Privacy policy

1. The short version

• Ghost only looks at what's already public, without logging in and without fake accounts.
• We never store photos of you or intimate images. Face matching keeps a template (a string of numbers), and the photos are deleted as soon as it's made.
• Nothing is filed without your review, and every scan and filing points back to a permission you gave.
• We don't sell your data, show ads or use your data to train AI models.
• You can download or delete everything from Settings at any time.

2. What we collect

Account: your first name, email, a scrambled (hashed) version of your password, and when you signed up and last signed in.

People you protect: the names, other names, city and state, school or team (for children), social handles and email addresses you add for yourself and your household, plus each child's birth year.

Permission records: for every permission, who gave it, for whom, when, which version of the wording, and the IP address and browser it came from.

Face templates: if you turn on face matching, the numbers made from three live selfies. See the face data section below.

ID check results: if you verify your identity, the result and the session reference from Stripe, our ID provider. Stripe collects your ID and selfie; we don't keep copies of either.

Findings: links to public pages and accounts, their titles and short excerpts, match and AI-detection scores, and a fingerprint of matched images (never the image).

Removals: the notices and form text you approve, where they went, and every step after that.

Help cases: the type of situation and the steps you take, if you use Get help now. Ghost works from links and never needs the images themselves.

Security data: counts of failed sign-ins and similar attempts, keyed by scrambled emails and IP addresses, deleted within a day.

3. Face data

Face matching is optional and only for your own face. Before we collect anything, you give separate consent, and you verify your identity so nobody can use Ghost to search for someone else.

How it works: three live camera shots are turned into face templates in memory and the photos are discarded straight away. If your ID check included a selfie, we briefly read it the same way to confirm your shots match your ID, then discard it; that template is only used for that check.

What it's used for: finding photos and videos of you in public places and spotting fakes. Nothing else.

How long we keep it: until you turn face matching off, delete your account, or 12 months after your last sign-in, whichever comes first. Then it's permanently deleted.

We never sell, lease or trade face data, and we don't share it with anyone except the providers that run Ghost's infrastructure.

Ghost doesn't use face matching for children.

4. How we use it

• To search public places for the people you protect and show you what we find.
• To prepare and send the removal requests you approve, and follow up on them.
• To email you about new findings, filings and your weekly summary, as you choose in Settings.
• To keep accounts secure and prevent misuse, such as someone trying to search for a person who isn't them.
• To meet legal obligations.

We don't use your data for advertising, and we don't use it to train AI models.

5. Who we share it with

Platforms and site owners you file with: a notice includes what you approve, usually your name, email and the link. You review every notice before it's sent, and you're copied on emails.

Service providers that run Ghost, only as needed for their part: hosting (Vercel), database (Neon), email delivery (Resend), web search (Brave Search), and ID verification (Stripe Identity). Each is bound to use the data only to provide that service.

Law enforcement or others when the law requires it, or when you ask us to help you report something.

If Ghost is ever sold or merged, this policy continues to apply to your data, and we'll tell you first.

We don't sell or rent personal information, and we don't share it for cross-context behavioral advertising.

6. Children

Ghost accounts are for adults. A parent or legal guardian can add a child, and confirms that they're the child's parent or guardian when they do.

For children, Ghost only looks at mainstream public places: search results, school and team pages, and public social posts. It never uses face matching for children, and children's protection is free.

Children don't use Ghost directly. If you believe a child created an account, contact us and we'll delete it.

7. How long we keep things

• Account, people, findings and removal records: for as long as your account is open, so your case file stays complete.
• Face templates: see the face data section.
• Password reset links and confirmation codes: expire within 30 minutes and can only be used once.
• Security counters: deleted within a day.

When you delete your account, we delete all of it. Notices already sent stay with the platforms that received them, and we keep only what the law requires (for example, billing records).

8. Your choices and rights

• See and download everything: Settings → Download my data.
• Correct details: Settings → People you protect.
• Withdraw any permission: Settings → Permissions. It takes effect straight away.
• Delete your face data: Your face → Delete my face data.
• Delete everything: Settings → Delete your account.

Depending on where you live (including California, Colorado, Connecticut, Virginia, Texas, Washington and other states), you may have rights to know, access, correct, delete and port your data, and to opt out of sale or targeted advertising. Ghost doesn't sell data or run targeted ads. You can use your rights in Settings or by emailing us, and you won't be treated differently for using them. If we decline a request, you can appeal by replying to our answer.

You can also use an authorized agent; we'll ask the agent for proof that you've authorized them.

9. Security

Data is encrypted in transit. Passwords are stored with scrypt, sign-in links and codes are stored only as hashes, sign-in attempts are rate limited, and access to production data is limited to people who need it to run Ghost.

No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

10. Changes and contact

If we change this policy in a way that matters, we'll email you before it takes effect.

Questions or requests: privacy@checkghost.com.