Plumb — Privacy

Plumb is an add-in for Microsoft Word that scores how closely your writing matches a style and suggests rewrites. This page says what it does with your text. Last updated 23 October 2026.

Scoring happens on your own device

When you press Calculate, your document's text is scored by a language model that runs inside the add-in, on your own device. The text is not sent anywhere to be scored. The rule checker works the same way.

What is sent to OpenAI, and when

Two features use OpenAI, and only when you ask for them:

• Generate suggestions sends the sentence or paragraph you selected, the names found in it, and a description of the style you chose — including its rules, and, for a style you built from your own text, up to six sentences from that text as examples.
• Draft rules sends the description of a style that you typed. It does not send your document.

They need a Plumb Plus subscription. They go to Plumb's service, which runs on Cloudflare, and on to OpenAI (api.openai.com) with Plumb's own key. The service passes your text through: it is not kept, not logged and not read, and the reply comes back the same way.

OpenAI's own terms and privacy policy cover what OpenAI does with a request. If you never activate a licence, nothing is ever sent to OpenAI.

What Plumb's service stores, if you subscribe

To check your subscription and count your requests, Plumb's service keeps, on Cloudflare:

• a one-way hash of your licence key — never the key itself;
• the status of your subscription, as Lemon Squeezy reports it, when it started, when it ends if you have cancelled, and the reference of your order;
• when Lemon Squeezy was last asked about your licence;
• an identifier for each computer you activate, which Lemon Squeezy issues;
• how many requests you have made this month — and how many were rewrites and how many rule drafts, and how many replies were refused as too long — and in the last minute;
• a hash of your IP address, to limit how fast requests can come from one place. It is made with a secret key that only Plumb's service holds, and the date: without that key it cannot be turned back into the address, and it cannot be matched with the same address on another day. It is deleted as later requests arrive, usually within a few minutes, and within about a day at most.

These are deleted about 13 months after your licence was last used, and a month's counts about 13 months after that month began, so that a year's history is there to answer a billing question. To have them deleted sooner, write to the billing address on the support page. A licence key that turns out not to be valid is remembered, as a hash, for up to about a day, so that Lemon Squeezy is not asked about it again and again.

It is never your text, never a prompt and never a reply. When you activate a licence, the name of the computer's Word (such as "Word (PC)") is passed to Lemon Squeezy, which lists it among your activations; Plumb's service does not keep it.

What is stored, and where

• Your Plumb licence key, if you activate one, is kept in the add-in's storage on your device, with the identifier of this computer's activation. It is not encrypted. It is sent only to Plumb's service. "Remove from this computer", in Settings, deletes both. A key for OpenAI that an earlier version of Plumb saved is deleted the next time the add-in opens.
• Styles you create — their names, descriptions, rules, and the sentences of any text you built them from — are kept in the add-in's storage on your device. Delete them in Manage Styles.
• The language model is downloaded once and cached by your browser.

Your styles and your licence do not follow you to another device.

What the publisher collects

If you do not subscribe: nothing. There are no accounts and no tracking. The website's pages — not the add-in inside Word — count visits with Cloudflare Web Analytics, which sets no cookies and does not follow you from site to site. It receives the ordinary information any web request carries, and reports totals such as page views, referring sites and countries. The add-in sends nothing to it.

The add-in's files and the language model are served as static files by GitHub Pages, and Microsoft's Office library is loaded from Microsoft; each of those services receives the ordinary technical information any web request carries, such as your IP address, under its own privacy policy.

If you subscribe, you buy from Lemon Squeezy, which takes your payment and keeps your payment details under its own privacy policy. It shares with the publisher what a seller needs: your name, your email address, your country, and your orders. The publisher uses them to answer you, to issue refunds, and to tell you about a change to the price or the terms, and for nothing else. See also the terms.

Questions

See the support page.