Understood, but how come it doesn't distinguish between grammatical items and non-grammatical ones, like passwords, if of course it is true that it "checks" everything?
The FAQ (do read it) says that what is typed in fields marked "sensitive" is not sent. That might be fine if you are confident that all web pages asking for passwords do mark the password field as "sensitive".
I don't find the FAQ very reassuring.
I am very wary of extensions that send your data to servers. Less so, for extensions that read URLs and possibly modify responses (e.g. ad and tracker blockers) because they do all their processing locally.
But it comes down to a) sensitivity and confidentiality of your work, b) the benefit of using the service, and c) trust.
For grammar correction, I much prefer to rely on tools on my computer (or my own grammar). When I have tried Grammarly I have often been unhappy with its suggestions. I get annoyed with apps like Grammarly which seem not to respect my country settings - e.g. it wants me to correct colour.
But:
You can tie Grammarly down to particular web sites - or to ask every time you visit any website. For example, you might be happy with Grammarly checking your posts on a public forum (like MacRumors) where confidentiality is not an issue, but not want it checking grammar on a business related website.
Safari > Settings > Websites > Grammarly (in the sidebar). Then, for example, allow MacRumors websites and deny all others.