startup and extension install or update. The session holds the proofreader instructions. Each correction runs on a copy, and the selected text is not kept in the reused session. Preparing the session does not download the model. Turning Private mode off discards the session. It is also discarded when the extension's background worker stops.
• The result says the fix ran on your device. If the selection already looks correct and the on-device reply is rejected, the toast says your English looks good and nothing is sent. If it is unclear whether a correction was needed, that same toast can include Try in the cloud, and the selection is sent only if you click it. If the selection has a detectable error, or the on-device model is missing or fails, a toast says the text was not changed and was not sent. That toast can include Fix in the cloud this time. The selection is sent to the cloud service only if you click that button.
• Optional usage metrics, if you turned them on separately, can still send the fixed event categories described below. They do not include the selected or corrected text. Private mode does not turn metrics on.

When Private mode is off, result toasts say the fix ran in the cloud, and the service-provider section below applies. On-device corrections do not use the daily cloud allowance.

Service providers and purpose

This section describes the default cloud correction. It does not apply to a correction that finishes in Private mode.

Production requests travel over HTTPS to our backend hosted by Cloudflare, then over HTTPS to the OpenAI Responses API. These providers process selected text to deliver the correction and operate their services. The backend, not the extension, holds the OpenAI API key and chooses the model and editing instructions. Processing may take place outside your country; this beta does not promise regional residency.

We request store: false and do not create OpenAI conversations or use background mode. This does not guarantee that OpenAI never temporarily retains API inputs or outputs. OpenAI's published default API abuse-monitoring retention can be up to 30 days, with applicable exceptions; different controls require specific account eligibility/configuration. Fix English does not claim Zero Data Retention. The operator must verify the actual account settings before publishing this notice. OpenAI states API data is not used to train its models by default unless a customer opts in; the operator must not opt this project in without updating this notice and obtaining any required consent.

What Fix English stores

Our application does not persist original or corrected text in a database, analytics, application logs, request logs, or an error-reporting service. Responses request no caching. We do not use session replay or page-level tracking.

To limit abuse and API costs:

• To show a one-time rating request, the extension keeps a count of successful corrections and whether the request was already shown in Chrome's local extension storage. These values never leave your device.
• Send feedback only opens a draft in your own email app. The copy-preview box and toolbar-icon menu prefill the extension version and the current site's hostname (never the path, query or text); nothing is sent unless you send that email yourself.
• The extension creates a random installation ID on its first production correction (or its first opted-in metrics event) and keeps it in Chrome's local extension storage until that storage is cleared or the extension is removed. It is not synced by the extension and is not an authentication secret.
• A request includes that ID. Cloudflare necessarily receives network information including an IP address. The backend derives daily keyed hashes of the installation ID and the network address (IPv6 is grouped by /64).
• A Cloudflare Durable Object stores those pseudonymous daily keys, numeric request/token-reservation counters, expiry times, and short concurrency leases. It does not receive text, raw IPs, or raw installation IDs. These keys are pseudonymous, not guaranteed anonymous.
• Counters expire at the end of their minute/day window. Expired records are removed on later quota operations or an hourly cleanup alarm, normally within an hour of expiry; failed alarms/platform incidents can delay cleanup. Leases expire after 35 seconds. Cloudflare's SQLite point-in-time recovery can preserve earlier database versions for up to 30 days, including deleted quota metadata. Those backups contain no application text.

Cloudflare and OpenAI may retain their own operational/security records under their services' terms and the operator's actual account configuration. Cloudflare infrastructure metrics such as aggregate requests, errors, CPU and storage usage remain available. Workers application/request observability is disabled in the checked-in configuration; the operator must keep body/header capture, request tracing, log exports and external error capture disabled for this endpoint. This notice cannot promise deletion from provider-controlled records beyond the applicable contract.

Optional usage metrics

In versions with the Share usage metrics setting, it is off by default, including for existing installations after an update. If you turn it on in the extension options, the extension may send fixed event types for correction started, applied, unchanged, copy preview, failed, and Undo applied or failed. Each event also includes only an editor category (such as standard field or ProseMirror), a coarse correction time range, and a fixed failure category. It does not contain the selected/corrected text, page address or domain, title, surrounding text, or error message. Turning the setting off stops new metrics; it does not remove data already aggregated.

These event requests include the existing random installation ID, which the backend converts into a keyed identifier before passing it to a dedicated metrics Durable Object. That object stores the keyed identifier and its most recent active day for up to 30 days to count distinct active installations and installations returning on a later day. It stores daily aggregate event counts for up to 90 days and short-lived keyed network rate-limit counters. It does not store raw installation IDs or network addresses, and never receives text. A different device/profile or cleared extension storage counts as a new installation; these counts are not people, and a return after 30 days is counted as first seen again. Delivery can fail, so these metrics are estimates. Cloudflare can process request-level network metadata as described above. Only the operator can request the aggregate report using a separate server secret.

Advertising, sale and choices

We do not sell your data or use it for advertising. There are no advertising SDKs, tracking pixels, or third-party product analytics in this release. We use quota metadata only to operate and protect the correction service; optional usage metrics help improve reliability and understand adoption.

You control which text you select and whether you invoke Fix English. Uninstalling the extension removes its local installation ID; it does not immediately remove expiring server quota metadata or provider security records. You can use Undo while available. Undo does not retract an already submitted cloud request. A Private-mode correction is not a cloud request unless you clicked Fix in the cloud this time or Try in the cloud.

For a development-only installation, selected text instead goes first to your own 127.0.0.1:8787 server, which calls OpenAI with your own key. That version stores a local access token in extension settings. The hosted production package does not require or ship that token or an OpenAI key.

Provider references: OpenAI API data controls, Cloudflare privacy policy, and Durable Object SQLite recovery.