Privacy.
What Wurding sees, what it doesn’t, and what our server holds about you. Written to be read once and trusted.
The short version
Your writing stays on your machine. When you select a word, the extension sees that word. When you paste a passage into the Passage tab, the extension reads that passage — on your computer, and nowhere else. The dictionary ships inside the extension. Lookups and passage review make no network request at all.
What the extension stores on your device
- The dictionary — static data files shipped with the extension. Nothing about you.
- Your settings — axis visibility, spelling, uncommon-word marking. Local only.
- Favorites — local only. Not synced, not sent.
- A license token, if you have signed in — a signed statement of which plan you are on. See below.
What leaves your device, and when
- Looking up a word or reviewing a passage: nothing. Ever. It works with the wifi off.
- Signing in: your email address goes to our authentication provider (Supabase) to send you a sign-in link and code.
- While signed in: the extension periodically asks our server for a fresh license token. That request carries the old token and the extension version. We do not log the words you look up — we never receive them.
- Subscribing: your card goes to Stripe. We never see the number. Stripe tells us your subscription status and gives us a customer id.
- Report a bad neighbor: only when you press send. Includes your message, the word you had open, the neighbors shown, your settings, the extension version, and your browser and window size — because a report without those can’t be acted on. Nothing else from the page you were on.
What our server holds
If you never sign in: nothing. The free plan needs no account.
If you do sign in, we hold:
- your email address;
- your plan (free, trial, or Pro) and, if you subscribed, a Stripe customer id and subscription status;
- timestamps of when license tokens were issued;
- whether you have unsubscribed from trial emails;
- if you asked for one, a short-lived activation code.
There are no license keys. A license token is a signed note from our server to the extension saying which plan you are on; the extension checks the signature locally and does not need to call home to use it.
If you used a form on the install page without signing in, we hold:
- the email address you entered, which platform you asked about (Firefox, Safari, the Mac app) or that you asked for the install link, and when.
Two things are kept even if you never create an account or after you delete it:
- A record that an email address has used its free trial. It is stored in a normalised form (lower-case, with any +tag removed, and Gmail’s dots and googlemail.com folded together) so that a free trial can’t be claimed over and over. It is kept after account deletion for that reason alone, and is used for nothing else.
- A short-lived, one-way hash of your network address. To stop automated abuse of the checkout, the sign-up forms and the visit counters we count requests per salted hash of your IP address for up to a day. The address itself is never stored, and the counters are deleted after two days.
This website
There is no analytics service on this site. The pages load nothing from any third party (fonts and scripts are all served from this site), and there are no advertising pixels, advertising IDs or cross-site trackers. The only outside services involved are the ones named under “Who handles your data for us”, and only for signing in, paying and sending email. Our host keeps basic server access logs (IP address, page, referrer, browser) for 30 days, for security.
To learn whether the site is working we keep simple counts in our own database of a few actions: “Add to Chrome”, “Start free trial” or “Compare plans” was pressed, a sign-in email was asked for, someone signed in, a trial started, a checkout was opened, a purchase was completed. Each count is only the action, a short label for where it came from (for example “hero”), for a checkout the plan chosen and whether you were signed in, and the time. It carries no IP address, no cookie, no account or user id, and no browser details, so it cannot be tied to you. We don’t count page views, and the website never reports whether you have the extension installed.
Cookies. The site sets only what it needs to work, none of it for advertising or tracking, and none of it containing anything about you beyond what is stated here:
- a session cookie, only if you sign in, so you stay signed in (set by our sign-in provider, Supabase);
wurding_next— for up to 30 minutes while you sign in, remembering which page to take you to afterwards (a page address on this site, nothing else).
We send email when you ask for it, or when your account needs it:
- a sign-in link and code, and (if you paid without signing in first) a link to finish signing in;
- a receipt, from Stripe;
- a note if a subscription payment fails, so you can update the card, or if a purchase was a duplicate and was refunded;
- a reply to a note you wrote us;
- if you asked for it on the install page, one email with the install link, or one email when a Firefox, Safari or Mac edition ships.
If you start a free Pro trial we also send two short notes about it — one a few days before it ends, one when it has ended — and nothing further unless you subscribe. Those are the only emails we send that you didn’t individually ask for, and every one of them has a one-click unsubscribe link and your mail app’s own unsubscribe button. There is no newsletter and no marketing list.
Who handles your data for us
We use a small number of services, each for one job:
- Supabase — sign-in and our database (your email, plan, preferences).
- Stripe — card payments and subscriptions.
- Resend — sending the emails above.
- Vercel — hosting this website, including its server logs.
- Cloudflare — carries the contact form and the extension’s “report a bad neighbor” messages to us.
None of them is allowed to use your data for their own purposes.
What we never do
- Sell or share your data. There is no buyer and no advertiser.
- Train anything on your prose. We never receive it.
- Read your documents. The extension sees only the word you selected or the passage you pasted.
- Track you across the web.
- Use any third-party analytics service, advertising pixel or advertising ID.
Children
Wurding is built for adult writers and is not directed at children under 13. If you believe a child has given us information, write to us and we will delete it.
Your rights
Wherever you live, you can ask what we hold about you, ask us to correct it, and ask us to delete it. You can delete your account yourself, any time, from the bottom of your account page; or write to us and we will do it. Deleting your account removes your email, plan, and any Stripe link on our side, and cancels any subscription (Stripe keeps its own payment records, as the law requires of it, and we keep the trial record described above). We answer requests within 30 days, usually within a few. GDPR, UK GDPR, and CCPA/CPRA all apply where relevant; we treat everyone to the strictest standard rather than keep track of where each writer lives.
Security
All server endpoints use TLS. License tokens are signed with a key that never leaves the server. The surface is small — a marketing site, a small account service, Stripe, and Supabase. If a security issue affects you, we will write to you within 72 hours of confirming it.
Contact
Privacy questions, data requests, security reports: info@wurding.com.
Changes
We update this page when our practices change and note the date below.