// Trust & Security Report
Boondoggle Studio, LLC
Hemingway Editor: a writing clarity and readability tool with free web and desktop versions, paid Plus tier ($100/year) adding OpenAI-powered AI rewriting, grammar checking, and tone adjustment. Part of Boondoggle Studio portfolio.
Certifications held
0
Maturity
Growth
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 7 unconfirmed / not-held certifications
source: hemingwayapp.comno trust center or GDPR compliance documentation found; company claims privacy-first stance but lacks formal GDPR compliance certification or DPA
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
Unknown. No public documentation of data residency. Hemingway Editor is based in New York City. OpenAI (for AI features) operates US infrastructure. No EU data residency option documented.
Hemingway states on its Plus page: 'We will never sell your data, let others use it to train an AI, or use it for advertising.' Hemingway Editor Plus's AI features (rewrites, tone, grammar) send text to OpenAI's API. Per OpenAI's API data usage policy (effective March 1, 2023), data submitted via the API is not used to train or improve OpenAI models unless the customer explicitly opts in; API logs may be retained up to 30 days for abuse monitoring and are then deleted. This is consistent with Hemingway's no-training pledge, so the earlier 'contradiction' framing was not supported. The free web and desktop versions analyze text locally in the browser with no server transmission. Users handling sensitive content should still note that Plus AI features transmit text to OpenAI as a subprocessor.
// Security controls
Encryption in transit
Not documented. No public security page or transparency report found.
hemingwayapp.comData at rest encryption
Not documented. No public security page or transparency report found.
hemingwayapp.comThird-party analytics
IP address and browser type collected and shared with third-party analytics tools
creativewriting-prompts.com// Products & data scope
data: Text processed locally in browser; no server upload; local analysis only
Highlights readability issues, passive voice, weak adverbs, complex sentences. Includes basic grammar checking, readability score (grade level), and word/sentence stats. No AI features. No account required.
data: Basic readability: processed locally in browser. AI rewrites: sent to OpenAI API. Requires account; uses email or Google OAuth.
$100/year subscription. AI-powered features: custom rewrites, tone adjustment, shortening, polishing, simplifying, synonym suggestions, advanced grammar checking. AI rewrites cost credits (5,000 credits per year included). Uses OpenAI integration—OpenAI's ToS apply.
data: Fully offline; no data transmission to servers
Desktop app version of Hemingway Editor. Operates completely offline. No account required. No AI features in standard desktop version.
data: Text processed locally in browser or desktop; no server upload
Older/legacy version of Hemingway Editor. Basic readability and grammar features. No AI. No longer actively promoted.
// What to watch
- AI FEATURES USE OPENAI (NO CONTRADICTION): Hemingway Editor Plus sends text to OpenAI's API for AI rewrites, tone, and grammar. Per OpenAI's API data usage policy, API-submitted data is not used to train OpenAI models unless the customer opts in, so this is consistent with Hemingway's pledge that it will not 'let others use it to train an AI.' Note only that AI features transmit text off-device to OpenAI; OpenAI is not named on the Plus page.
- PRIVACY POLICY OPACITY: Privacy policy and terms of service exist but are not easily accessible at standard URLs (no /privacy, /terms, or /legal pages). They are referenced in the login flow but difficult for users to discover or review upfront.
- NO TRUST CENTER: No formal trust center, security page, or compliance documentation published. No transparency report on security practices or incident response.
- NO DPA: No Data Processing Agreement published. GDPR-regulated customers cannot easily comply with Article 28 requirements.
- NO CERTIFICATIONS: Despite privacy-forward messaging, the company holds no SOC 2, ISO 27001, HIPAA, or other formal compliance certifications. This is typical for growth-stage indie tools but limits enterprise adoption.
- ANALYTICS WITH THIRD PARTIES: Third-party analytics tools collect IP and browser type; cookie usage for analytics and potentially targeted advertising noted in external review.
- DATA RESIDENCY UNCLEAR: No documentation of where data is stored or processed. Critical for GDPR, HIPAA, or international data protection compliance.
- OPENAI SUBPROCESSOR: Text submitted to Plus AI features is processed by OpenAI's API under OpenAI's data policy (no training on API data by default; up to 30-day abuse-monitoring retention, then deletion). This is a subprocessor relationship worth noting for procurement, not a violation of Hemingway's privacy claims.
// At a glance
Pricing model
Freemium: free tier (web/desktop basic editing) + $100/year Plus subscription (AI rewrites, advanced grammar, tone control, document import/export, team plans available)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Boondoggle Studio, LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
hemingwayapp.com