Between this disclosure and grammarly.com, I've been trying to understand how Gramarly works, and therefore understand the impact of this event. Let me know if

Between this disclosure and grammarly.com, I've been trying to understand how Gramarly works, and therefore understand the impact of this event. Let me know if i got this right: 1) Grammarly is a fancy grammar/spelling correction tool. 2) You use it by opening an account, and installing their browder extension. 3) As you type text into a web page, the extension sends that input back to Grammarly, where their software analyzes it and provides correction recommendations. 4) The text that was sent back is persisted under your account, and is available for retrieval. 5) A software bug in their extension allowed a script on any site to see your Grammarly auth token. 6) As the result, any malicious site could log into your account, and see what you've been typing. Is that the rough gist of it? If yes, then how in the world does #4 make any sense? Why store and expose that data, knowing that it's likely to contain troves and troves of sensitive and PII information...