Privacy Policy
InPlace AI ("we", "our", or "us") operates the InPlace AI Chrome Extension and web portal. We are firmly committed to transparent, privacy-first engineering. We believe your private writing belongs solely to you.
Effective & Last Updated: October 2, 2026
🛡️ Privacy Principles at a Glance
Your highlighted text is processed ephemerally in volatile memory and never logged, stored, or reviewed.
Your Groq API keys are isolated and encrypted at rest with industry-standard authenticated encryption.
We never feed your writing into training sets for public models or commercial advertising networks.
We never monetize, broker, or transfer personal information to data brokers or advertising third parties.
1. Single Purpose Statement
In strict compliance with Google Chrome Web Store Developer Program Policies, InPlace AI operates with a single, narrow purpose:
"InPlace AI provides in-place grammar correction, text polishing, and tone adjustment directly inside web input fields and text areas across the web without switching tabs."
2. Information We Collect & Process
We only process the minimal technical data strictly necessary to fulfill your formatting requests:
When registering for an account, we collect your email address and a securely salted bcrypt password hash to authenticate your session. We do not store plaintext passwords.
If you connect a personal Groq API key, it is encrypted using AES-256-GCM authenticated encryption before being saved to our database. It is only decrypted in volatile serverless memory during an active formatting request and is never logged or exposed.
When you trigger a shortcut (Ctrl+Shift+F), the selected text snippet is transmitted via HTTPS/TLS to our backend and forwarded to the Groq LLM API. Once the improved text is returned to your browser, the text payload is instantly cleared from memory. It is never stored on disk, never logged to database records, and never persisted.
3. What We Do NOT Collect
To eliminate ambiguity, InPlace AI explicitly does not collect:
- ✕ No browsing history or visited URLs
- ✕ No continuous keystroke logging or keyloggers
- ✕ No IP address tracking or geolocation
- ✕ No financial, health, or payment data
4. Chrome Extension Permissions Justification
Every permission declared in our manifest.json is strictly audited and limited to the core in-place formatting functionality:
| Permission | Technical Purpose & Justification |
|---|---|
| storage | To store your authenticated session token (JWT) and user settings (e.g. last chosen tone) locally on your device. |
| activeTab | To read user-highlighted text in the current browser tab and anchor the floating action toolbar directly above the active input field. |
| scripting | To dynamically execute the in-place text replacement script within the active tab when formatting is triggered. |
| clipboardWrite | To serve as a fallback to copy formatted text to your system clipboard when editing canvas-based editors (such as Google Docs) that restrict direct DOM input manipulation. |
| <all_urls> | To allow users to format text in whatever web portal, message box, or email client they choose (e.g. LinkedIn, WhatsApp Web, Gmail) without requiring manual per-domain permission prompts. |
5. Third-Party Service Providers
To deliver rapid AI inference and host our serverless infrastructure, we partner exclusively with enterprise-grade providers adhering to SOC 2 Type II compliance:
- Groq Inc. (LLM Inference): User-selected text is transmitted to Groq's API endpoints for near-instant inference using high-efficiency open models (such as Llama 3.3). Requests are sent under your authenticated API key according to Groq's strict API data privacy terms, which guarantee zero retention for model training.
- Vercel Inc. (Cloud Infrastructure): Our backend functions run as stateless, ephemeral serverless microservices hosted in secure data centers.
- MongoDB Atlas (Database): Encrypted account records and AES-256 encrypted API keys are stored in a dedicated, firewall-protected database cluster with TLS encryption in transit and at rest.
6. Your Data Rights & Deletion
Under GDPR, CCPA, and global privacy standards, you maintain full control over your data:
- Self-Service API Key Removal: You can view, update, or completely delete your stored Groq API key at any time in one click from your User Dashboard.
- Account Erasure: You can request full erasure of your account, email address, and associated encryption records by contacting us. Requests are processed within 48 hours.
- Data Portability: You may request a copy of the minimal account information associated with your email at any time.
7. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact the developer:
Project: InPlace AI — Instant Text Formatter
Developer: Khalid Hasan
Website: https://inplace-ai.vercel.app
Support & Privacy Email: support@inplace-ai.vercel.app