1 Information you provide

When you register in the iOS or Android app, we receive your username, email address, date of birth, selected country, postal code, city, chosen gender, and password. The registration form may display a preselected country, and you can review the information you provide. We use your date of birth to check the minimum age requirement of 18. We do not request a phone number when you register or when you send or open a Ghostyk PM message.

You can add information to your profile and publish posts, comments, reactions, tags, photos, videos, audio clips, and files, and create groups and pages. Other people may see these materials depending on the privacy settings and the feature used. Comments are visible to their intended audience; the app may display a “VIP” label instead of the username of a paid subscriber. The visibility of a private profile or hidden group is subject to what is described in the app. VIP+ users can place links to their business websites in comments; these links are user-posted content, not advertisements from Ghostyk.

We receive the information you send to our support team, including your email address, your message and its attachments, and what is needed to handle the complaint. Do not send us your bank card number or private-message passwords in support requests.

2 Device information and use of the service

Our systems process IP addresses, connection times, device and app information, account activity, security events, and technical logs to provide the service, protect accounts, diagnose errors, and investigate complaints. We do not use the device’s GPS to determine the country displayed at registration. We infer an approximate country from the connection’s IP address to suggest the country and interface language. If you use a VPN or a similar connection, the suggestion may reflect the VPN connection’s exit location instead of your actual location.

The app requests permission to access the camera, microphone, photos, files, or notifications only when a feature needs it, and subject to the permissions you grant on your device. You can manage these permissions in your device settings; denying a permission may disable the associated feature. Apple and Google independently process information related to app downloads and their platforms under their own policies.

3 Private chats and Ghostyk PM

Ghostyk provides encrypted one-to-one chats. Ghostyk employees cannot access the content of these private chats. However, we process account identifiers and the technical information needed to route and secure communications. The sender or recipient can keep a copy outside Ghostyk, including by photographing the screen; Ghostyk cannot remove these external copies.

Ghostyk PM sends one recipient an email containing a link to the message-viewing page at pm.ghostyk.com. The sender provides the recipient’s email address and the message, and can attach files or photos and add a note. The recipient selects the interface language and may be asked to enter a password manually set by the sender to open the encrypted message. If the sender puts the password in the note, the note and password arrive in the same email that contains the link. This makes delivery easier, but does not provide the protection of sending the password through a separate channel. The opening password is valid for one opening only.

After the recipient opens a PM message, a countdown determines how long it remains accessible; the recipient can press the “Destroy” button before the time expires. When the countdown ends or “Destroy” is pressed, the message cannot be opened again through Ghostyk PM. The email containing the link, copies in the inbox, screenshots, and other copies made outside the service remain under the control of whoever holds them. We process the delivery, access, and security information needed to operate PM, but our team cannot read the encrypted message content.

4 Payments and notifications

Purchases in both apps are made through Stripe. Stripe handles card data and maintains independent transaction records. In its Stripe account, Ghostyk can view purchase information, including the transaction date, plan, amount, status, buyer’s email address, and username when those data are available. Stripe also sends us payment notification emails containing this information. Ghostyk does not receive or store full debit or credit card numbers. Payment and refund terms are set out in the Ghostyk Apps Payment Policy.

We use Firebase Cloud Messaging and OneSignal for push notifications and in-app messages. These providers may receive device or app identifiers, the notification token and details, the IP address, and the technical delivery information needed for these features. You can disable push notifications in the app or device settings where available. Emails necessary for the service, such as those relating to accounts, security, delivery of PM messages, and purchases, may continue to be sent when the feature requires them.

5 Reasons for processing information

We process registration data, user content, account settings, private-message routing information, and purchase status to create your account, provide the features you request, activate your purchases, and respond to service requests. We process security and diagnostic data to prevent misuse, protect accounts, and keep the service running. We use support correspondence to answer questions and resolve complaints. We may process limited records to meet a specific legal obligation or respond to valid legal process.

For users subject to the European General Data Protection Regulation (GDPR), the usual legal bases include performance of a contract, compliance with a legal obligation, and our legitimate interests in security, service reliability, and handling requests, taking your rights into account. If a particular feature or processing activity requires your consent, we request that consent and allow you to withdraw it. An app permission or a general acceptance checkbox at registration does not, by itself, constitute consent to all uses of sensitive information.

6 Political opinions and other sensitive information

Ghostyk allows political and non-political discussions. We do not ask you to disclose your political opinions at registration and do not use them to target advertisements. Content you choose to publish may reveal political opinions or other sensitive information. The audience of a public post can read and retain it; keep this in mind when posting. If applicable law requires a special condition for processing sensitive information, such as explicit consent or another legally recognized exception, we apply that condition. We do not treat acceptance of the Terms of Use or this policy as blanket consent to the processing of sensitive data.

Faces may appear in photos and videos. We process these materials to display the content you submit, not to identify people using facial recognition technology or create biometric templates. We do not ask users to provide health information; if you disclose it in a post or support message, its processing is subject to the relevant feature and applicable law.

