Privacy policy.
The short version
- Ghost has no accounts. We don't know who you are.
- Your photos, videos and files are encrypted on your iPhone. We never receive them and can't open them.
- The Ghost app has no analytics, no ads and no tracking.
- Backups go to your own iCloud, encrypted before they leave your phone. We can't read them.
- Apple handles payments. We never see your card or your Apple Account details.
This policy explains how Ghost Projects LLC ("Ghost", "we", "us") handles information in the Ghost app for iPhone and on ghostpics.app.
1. The Ghost app
What we collect
Nothing. The Ghost app doesn't send your content, your usage, your device identifiers or anything else to us. We don't run servers for the app, and the app contains no analytics, advertising or crash-reporting tools.
Your vault
Everything you add to Ghost is encrypted on your iPhone before it's saved. The keys that unlock it are protected by your PIN and your iPhone's Secure Enclave, and they never leave your device. We have no copy of your PIN, your keys or your content, so we can't open your vault, recover it, or hand it to anyone.
Hidden details in photos and videos
When you import a photo or video, Ghost removes supported hidden details (such as location, camera details and the date taken) on your iPhone, before encrypting it. This happens entirely on your device. Some details may remain in some files; the app shows you exactly what was removed and what wasn't.
Photos access
Adding items from Photos uses Apple's photo picker, which only gives Ghost the items you choose. Ghost asks for full Photos access only if you choose Remove from Photos, and uses it only to delete the originals you just moved into your vault. iOS asks you to confirm every deletion.
Face ID
If you turn on Face ID, iOS handles it. Ghost never receives your face data. It only learns whether the check succeeded.
iCloud backup (Ghost Plus)
If you turn on backup, Ghost stores encrypted copies of your vault in the private iCloud storage of your Apple Account, using Apple's CloudKit. Items are encrypted on your iPhone before upload. The key needed to read them is protected by a recovery key that only you hold. We can't access your iCloud data, and Apple can't read the encrypted contents. Your iCloud storage is subject to Apple's terms and privacy policy.
We never see or store your recovery key. If you lose it, we can't restore your backup.
Panic PIN
If you set up a Panic PIN and enter it, Ghost permanently erases the vault on that iPhone. Nothing is sent to us. It doesn't delete your iCloud backup.
Purchases
Ghost Plus is sold through the App Store. Apple processes your payment and tells the app on your iPhone whether you have Ghost Plus. We don't receive your name, email address, payment details or Apple Account information. Apple's handling of purchase data is covered by Apple's privacy policy.
Apple's own services
Like every app, Ghost is downloaded through the App Store, and Apple may share anonymous, aggregated statistics with developers (for example, download counts, and crash reports if you've chosen to share them with developers in your iPhone's settings). These don't include your vault content.
2. ghostpics.app
Launch list
If you join our launch list, we collect the email address you enter, plus which button you clicked and any plan you showed interest in. We use it only to tell you about Ghost's launch and major updates. We don't sell it or share it for advertising.
Hosting and logs
The website is hosted by Cloudflare, which processes standard technical information (such as IP address and browser type) to deliver the site and protect it from abuse. We don't use cookies for tracking, and the site has no advertising or social-media trackers.
If you email us, we receive your message and email address and use them only to reply. Email to ghostpics.app is delivered through Cloudflare's email routing.
3. Sharing
We don't sell or rent personal information, and we don't share it for cross-context behavioral advertising. We share the little we have (launch-list emails and support emails) only with the service providers named above, so they can run the website and email for us, or when required by law. Because we never have your vault content, keys or recovery key, we can't provide them to anyone, including in response to a legal request.
4. Keeping and deleting your information
Launch-list emails are kept until you unsubscribe or ask us to delete them, or until they're no longer needed for launch updates. Support emails are kept only as long as needed to help you. Data in the Ghost app stays on your iPhone and in your own iCloud, under your control. Deleting the app deletes the vault on that iPhone. You can remove Ghost's iCloud backup in iPhone Settings › your name › iCloud › Manage Storage.
5. Your choices and rights
You can ask us to access or delete the information we hold about you (in practice, a launch-list or support email address) by writing to [email protected]. Depending on where you live, including California and other US states, you may have additional rights under local law. We'll honor them and won't treat you differently for using them.
6. Children
Ghost isn't directed to children under 13, and we don't knowingly collect information from them.
7. Security
Ghost is built so that we hold as little as possible. Vault content is encrypted with AES-256-GCM on your device, and keys are protected by your iPhone's Secure Enclave. No system is perfectly secure. Ghost can't protect content you share outside it, copies kept elsewhere (such as Recently Deleted in Photos), or a device that has been compromised.
8. Changes
If we change this policy, we'll update the effective date above, and for significant changes we'll give notice in the app or on this site.
9. Contact
Ghost Projects LLC
Email: [email protected]