Ghost and Core Privacy Policy

Core uses the information you provide and the sources you connect to answer questions, carry out tasks and remember useful context. Depending on the features and permissions you enable, this can include:

This information may contain sensitive details about you or other people, including private communications and health, financial or location information.

Core does not use a remote AI model as a fallback for its local conversational AI or memory processing. Online features can still send task information to external services, as described in Section 2.

Some features give Core ongoing access to information:

Core can create or update memories in the background. A memory can exist separately from the conversation or file it came from, and it may be inaccurate. You can use the available controls to review, correct or remove it.

When you use a paired phone or computer to view or download conversations, files or previews from Core, that device may save its own local copies. Depending on your backup settings, those copies may also be included in device or cloud backups. Erasing Core does not erase these separate copies; manage them using the paired device’s storage and backup settings.

Some online features use third-party services to carry out a task. Ghost provides managed access to make these features simple to set up. For example, you can enable a service without obtaining a separate API key from its provider.

For a Ghost-managed service, the request travels from Core to Ghost's managed-service gateway, then to the third-party provider. The response returns through the gateway to Core. The request contains the information needed for the task: for example, a search query, or a phone number and instructions for a call. That information can include personal details from your task.

Ghost handles the request and response content only to forward it. The gateway does not save that content in databases, request logs, backups or troubleshooting records. We do not use it for analytics, profiling or AI training. Core can still save the conversation or result on your hardware.

The third-party provider receives and processes the request content. Its retention and use of that information depend on its own policies and applicable agreements. Ghost's decision not to store forwarded content is not a guarantee that the provider does not store it. Deleting a result on Core does not necessarily delete the provider's copy.

You can configure direct provider connections in the app using your own API keys, often called bring your own key or BYOK. Core then sends requests directly to that provider, without passing through Ghost's managed-service gateway. This changes the route for that service; other Ghost-managed services you leave enabled still use the gateway. Using your own key does not change the provider's privacy practices.

When you connect an existing account, Core receives the permissions you approve. Some connections continue syncing in the background. Ghost may handle account identifiers, access credentials, permissions, connection status and change notifications to establish or maintain the connection. Sending a message or uploading a file also gives its contents to the service and the intended recipient.

Ghost retains records needed to authorize devices, maintain connections, manage usage limits and protect the service, such as device identifiers, authorization records and service-usage counts. These records do not include the content forwarded by the managed-service gateway or remote-access relay. These no-storage commitments concern forwarded content; they do not mean that Ghost holds no account, connection, purchase or support information.

Remote access connects a paired phone or computer to your Core over the internet. Ghost provides a remote-access relay so you can reach Core from another location. The connection is encrypted. The relay forwards traffic; it does not run your conversational AI or store your conversations, files or memories.

The relay does not save the content it forwards in databases, traffic logs, backups or troubleshooting records. We do not retain that content for analytics, profiling or AI training. Information you access or create remains subject to storage on your Core, paired devices and any third-party services you choose to use.

You can replace Ghost's remote-access relay with your own connection, such as a private network set up using Tailscale. Your remote-access traffic then travels over that connection without using Ghost's relay. Replacing the remote connection and using your own API providers are separate choices. Using both can remove Ghost's gateway and relay from those data paths.

When you buy Core or another product from Ghost, we receive information from you and our payment and delivery providers, such as your contact details, billing and shipping addresses, order details, payment status and delivery information. We use it to process and deliver your purchase, handle returns and warranty service, prevent fraud, resolve disputes and maintain required business records.

When you contact us, we receive your contact details, message and anything you choose to include, such as screenshots, logs, attachments or conversation content. People handling your request can read that material to investigate the issue and respond. Review it before sending if it contains private information.

We do not automatically collect product telemetry, usage analytics or diagnostic reports from Core or its companion software. Diagnostic material is sent to us only when you choose to include it in a support or bug report. We do process the operational records of requests to our online services described in Section 2.

Our website infrastructure receives the technical information needed to serve a page, such as your IP address and request details. Forms collect the information you submit so we can respond or provide the requested service.

We do not use optional analytics, advertising pixels or other optional tracking on our customer website. You can unsubscribe from marketing messages using the link in the message. We may still send communications about purchases, support, service or security.

