Privacy Policy

Last updated: September 27, 2026

Thirdraft ("we", "us") is a Chrome extension and web app that rewrites text in your own writing voice. To do that it has to read your writing, so this policy sets out exactly what we collect, where it goes, and how to delete it. It covers the extension, the web app at thirdraft.com/app, and this website.

1. What we collect

Your account

• Email address, used to sign in (with a one-time code or with Google) and to contact you about your account.
• Signing in with Google. Google shares your email address, name and profile picture with our sign-in provider (Supabase). We use only the email address.
• Guest sessions. If you use the web app without signing in, we may create an anonymous session with no email attached, only so your free rewrites can be counted.

Your writing samples

Samples are pieces of your own writing that Thirdraft learns your voice from. If you're signed in, they're saved to your account so the same voice works in the extension and on the web. A sample is saved when you:

• paste or upload writing as a sample;
• accept a rewrite (the accepted text becomes a new sample); or
• turn on Learn from my Gmail. This is off by default and asks for Chrome's permission first. When it's on, the extension saves the text of emails you send, from your Sent mail. It skips messages from other people in the same thread.

If you use the web app without an account, your samples stay in that browser tab and are gone when you refresh. We don't store them.

Text you rewrite

When you ask for a rewrite, the text you selected is sent to our server along with your samples. Our server passes it to our AI provider (OpenAI) to write the rewrite and sends the result back to you. We don't store the text you rewrite unless you accept the rewrite, which saves it as a sample. OpenAI's own handling is described in section 4.

Payments

Payments are handled by Stripe. We never see or store your card number. We keep your Stripe customer ID, your subscription status and your renewal date, so we know whether you're on the free plan or Pro.

Usage and technical data

• Free-plan usage: a count of how many free rewrites you've used.
• Product events: a few events, linked to your account ID and never to your text: a rewrite succeeded, you reached the free limit, you started checkout. We use them to understand how Thirdraft is used.
• Website analytics: page views on thirdraft.com, and whether you joined the waitlist. Our analytics tool (PostHog) uses a cookie or browser storage to tell visits apart. Session recording is off.
• Error reports: if our server hits an error, a report goes to Sentry. We remove the request contents, which is where your writing would be, before it's sent.
• Server logs: our server logs the type of each request (for example "rewrite") and the site it came from. It never logs your text. Our hosting providers may also record IP addresses as part of running their networks.
• Waitlist: if you join the launch waitlist, your email address.

2. The Chrome extension

• Reading pages. The extension can run on the pages you visit so that "Rewrite in my voice" works wherever you type. It reads the text you've selected only when you choose to rewrite it, and it writes the rewrite back into the page only when you click Accept. It doesn't record which sites you visit.
• Gmail. Access to mail.google.com is an optional permission, requested only when you turn on Learn from my Gmail. You can turn it off in the extension's settings at any time.
• AI chat sites. The extension never learns from AI chat sites such as ChatGPT or Claude, so it picks up your voice and not a chatbot's.
• Stored in your browser: your sign-in session, a copy of your samples, the style notes generated from them, and your settings. Signing out removes your samples and plan details from that browser.
• Permissions used: storage (the items above), sidePanel (the Thirdraft panel), contextMenus (the right-click "Rewrite in my voice" item), identity (the Google sign-in window), and optional access to mail.google.com.

3. How we use it, and what we don't do

We use the information above only to:

• provide Thirdraft: write rewrites in your voice and keep your samples in your account;
• run your account and subscription;
• answer you when you contact us;
• keep the service reliable and secure, and understand how it's used; and
• meet legal obligations.

We don't:

• sell your data, or share it for advertising;
• use your writing to train AI models, or allow our providers to;
• show your samples to anyone else; or
• use or transfer your data for any purpose unrelated to Thirdraft, including to determine creditworthiness or for lending.

We follow the Chrome Web Store User Data Policy, including its Limited Use requirements.

4. Service providers

We use these companies to run Thirdraft. Each gets only what it needs for its part of the service.

We may also disclose information if the law requires it, or as part of a merger or sale of Thirdraft. In a sale, this policy would continue to apply to your data.

5. Keeping and deleting your data

• Samples stay in your account until you delete them. You can delete one, all samples from Gmail, or all of them at once, from the extension's settings or the web app. Deleting removes them from your account, not just from that device.
• Your whole account: email support@thirdraft.com from the address you sign in with. We'll delete your account, samples and usage data within 30 days. Records we're legally required to keep, such as payment records held by Stripe, are the exception.
• Text you rewrite isn't stored by us at all (see section 1).

6. Your rights

Depending on where you live, including under the GDPR and California's CCPA, you may have the right to access, correct, delete or export your personal data, and to object to or restrict how we use it. Email support@thirdraft.com and we'll respond within 30 days. We won't treat you differently for using these rights.

7. Security

Data travels over HTTPS. Your samples and account data sit in a database that only our server can reach, and every request is limited to your own account. The keys to our AI provider, database and payments live only on our server, never in the extension or the website. No system is perfectly secure, but we'll tell you promptly if a breach affects your data.

8. International users

Thirdraft is run from the United States, and our providers process data in the United States and other countries. By using Thirdraft, you understand your data will be processed there.

9. Children

Thirdraft isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has given us personal information, contact us and we'll delete it.

10. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll also email account holders before it takes effect.

11. Contact

Questions or requests: support@thirdraft.com