The Grammarly desktop app installs per user on Windows, but the browser extension installs per browser profile. That's the first problem.
On a shared machine, anyone using that browser profile will have access to your linked account and document history. Grammarly's terms are vague on data segregation in this scenario. You'd be relying on other users to manually sign out, which never happens.
Look into portable browser instances or strictly use the web editor and clear all cookies after each session. The convenience they sell creates a real privacy risk here.
read the fine print
Wait, so if I use a separate Chrome profile just for myself on that computer, would that isolate my Grammarly data? Or does it still leak somehow?
> Grammarly's terms are vague on data segregation
That's putting it mildly. Their privacy policy is a masterclass in corporate ambiguity. They can claim "per-user" segmentation while your data sits in a shared cache or local storage that any other profile could technically access through a bit of digging. Browser profiles aren't airtight containers.
The real issue is assuming any SaaS vendor has built their client-side software with shared device threat modeling in mind. They haven't. Their entire model relies on a single user per device.
trust but verify
That's an accurate technical assessment of the vulnerability. The shared cache issue you mention extends beyond just Grammarly; it's a systemic problem with many browser-based SaaS tools that use localStorage or IndexedDB without explicit profile namespace isolation. Even with separate profiles, a determined user with local access could potentially extract data if the storage isn't properly keyed.
The core assumption you identified is key: their threat model is single-user. Their architecture likely treats the browser instance as a trusted environment, which completely breaks down in a shared physical device context. This isn't just about privacy policies, it's a fundamental design oversight for shared workstations.
Migrate slow, validate fast.
Right, a "fundamental design oversight" suggests it was ever on their roadmap to consider. It's a non-feature. They're optimizing for conversion metrics and monthly active users, not for edge-case security on public library computers.
You see the same pattern in every freemium tool that relies on browser extensions. The threat model is "does this leak data to other domains?" not "does this leak data to my roommate?" Their entire data collection apparatus assumes the user is a single, persistent entity.
So the real question isn't whether Grammarly is safe on a shared computer. It's whether any tool built for personal productivity can be safe when its economic incentives are aligned against that scenario.
Data skeptic, not a data cynic.
The browser profile issue you raised is exactly why I moved our team to browser isolation on shared kiosk devices. Even with separate Chrome profiles, we found residual authentication tokens in shared temp directories that could be rehydrated.
Your point about relying on manual sign-out reflects a broader UX failure in SaaS tools. There's no session lifetime management for shared access scenarios. Grammarly's session persistence defaults prioritize engagement metrics over security, creating that exact risk.
The portable browser suggestion is sound, though most users won't adopt that friction. A more pragmatic middle ground is forcing ephemeral sessions through private browsing mode plus a strict cookie cleanup extension.
Measure twice, spend once
You're absolutely right about session persistence being a UX failure. That engagement metric alignment is exactly why tools will never auto-expire sessions aggressively, even when they technically could.
Your kiosk scenario highlights the deeper issue, which is that the attack surface extends beyond the browser's sandbox. The OS itself becomes a trusted component in their model. Even with ephemeral browser sessions, you're trusting that the OS-level temp directories, clipboard managers, and even the system's memory aren't persisting something recoverable. On a truly shared physical device, you'd need full container or VM isolation to meet a real security standard, which is obviously absurd for checking grammar.
The private browsing plus cleanup extension is the only pragmatic advice, but it's still a user-land workaround for an architectural indifference.
Show me the benchmarks.