privacy policy

1. Our Core Privacy Commitments

Ghostpost is designed from the ground up around four foundational privacy principles:

• Zero Social Passwords: We never ask for, collect, or store your social media passwords.
• No Live Account Linking: We do not connect to your live profiles via OAuth or scrape your active feeds. You upload official data export archives that you control.
• No Public AI Training: We never use your uploaded posts, photos, comments, or direct messages to train shared or public AI models.
• No Data Monetization: We do not sell, rent, or trade your personal data, archives, or contact information to advertisers, data brokers, or third parties.

2. Information We Collect

Waitlist & Contact Information

When you join our early-access waitlist, we collect your email address or mobile phone number, along with the source of your signup. We use this information solely to notify you when Ghostpost is ready for you, provide your early-access onboarding, and send critical transactional updates.

Uploaded Social Media Archives

To perform a scan, you voluntarily upload an official data export file (such as a .zip archive from Instagram, TikTok, X, Facebook, or Reddit). These archives contain your historical posts, comments, captions, dates, and media that you chose to export from the platform.

Technical Telemetry

We collect basic, privacy-preserving technical logs (such as IP address, browser type, and response latency) strictly to prevent abuse, rate-limit waitlist spam, and maintain the security and availability of our edge infrastructure.

3. How We Process Social Archives

When you submit a data export zip, our automated audit engine parses the text and metadata in an isolated, ephemeral processing environment:

• Content Categorization: Text is evaluated against reputational risk categories (such as alcohol, drugs, profanity, toxicity, or extreme hot takes).
• Report Generation: A prioritized review dashboard is compiled for your browser session, displaying flagged items, timestamps, and direct URLs or context to help you locate them.
• Strict Read-Only Isolation: The audit is generated exclusively for your review. Ghostpost has no ability to delete or modify posts on your live social accounts; you remain in total control of any cleanup action.

4. Data Retention & Immediate Purge

We believe you should never leave data where it doesn’t belong:

• User-Initiated Purge: You can permanently purge your scan results, parsed data, and uploaded files at any time directly from your dashboard. Once confirmed, deletion from our active systems is immediate.
• Automatic Expiration: Uploaded archive files are automatically deleted after your audit session completes or expires, unless you explicitly request temporary cloud retention for ongoing review.
• Waitlist Removal: You can remove yourself from the waitlist at any time by clicking unsubscribe in any notification or by emailing privacy@getghostpost.com.

5. Subprocessors & Infrastructure

We partner with industry-leading infrastructure providers who are contractually bound by rigorous data protection agreements:

• Cloudflare, Inc.: Edge hosting, DDoS mitigation, and serverless compute (Workers & D1 database). All traffic is encrypted in transit via TLS 1.3.

6. Security Practices

We maintain comprehensive technical safeguards to protect your personal information:

• All connections to Ghostpost are encrypted using modern HTTPS (TLS 1.3) with HSTS enabled.
• Archive processing runs in isolated sandbox environments with strict access controls.
• We adhere to the principle of least privilege: our staff never accesses or reads your private social archives except upon your explicit request for technical support.

7. Children's Privacy

Ghostpost is intended for high school, college, and adult users preparing for higher education admissions and employment. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has provided personal data to Ghostpost, please contact us immediately at privacy@getghostpost.com, and we will promptly delete the information.

8. California (CCPA/CPRA) & International Privacy Rights

Regardless of where you live, Ghostpost affords you the highest privacy standards:

• Right to Know & Access: You have the right to request a copy of the personal information we hold about you.
• Right to Delete: You have the right to request the permanent deletion of your personal data.
• No Sale or Sharing: We do not sell your personal information and do not share it for cross-context behavioral advertising.

To exercise any of these rights, simply email privacy@getghostpost.com. We will verify and process your request within 30 days without discrimination.

9. Security Vulnerability Disclosure

We welcome vulnerability reports from security researchers and developers. If you discover a vulnerability or security issue affecting Ghostpost, please disclose it responsibly by emailing privacy@getghostpost.com with reproducible steps. We appreciate your assistance in keeping our users safe.

10. Changes & Contact

We may update this Privacy Policy from time to time. When changes are made, we will update the "Last updated" date at the top of this page and notify waitlist members of any material revisions.

For any questions or concerns regarding our privacy practices, please contact us at:

• Privacy Officer: privacy@getghostpost.com
• General Inquiries: hello@getghostpost.com