Ghost does not keep a cloud copy of your on-device conversations, files, connected-app content or memories, or store content forwarded through its gateway or remote-access relay. This section concerns the purchase, support, account and service information Ghost receives, including any private material you choose to submit to us.

We use that information to fulfill requests, operate and protect our services, handle purchases and support, and meet legal obligations. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising or use it to train AI models.

We share relevant records with providers that help us operate, such as payment, delivery, hosting and support providers. They must handle those records under their agreements with us and applicable law.

We may disclose relevant information to professional advisers, to comply with law or valid legal process, address fraud or security incidents, protect rights and safety, or establish or defend legal claims. Records may also be disclosed during a merger, acquisition or other business transfer, subject to applicable confidentiality and privacy obligations. These disclosures do not provide access to content stored only on your devices or create copies of content Ghost does not retain.

Information Ghost receives may be processed in countries where we or our providers operate. Contact us for information about the safeguards applicable to international transfers.

Local conversations, files, imported information and memories remain until removed through the relevant controls or retention rules. Synchronization and storage limits can also affect what is retained.

Screen-history records expire seven days after the content was last observed, or sooner if storage limits are reached. You can pause capture or clear the stored history. Clearing history also stops that capture session, but does not delete information already saved separately in a conversation, file or other output.

Pausing capture or disconnecting a source stops further collection through that feature; it does not delete information already saved. Deleting a source file or conversation does not necessarily delete a separate memory derived from it. If a source remains available, later synchronization or memory processing can bring the information back.

Use the relevant controls to delete local content and memories, remove credentials or erase Core's managed user data. A connected service may also require you to revoke access or signed-in sessions through its own settings.

Erasing Core does not remove copies on companion devices, in exports or backups, or with Ghost, another service or a message recipient. Restoring a backup may restore previously deleted information. Requests about information Ghost holds are covered in Section 8.

A legal hold or another lawful exception may require us to keep records we already hold for longer. We continue to restrict their use and access. This does not create a stored copy of gateway or remote-access content that our systems do not retain. Our retention and deletion commitments for records kept by Ghost also apply to copies held by providers on our behalf, including backups. External services that receive a task request may retain information under their own policies and applicable agreements; Ghost's no-storage commitment does not guarantee deletion of their copies.

We use device-access controls and protected connections to help secure Core and communications between paired devices.

The security of your devices and connected accounts also matters: someone with access to an unlocked device or an authorized account may be able to access its information.

Before returning a Core or sending it for repair, back up what you need and follow the erasure instructions. Contact us before sending it if you cannot erase it. No security measure eliminates every risk; we provide notice of an incident when required by law.

Depending on where you live and the law that applies, you may have rights to learn what personal information is processed; access or receive a copy of it; correct or delete it; restrict or object to processing; withdraw consent; or limit certain uses of sensitive information. Applicable law may also give you rights concerning sale, sharing, targeted advertising or certain significant profiling, and rights to appeal a decision or complain to a privacy regulator.

Contact us using the details below to make a request. Describe what you need and the purchase, device or interaction involved. We may need to verify your identity and, where relevant, an authorized agent's authority. Do not send passwords or recovery keys.

We respond within the time required by applicable law and explain any extension or limitation. We do not unlawfully discriminate against you for exercising your rights. If an appeal is available, contact us with "Privacy appeal" and the details of your original request.

For information stored only on your devices, we can help you use the relevant local controls. Information independently held by another provider may require a separate request to that provider. Where processing depends on consent, you can withdraw it through the relevant control or by contacting us. Withdrawal applies to future processing and may affect the feature that depends on it.

Ghost's online services are intended for people aged 13 and older and are not directed to children under 13. We do not knowingly collect personal information online from children under 13. If we learn that we have collected it without the authorization required by law, we take steps to remove it and stop the unauthorized processing.

We welcome independent security firms to audit the managed-service gateway and remote-access relay. Contact support@ghost.ai to arrange a review of these data flows.

For privacy questions, requests or appeals, contact:

Ghost
Attention: Privacy
325 9th Street
San Francisco, CA 94103, United States
Email: support@ghost.ai

We update this policy when our practices or applicable requirements change. The effective date identifies the current version. For material changes, we provide notice through the product, website or another suitable channel before the change takes effect where required. If a change requires consent, we obtain it; posting an update or continued use of Core does not replace that consent.