Legal

Privacy Policy

Last updated: August 22, 2026

Lexicon is a local-first desktop writing app, with an optional browser extension beta, operated by Aashish Harishchandre (“I,” “me,” or “Lexicon”). This policy explains what data stays on your device, what limited network activity can happen, and how to delete local data.

This is a practical policy for an indie open-source project—not a substitute for professional legal advice.

1. Short version

• No Lexicon accounts and no Lexicon cloud sync of your documents.
• Your drafts, settings, dictionaries, and history are stored locally by default. The external-endpoint exceptions are described below.
• Proofreading and AI can run locally, but a server URL that you configure may receive the text and prompt sent to that server.
• The browser extension can send supported page text to the Lexicon desktop app on the same device for proofreading or Tone/rewrite actions. It does not send that text to a Lexicon-operated cloud service.
• I do not operate a cloud backend that stores your writing.
• The desktop app may automatically check for updates. Installing an update, downloading a model, or contacting support is still your choice.

2. Data stored on your device

Depending on how you use Lexicon, your device may store:

• Documents and drafts in the app’s local browser/WebView storage. The current rich-text document is saved as HTML; automatic draft snapshots can include the HTML, plain text, timestamp, and word and character counts.
• Document history and AI transform history. History has no time-based expiry; the normal item limit can be exceeded by entries you lock.
• Settings and preferences (language, appearance, layout, proofreading options, beta update channel, AI backend preference, and similar), including a local marker that remembers initial operating-system startup setup
• Personal dictionary and dismissed suggestion state. A dismissed suggestion key can include the rule message, original text, and sentence context used to recognize it on later checks.
• Custom tools / prompt overrides, transform history, and export-related preferences (for example DOCX author name)
• Downloaded AI model files and an AI preferences file in Lexicon’s local app-data directory (for example under Application Support / AppData)
• The AI preferences file can contain your selected backend, model names, a custom LM Studio URL, and an LM Studio API token. The token is stored in the local ai_prefs.json file and is used as a Bearer token on requests to the configured LM Studio server for authentication. Lexicon does not send that token to the Lexicon operator, and the application does not provide a separate encrypted token vault.
• Import/export files you choose to open or save elsewhere on disk
• Browser-extension settings and dictionary cache that the browser stores in local extension storage: whether proofreading is paused, the hostnames where Lexicon is disabled, cached dictionary words, the dictionary revision, and pending add/remove operations. The extension does not store page text in that storage.

Documents, histories, dictionary entries, prompt data, preferences, and downloaded models use ordinary WebView or local filesystem storage. Lexicon does not apply application-level encryption to these records or provide an encrypted backup. This is not a guarantee against device loss, account access, malware, or operating-system backup providers. Protect your OS account and control which folders are included in backups or synchronization services.

I do not receive copies of this content in the normal course of using the app. There is no cloud copy of your drafts for me to delete on your behalf.

Browser extension controls

The beta extension requests optional HTTP/HTTPS page access. On a page where access is granted, its content scripts match all URLs and frames, including supported blank-frame fallbacks, and automatically scan supported visible editable fields. Proofreading is enabled by default: a non-empty visible field is normally checked about 700 milliseconds after input, with at most three field checks running at once. Firefox 142 or later is required. You can pause proofreading globally or disable Lexicon for the current website. Pausing stops proofreading checks but does not prevent a manually requested Tone/rewrite action; disabling a website prevents Lexicon extension processing there. These controls are stored locally in the browser extension. You can also add a flagged word to the shared personal dictionary. Dictionary changes are sent over the same-device loopback connection to the Lexicon sidecar, while the extension keeps a local cache and offline queue. The canonical dictionary is stored in Lexicon app data, and dictionary words are not sent to a Lexicon-operated cloud service.

3. Deleting local data

You control local Lexicon data on your machine. Common options:

• Windows uninstall: the Nullsoft (NSIS) installer may offer a “delete the application data” option. Choosing it removes Lexicon application data associated with that install path/flow.
• Manual cleanup: you can delete Lexicon’s app-data folders (models, prefs, and the shared dictionary) and clear the app’s WebView / local storage if anything remains after uninstall or if you use a portable/dev build.
• Browser extension: remove the extension from your browser and use the browser’s extension-data controls if you also want to remove its locally stored pause, disabled-site, dictionary cache, revision, and pending operations. To remove the canonical shared dictionary, also delete the Lexicon app-data dictionary or remove it from the desktop Settings dictionary manager.
• macOS / Linux: remove the app bundle or package, then delete Lexicon folders under Application Support / local share if you want a full wipe.