7 Service providers and sharing

Infomaniak hosts Ghostyk’s server in Switzerland. Cloudflare helps deliver and protect the service, while Backblaze stores media files. OneSignal and Firebase support notifications, and Stripe processes payments. These providers receive only the information necessary for their roles and handle it under the applicable agreements and their own legal obligations. Other users receive the profile or content you choose to share with them or publish to their audience.

We do not sell personal data or share it for cross-context behavioral advertising. Ghostyk does not currently operate its own advertising program. A business link posted by a VIP+ user in a public comment is that user’s content. We may disclose limited information when required by law or valid legal process, or when disclosure is necessary to protect users and the service to the extent permitted by law. If Ghostyk’s ownership changes, information may be transferred in accordance with the law and with appropriate notice.

8 Hosting and international transfers

Ghostyk LLC is located in Delaware. Infomaniak hosts the main app server in Switzerland. Providers such as Cloudflare, Backblaze, Stripe, OneSignal, and Google may process information in other countries depending on their service arrangements. Switzerland benefits from a European Union adequacy decision. When transfers require additional safeguards, we use a valid transfer mechanism under applicable law and can provide information about it on request.

We use access restrictions, encryption of data in transit where appropriate, and other technical and organizational measures to protect information. No system can guarantee absolute security. If a security incident occurs, we investigate it and provide the notifications required by applicable laws.

9 Retention and deletion

Posts and videos are not automatically deleted 30 days after upload. VIP accounts include 5 GB of storage, and VIP+ accounts include 30 GB for each 12-month period. Users can manage their storage and delete their content themselves in the app. Content remains available according to the feature and your choices until you delete it, the account is closed, or another rule requires its removal.

Paid access ends when the plan expires. If you do not purchase a new period within seven days after the plan expires, Ghostyk closes the account and makes its content inaccessible. The username, profile, posts, videos, tags, comments, messages, files, and groups and pages created by that account are removed from the service. The associated data is permanently erased from systems controlled by Ghostyk, including server copies and relevant backups, no later than 30 days after the paid plan expires. Erasure may occur when the account closes on the seventh day. Accounts that have only used free viewing are not closed under this paid-plan expiry rule.

You can also delete a free or paid account using the option in the app. After deletion, the account cannot be restored; its associated data is erased from systems controlled by Ghostyk no later than 30 days after account closure. Ghostyk cannot remove the app from your device remotely; you must delete it yourself. We do not contact former users to invite them back after their accounts have been deleted.

We retain support correspondence and technical logs only for as long as necessary to handle requests, maintain security, and comply with applicable duties. Copies associated with a deleted account and controlled by Ghostyk, including payment notification emails received from Stripe, are subject to the deletion procedures described, unless a nonwaivable legal obligation requires retention of a specific record. Stripe, app stores, banks, email providers, recipients, and other independent parties may retain their own records under their policies and legal obligations. We cannot delete copies made by another person outside Ghostyk. If the law requires us to retain a limited record, we restrict its use and delete it when that obligation ends.

10 Your choices and rights

You can update your account information, manage your device permissions and notifications, delete individual content, and close your account using the tools available in the app. To request access, correction, a copy of your data, deletion, restriction of processing, or to object to processing or ask a privacy question, write to info@ghostyk.com with “الخصوصية” (“Privacy”) in the subject line. We may verify that the request comes from the account holder without asking for unnecessary information. We respond within the period specified by applicable law and explain any legal restriction or exception.

If the General Data Protection Regulation (GDPR) applies to you, you can also withdraw consent where processing is based on it, request data portability where its conditions are met, and lodge a complaint with a data protection authority where you live, work, or believe an infringement has occurred. You can object to certain processing based on a legitimate interest. Deleting data does not necessarily erase copies independently retained by other users or providers.

If the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to Ghostyk and to you, you may have the right to know about, access, correct, and delete personal information, obtain information about its categories and purposes of use, and exercise rights to opt out or limit the use of sensitive information where applicable, without unlawful discrimination. We do not currently sell personal information or share it for cross-context behavioral advertising. Delaware residents may, if its Personal Data Privacy Act applies, have rights of access, correction, deletion, data portability, and certain opt-out rights. Privacy laws in other U.S. states may provide additional rights depending on their scope and exceptions.

Canadian users may have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial or territorial laws, including rights of access and correction. Rights in other countries depend on the laws that apply to Ghostyk and to the individual concerned. Contact us to exercise your rights; you can also contact the relevant supervisory authority where it has jurisdiction.

11 Minors and policy changes

Ghostyk accounts are intended for people who are at least 18 years old. We do not knowingly allow minors to register. If you believe someone below the required age has an account, contact us at info@ghostyk.com so we can review the matter and take appropriate action.

We may amend this policy when features, service providers, or laws change. We will update the date above and provide appropriate notice of material changes. The latest version will be available in the apps and through relevant service links. For privacy requests or questions, contact Ghostyk LLC at info@ghostyk.com.