How we handle your data
Ghostifier asks companies to stop using and delete your data, so it holds as little of yours as it can. This is what it reads, what it keeps, for how long, and who else touches it.
What it reads in your inbox
Ghostifier asks Google to let it see only the top part of each email, the part that says who it is from and when it was sent. For each email it reads the sender, the reply-to address, the subject, the date, and the unsubscribe and reply information. It can't open the body or attachments of any email, and Google enforces that limit on its side too.
That top part is read in memory to recognize companies, then discarded. What's kept is the list of companies and a few dates for each. Senders who aren't companies, like the people you write to, leave no trace.
What it keeps, and until when
| What | Why | Deleted when |
|---|---|---|
| Your email address and a one-way hash of your password | To sign you in and send you account emails | You delete your account, or 30 days after signing up if you never connect Gmail |
| Counts of attempts to sign in, sign up and reset a password, by a scrambled form of the IP address and email used | To stop someone guessing passwords or making accounts in bulk | Within a day |
| An access key for your Gmail, encrypted with a key of your own | To keep finding new companies in your inbox | You disconnect Gmail or delete your account |
| Your name, US state and the signed permission for Ghostifier to act for you, encrypted with your key | Companies need it to accept a request made on your behalf | You delete your account |
| The companies found in your inbox, and a few dates for each (first email, last order, last marketing email) | To know who has your data and what's been asked of them | You delete your account |
| The name of any company you remove from your list, and the day you removed it | So a scan doesn't add it back when it emails you again. Nothing else about it is kept | You add it back or delete your account |
| A record of what our staff did to your account (a complimentary plan, disabling it), with the date and why | So staff actions can be checked | You delete your account. Only what was done, when and by whom then stays, with your email address scrambled and no notes |
| Each request sent for you, the letter itself, and the company address it went to | To send it and track the answer | The letter and address: 30 days after the request finishes. That it was sent, to which company and when: until you delete your account |
| Companies' replies: their words, subject, sender address and any reference number, when each arrived, and its kind (confirmed, declined, verify your identity, a receipt, an automatic reply). Encrypted with a key that belongs to your account; only you can read it | So you can see how each request is going and what a company asked for | 30 days after the request finishes (at most 180 days after the company's last reply), or sooner if you delete it |
| Anonymous totals: counts by day and by company of requests sent and companies that were unsubscribed from, opted out of or deleted | To know how well Ghostifier is working overall. They contain only counts, so they can't be traced to you | They stay after you delete your account |
A scheduled job enforces these dates. Mail that reaches Ghostifier's addresses but answers none of your requests keeps only its arrival time, for 7 days. A company's reply is read by software to sort it, and what it says is kept for you (encrypted, as above), never from your Gmail. Where a reply arrives through Amazon Web Services, the full message is deleted there as soon as it is recorded, and where it arrives through Resend, Resend also keeps it under its own retention period.
How requests go out
Requests are sent from Ghostifier's own address, as your authorized agent, under the permission you sign. Nothing goes out from your Gmail, and Ghostifier can't send email as you. Each request includes what a company needs to find your records: your name, email address and state. On a paid plan, if you choose it, the same request goes to data brokers on a public register, even if they never emailed you.
Who else handles it
- Google, for Gmail access and signing in with Google.
- Railway, which hosts the app and its database.
- Amazon Web Services and Resend, which send requests to companies and receive their replies. Resend also sends Ghostifier's emails to you.
- Umami, which counts visits to the public pages and sign-in pages, without cookies. It is also told when an account is created (with the visit's IP address and browser, so it can link the two) and when a plan is bought (the plan and the amount, never who bought it), unless your browser sends Do Not Track.
- Stripe, whose Link checkout sells the plans and takes payment. It gets your email address, and your card goes straight to Stripe, never to Ghostifier.
- The companies you ask, which receive your request and the details in it.
- The people who run Ghostifier, who can see an account's basics (email, name, plan, whether Gmail is connected, how many requests were sent) to run accounts and answer support. Not the companies on your list, your legal name, or your requests.
Your data is used only to find companies and send your requests. Ghostifier doesn't sell it, and never uses it for advertising or to train AI models. Its few cookies only keep it working, like keeping you signed in. The public pages count visits with Umami, which sets no cookies and records only the page, the site that linked to it, your country and your type of device, and that an account was created or a plan bought, never what you do once you're signed in.
Seeing and deleting it
Signed in, Settings, then Your data shows everything stored about you right now. Delete everything on that page removes Ghostifier's access to your Gmail, deletes your data, destroys your encryption key and emails you a confirmation. Backups keep a copy until they expire. Requests already sent can't be recalled from the companies that received them.