Privacy Policy

1. Who we are

Ghosthread AI is an independent software project built by M. Arslan. Throughout this policy, "we", "us", and "our" refer to the Ghosthread AI project. "You" refers to anyone using the Ghosthread AI software or website.

2. What the software does NOT collect

The Ghosthread AI desktop application is local-first by design. We do not collect, transmit, or store:

• • Your files or their contents.
• • Your screenshots or screen recordings.
• • Your chat logs or messages.
• • Your passwords, API keys, or credentials.
• • Your browsing history.
• • Your keystrokes or clipboard content.
• • Your contacts.
• • Any analytics about your activity within the app.

All of the above stays on your own machine, in an encrypted local database. It is never transmitted to us or to any third party.

3. When the software uses the cloud

Ghosthread uses cloud AI models for complex reasoning tasks — for example, understanding an unusual request or fixing a code error. When this happens:

• • An outbound privacy filter scans the payload before it leaves your device.
• • Windows file paths, API keys, environment tokens, and private keys are automatically scrubbed.
• • Only the minimal context needed to complete the task is sent.
• • Air-Gap Mode can disable cloud reasoning entirely, if you prefer.

You choose which AI provider to use (BYOK model). Your API key is used to make calls on your behalf and is never sent to us.

4. What we collect on the website

The Ghosthread website (ghosthread.online) collects a limited amount of data:

• • Anonymous page views: we count how many times each page is visited. This uses a one-way hash of your IP and user-agent, not your actual IP.
• • Referrer: we record which site linked you to us, if any.
• • Waitlist submissions: if you join the waitlist, we store your email, OS, and use case.
• • Feedback submissions: if you submit a review, we store your name, email, and message.
• • Audit logs: login attempts and admin actions are logged for security purposes.

5. How we use what we collect

• • To send you beta access keys and product updates.
• • To understand overall interest in the product.
• • To prevent spam, abuse, and unauthorized admin access.
• • To improve the product based on your feedback.

We do not use this data for advertising, profiling, or any purpose other than those listed above.

6. Who we share data with

We do not sell or rent your data to anyone. We share data only with the following sub-processors, and only to the minimum extent needed:

• • Vercel — hosts the website.
• • Upstash — hosts the waitlist and feedback database (Redis).
• • Google Fonts — serves typography.

Each sub-processor handles only the specific data needed for its function. None of them have access to files, screenshots, or chat content — because that data never leaves your device in the first place.

7. Data security

• • All website traffic uses TLS 1.3 transport encryption.
• • Server-side data is encrypted at rest.
• • Admin credentials are hashed with bcrypt.
• • Session cookies are signed, HttpOnly, and SameSite=Strict.
• • State-changing endpoints require CSRF tokens.
• • Login attempts are rate-limited.

8. Your rights

You have the right to:

• • Access — request a copy of the data we hold about you.
• • Deletion — request that we delete all data we hold about you.
• • Correction — request that we fix inaccurate data.
• • Portability — receive your data in a portable format.
• • Objection — object to any data processing you disagree with.

Email [email protected] with any of these requests. We will respond within 7 days and complete deletion within 30 days.

9. Data retention

We retain waitlist and feedback data for as long as you are a beta user, or until you request deletion. Audit logs are retained for security purposes for up to 90 days, then automatically purged. Anonymous analytics are retained indefinitely in aggregate form — because they contain no personal information.

10. Children

Ghosthread is not intended for use by anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has submitted data to us, contact us and we will delete it promptly.

11. International transfers

Our sub-processors (Vercel, Upstash, Google) may store data in data centers located outside your country, primarily in the United States and the European Union. By using the website, you consent to these transfers, which are safeguarded by the sub-processors' own privacy frameworks.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated effective date. Continued use of the website or software after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions about this policy or your data? Email [email protected].