Reset to Default resets selected interface and proofreading preferences; it does not delete the current document, document or transform history, dictionary, dismissed suggestions, custom tools, prompt overrides, AI setup, or the LM Studio token. The in-app history controls also leave locked entries in place and do not delete the current document. Remove those records separately when you want a full local-data wipe.

4. What leaves your computer

Lexicon is local-first, not an unconditional promise that no bytes can leave your computer. The destination depends on the backend and URLs you use. Lexicon does not send your writing to a Lexicon-operated cloud service for normal grammar checking or AI transforms.

• Browser extension connection: when you run the beta extension on a supported page, it may read text from enabled fields in the page and send that text over a loopback connection to the Lexicon desktop app on the same device. This can include the current field text for a Tone or rewrite action. The app returns results to the extension. This local exchange is not a transmission to a Lexicon-operated cloud service.
• Shared dictionary synchronization: the desktop app and extension send individual dictionary add/remove requests and revision reads over the same-device loopback connection to the Lexicon sidecar. The sidecar stores the canonical dictionary in the Lexicon app-data directory; each client keeps a local cache and an offline mutation queue. Dictionary words are not sent to a Lexicon-operated cloud service. If the sidecar is unavailable, queued changes remain local until a later connection.
• Local API trust boundary: the desktop application exposes an unauthenticated HTTP API on loopback (127.0.0.1:18000 in packaged builds and 127.0.0.1:8000 in development) for the desktop UI and extension. It is not an encrypted or authenticated channel. Other software running on the same device may be able to connect to that port and submit or read request data, so do not run untrusted local software while using Lexicon.
• Local processing: the packaged LanguageTool engine, any downloaded local GGUF model on a supported build, and default local-server configurations process text on the device. A default local Ollama server (localhost:11434) or default local LM Studio server (localhost:1234) is also a server on your device.
• User-configured AI servers: if you configure LM Studio with a LAN or remote URL, or configure Ollama to use a non-local server, the text and prompt sent for a transform go to that server. The server operator may retain or process the request under its own policies. LM Studio model-availability probes also go to the configured URL, and an API token, if saved, is sent in the authorization header. Extension Tone/rewrite requests follow the same backend choice.
• Network configuration: LANGUAGETOOL_SERVER, OLLAMA_SERVER, and LM_STUDIO_SERVER can redirect backend requests in any installation when configured. Advanced source/development settings such as VITE_API_URL and LEXICON_HOST can redirect or expose the standalone API. Custom URLs may use unencrypted HTTP; an LM Studio Bearer token sent to an HTTP URL can be observed by parties able to monitor that connection.
• Optional remote proofreading configuration: any installation with the LANGUAGETOOL_SERVER environment override can route proofreading to an external LanguageTool-compatible endpoint. In that case, proofreading text is sent to that endpoint. Packaged builds use the bundled local engine by default.
• Backend availability probes: Lexicon may check the configured Ollama and LM Studio servers for available models. These probes are sent to the configured server and return server/model metadata; they do not include document text.
• Retries and cancellation: a transient failed request can be retried, and cancelling a proofreading or transform request stops Lexicon's wait but cannot retract text already received by a remote endpoint. Whole-document transforms may send several chunks to that endpoint.
• Automatic update checks: the packaged desktop app may contact GitHub-hosted update manifests shortly after launch (stable channel by default; beta channel if you enable beta updates). Packaged builds enable operating-system startup by default and can start in the background with a tray process, so an update check can occur without the main editor window being visible. The current build has no in-app startup toggle; after initial setup, an operating-system startup disable is respected. Checking does not install anything by itself. Downloading and installing an update happens only if you choose to.
• Beta updates: the beta toggle only changes which update manifest is fetched. It does not send your documents, dictionary, or identity to me.
• Release lists: Settings may fetch public release metadata from GitHub’s API when you open that UI.
• Optional model download: when you choose Download & enable, Lexicon retrieves a local model file from Hugging Face (or its CDN). Your document text is not sent as part of that download. Model files are subject to their own third-party licenses.
• Optional Ollama: if you select Ollama, requests go to the Ollama server configured for Lexicon. The default is a local server on your machine; a non-local server is covered above.
• Source and development setup: the quick-start or manual source setup can download Python packages from PyPI, frontend packages from npm, and the official LanguageTool standalone archive from Maven Central. These downloads are installation activity, not uploads of your document text.
• Remote images: if you insert or paste an image that uses an https:// (or other remote) URL, your device may fetch that image from the host you referenced when the document is displayed or reopened. Imported HTML can contain the same kind of image reference. Prefer embedding local images if you do not want that request.
• Clipboard and exports: user-initiated paste can read text or images from the OS clipboard, and copying history writes text to that clipboard. DOCX and EPUB exports can include metadata such as author, title, publisher, language, timestamps, and tracked-change information. Clipboard managers, file systems, and recipients may process those values under their own policies.
• Links you open: website, Discord, GitHub, docs, or other URLs you click open outside the private editor flow.

