Privacy Policy

Effective: May 26, 2026

1. What We Collect

GhostMode collects the following personal information to draft and send legally valid opt-out letters on your behalf:

• Full legal name — Required for letter drafting and broker verification
• Email address — Used for account management and broker contact
• Physical mailing address — Required by many brokers for identity verification
• Phone number — Optional; used for brokers that require phone verification
• Date of birth — Required by some brokers for identity verification

We also collect account data such as your email address, hashed password, and session tokens for authentication. We do not collect payment card information — all payment processing is handled by Stripe, our payment processor.

2. How We Use Your Data

• Drafting and sending opt-out letters to data brokers you request
• Managing your GhostMode account and session
• Sending transactional emails: verification, password reset, letter sent confirmations
• Tracking the status of your removal requests
• Improving our service and internal analytics (aggregate, non-identifying)

3. Data Sharing

We do not sell your personal information. We share your data only in the following limited circumstances:

• Data brokers — We send opt-out letters containing your personal information to the brokers you specifically request. This is the core function of our service.
• Service providers — We use OpenAI to draft letters and Stripe for payment processing. These providers are contractually restricted from using your data for their own purposes.
• Legal requirements — We may disclose data if required by law, court order, or government request.

4. Do Not Sell My Personal Information

We do not sell personal information. If you are a California resident and wish to opt out of the sale of personal information, you may contact us at support@ghostmode.app. We will respond within 15 days.

5. GDPR Rights (European Users)

If you are located in the European Economic Area, you have the following rights under GDPR:

• Right of access — Request a copy of your personal data
• Right to rectification — Correct inaccurate data
• Right to erasure — Request deletion of your data ("right to be forgotten")
• Right to restrict processing — Limit how we use your data
• Right to data portability — Receive your data in a structured format
• Right to object — Object to processing based on legitimate interest

To exercise GDPR rights, contact: support@ghostmode.app

6. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements. You may request account deletion at any time, and we will delete your personal data within 30 days, except where retention is required by law.

7. Security

We use industry-standard encryption (TLS) for data in transit, bcrypt for password hashing, and secure HTTP-only cookies for session management. No method of electronic transmission or storage is 100% secure, but we take commercially reasonable measures to protect your data.

8. Cookies

We use the following cookies:

• session — HTTP-only cookie storing your session token. Expires after 7 days. Required for authentication.

We do not use advertising or tracking cookies. We do not share cookie data with third parties.

9. Children's Privacy

GhostMode is not intended for users under 18 years of age. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We will notify you via email for material changes.

11. Contact

For privacy-related questions or to exercise your rights: support@ghostmode.app