Your text is used for the rewrite, not kept as a history.
ControlG minimizes collection and explains the small amount of data required for accounts, licensing, sync and support.
Ordinary rewrites
Built-in rewrite text is processed for the request and is not retained by ControlG as a rewrite history.
Provider keys
Optional keys are encrypted locally. They are sent only to the provider you choose and do not sync to ControlG.
Account records
Account, usage, licence, device and synced action data is stored so the service can operate.
Your choices
Automatic Android diagnostics are off by default. AI output is sent for safety review only after separate confirmation.
Text you choose to rewrite
When you use the built-in AI, the selected or triggered text, your chosen instruction and a device identifier are sent over HTTPS to our Azure Functions backend and then to Azure OpenAI. The text is handled in memory for that request and is not written to our database or application logs.
When you use your own provider key, the app sends the text directly to that provider under its own terms.
Account and licence data
Google sign-in is provided by Clerk. We store your Clerk user id, email address, plan, free-rewrite count, prompt settings, registered device identifiers, licence status and related timestamps in Azure Cosmos DB. An account receives one active device slot for each supported platform.
On-device information
Third-party API keys are stored locally using Keychain on macOS, Android Keystore-backed encrypted preferences on Android and DPAPI on Windows. If Android secure storage is unavailable, keys remain in memory for that app session and are not written in plaintext. Desktop hotkeys also stay local.
Android Accessibility permission
While the service is enabled, ControlG observes text changes only in the active editable field so it can detect a trigger you configured. Depending on what you type, this can include emails, SMS or MMS messages, other in-app messages, and other personal information such as names, addresses, account details, or notes. ControlG collects and sends the active field text only after you type a trigger, solely to generate the rewrite and write it back into the same field. It does not read password fields, notifications, or unrelated screen content. This access is not used for advertising or profiling.
Optional diagnostics
Android keeps a small 20-event technical log on the device. It can include error and status codes, provider and model, timing, network type, device model, Android version and text length. It does not include your text, result, prompt, API key or the app where you were typing. Automatic sending is off by default. Mac and Windows keep only the latest failure detail and send it only when you choose the report action.
Optional AI output reports
Android can report the latest AI-generated result for safety review. Before anything is sent, the app explains that the result may contain sensitive text and asks you to confirm. The report contains the result, provider, model and platform. It does not contain your original text, prompt, email or account id.
Purchases and email
International payments are processed by Paddle. Bangladesh payments may be processed by EPS. We receive the buyer email, transaction id, product and payment status required to create and support the licence. Payment card and wallet details do not reach ControlG.
The activation code appears after payment. If transactional email is enabled, Resend may deliver the code or support replies. ControlG does not operate a marketing mailing list.
Website analytics
The website stores a random browser id to count unique visits and records the referring site's host name, never the full referring URL. There are no advertising cookies, cross-site trackers or third-party analytics. Your IP address is processed transiently for country-based checkout and fraud prevention.
Retention, processors and your rights
Account, licence, device and order records are kept while the account or lifetime licence remains active and where legal or accounting duties require them. Service providers include Microsoft Azure, Clerk, Vercel, Paddle, EPS and Resend when email delivery is enabled.
If you are in the EEA, United Kingdom or Switzerland, processing required to provide ControlG relies on performance of a contract. Limited site measurement and fraud prevention rely on legitimate interests. You may request access, correction, deletion, restriction, objection or data portability.
ControlG does not sell personal data, profile users or make automated decisions about them. The product is intended for people aged 18 and over.
Delete your account
Request deletion from Android under Account, or use the account deletion page. Eligible account, prompt, device, usage and diagnostic records are deleted. Purchase and licence records may be retained only where required by law, accounting, fraud prevention or to preserve a lifetime licence you ask us to keep.