Those third parties process connection metadata (such as IP address) under their own policies (for example Cloudflare, GitHub, Google Fonts, unpkg, img.shields.io, Hugging Face, Maven Central, PyPI, npm, Discord, or an image host you link to). The operator of any external AI or LanguageTool-compatible endpoint you configure may also process the request contents and authentication data.

5. Website

The marketing site at lexicon-writer.pages.dev is hosted on Cloudflare Pages. Like most websites, hosting and CDN providers may process technical logs (such as IP address, user agent, and request timing). The site may load fonts from Google Fonts, a scrolling library from a public CDN (unpkg), and public repository metadata from GitHub’s API (for example release or star counts). The Lenis file from unpkg executes third-party JavaScript on this marketing page and can access the page DOM for scrolling. The download selector also reads browser architecture, bitness, and limited WebGL renderer hints locally, without putting those values in Lexicon request bodies or URLs. README status badges can request images from img.shields.io when the README is rendered. I do not run a first-party analytics product that profiles your writing inside Lexicon. Browser extension packages may be distributed as published GitHub release artifacts, so GitHub may process download connection metadata under its own policies.

The extension can interact with text fields on websites where you enable it. Those websites, your browser, and any other browser extensions you install may separately collect or process page content under their own terms and privacy policies. Lexicon does not control that processing.

6. Community, bug reports, and email

Bug reports and feature requests for Lexicon should go through the Lexicon Discord (for example bug-reports and feature-requests channels).

GitHub is primarily for source code, releases, and pull requests. GitHub Issues may still exist and I may still address them, but Discord is the preferred channel for product bugs and feature requests.

If you post on Discord, open a GitHub issue or pull request, or email me, you share whatever you include in that message (and Discord/GitHub/Google process it under their terms). Prefer not to paste highly sensitive drafts into public channels.

Lexicon does not send automatic crash reports, usage analytics, or diagnostic logs to me. A voluntary report may include your contact details, account or community username, screenshots, logs, or text that you choose to attach. I may retain that information only as needed to respond, investigate, or maintain the project, subject to what the relevant community or email provider retains. You can ask me to delete a support message or copy that I control; I cannot delete copies retained by Discord, GitHub, Google, or another provider.

Contact for privacy or security questions: hello.lexiconwriter@gmail.com.

7. Children

Lexicon is a general productivity tool and is not directed at children under 13. I do not knowingly collect personal information from children through a Lexicon account system, because Lexicon has no accounts. If you believe a child has sent personal information by email or community channels, contact hello.lexiconwriter@gmail.com and I will delete what I can control on my side.

8. Changes

If this policy changes in a material way, I will update the “Last updated” date on this page. Continued use of the website or app after changes means you have read the updated policy.

9. Open source

Lexicon’s source code is released under the MIT License. Third-party libraries, engines, and optional model weights (including LanguageTool, TipTap, llama.cpp-related tooling, Hugging Face–hosted models, and others listed in the project README) are subject to their own licenses and notices.

← Back to Lexicon  ·  Terms of Service