Privacy Policy

Writai: AI Writing Assistant (Android app) · Last updated: 2 October 2026

1. Who is responsible (controller)

Nazli Mahmudlu
Spreestraße 5
12439 Berlin, Germany
Email: mahmudlunaz@gmail.com

We are not required to appoint a data protection officer. For any privacy question or request, contact us at the email address above.

2. What data we process, why, and on what legal basis

2.1 Text you submit for AI processing

When you tap Improve or Reply (in the app’s editor or via the floating button), we process:

• the text you want to improve or reply to (up to 4,000 characters),
• your selected tone, optional custom instructions and your answers to the reply questions.

This data is sent over an encrypted connection to our server (hosted by Contabo GmbH in Germany), which forwards it to our AI provider OpenAI to generate the result and returns the result to your device. We do not store this text, and we do not write it to our server logs. OpenAI processes it on our behalf. Under OpenAI’s API terms, the data is not used to train OpenAI’s models and may be kept for up to 30 days only for abuse and misuse monitoring, after which it is deleted.

Please do not submit sensitive information (e.g. health data, passwords or banking details) that you do not want processed by an AI service.

Legal basis: Art. 6(1)(b) GDPR (performing the service you request).

2.2 Accessibility service (optional)

If you choose to turn on Writai’s Accessibility service, which helps you write in other apps, the app:

• detects when you are typing in a text field in another app and checks how long the text is, entirely on your device, to decide when to show the floating button. This information never leaves your device and is not stored;
• reads the text of that field only when you tap Improve or Reply, and processes it as described in section 2.1;
• inserts the result into the field only when you tap Apply.

Writai never reads password fields, does not collect other screen content, and does not use Accessibility data for advertising or analytics. The service is off by default. We only ask you to enable it after explaining its use and getting your consent, and you can turn it off at any time in your device’s Accessibility settings.

Legal basis: Art. 6(1)(a) GDPR (your consent) and Art. 6(1)(b) GDPR.

2.3 Anonymous account

To protect the service from abuse and apply usage limits, the app signs you in anonymously with Firebase Authentication. This creates a random user ID that is not linked to your name or email address.

Legal basis: Art. 6(1)(b) GDPR.

2.4 Usage counters

For the daily free limits, our server stores the number of improves and replies per day, linked to your anonymous user ID (in Google Cloud Firestore). These counters are deleted automatically about one week after the day ends.

Legal basis: Art. 6(1)(b) GDPR.

2.5 Subscriptions and purchases

Subscriptions are sold and billed by Google Play. We use RevenueCat to manage subscription status. We receive information such as which plan you bought, whether it is active, and when it expires or renews, linked to your anonymous user ID. We never receive your payment card details or your Google account’s name and email.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR where we must keep records for tax and commercial law (generally up to 10 years in Germany).

2.6 App integrity and abuse prevention

We use Firebase App Check with Google Play Integrity to verify that requests come from a genuine copy of the app on a genuine device. This involves technical device and app information processed by Google.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting the service and our AI budget from abuse).

2.7 Analytics

We use Google Analytics for Firebase to understand how the app is used and improve it, for example how many users reach the paywall or complete their first improve. It processes app usage events, an app instance ID, device model, operating system version, app version and approximate region (country/city level, derived from your IP address). We do not log the text you write, we do not collect the advertising ID, and ad-personalization signals are disabled.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the app). You may object at any time (see section 6).

2.8 App configuration

The app downloads configuration values (for example, feature thresholds) from Firebase Remote Config. This uses an app instance ID.

Legal basis: Art. 6(1)(f) GDPR.

2.9 Server logs

When the app communicates with our server, technically necessary data is processed, including IP address, time and requested endpoint. In case of an error, we may log your anonymous user ID and the error message, never your text. Logs are kept only as long as needed for operation and security.

Legal basis: Art. 6(1)(f) GDPR.

2.10 Data stored on your device

Your settings (e.g. default tones and whether onboarding is complete) are stored locally on your device and are removed when you uninstall the app.

2.11 Contacting us

If you email us, we process your email address and message to answer your request.

Legal basis: Art. 6(1)(b) or (f) GDPR.

3. Recipients and processors

These providers process data on our behalf under data processing agreements (Art. 28 GDPR) or, for Google Play billing, as independent controllers under their own privacy policies. We do not sell your personal data or share it with third parties for advertising.

4. Transfers outside the EU

Some providers may process data in the USA. Such transfers are based on the EU–U.S. Data Privacy Framework (where the provider is certified) and/or the EU Standard Contractual Clauses (Art. 46 GDPR).

5. How long we keep data

• Text submitted for AI processing: not stored by us. OpenAI may keep it for up to 30 days for abuse monitoring.
• Usage counters: about one week after the respective day.
• Subscription records: for as long as you are a subscriber, plus any legally required retention period.
• Analytics data: up to 14 months.
• Support emails: until your request is resolved, unless legal retention applies.

6. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future. For the Accessibility service, simply turn it off in your device settings.

To exercise your rights, email mahmudlunaz@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

7. Deleting your data

Uninstalling Writai removes all data stored on your device and ends the link to your anonymous ID. Usage counters linked to that ID are deleted automatically within about a week. You can also ask us to delete data at any time by emailing us. To manage or cancel a subscription, use Google Play → Payments & subscriptions.

8. Children

Writai is not intended for children under 16. We do not knowingly process personal data of children under 16.

9. Security

All communication between the app and our server is encrypted (HTTPS/TLS). Access to our systems is restricted and protected.

10. Changes to this policy

We may update this policy when the app or legal requirements change. The current version is always available at writai.app/privacy.