Privacy

Your account

• Your email and name. With email sign-up, a securely hashed password (never the password itself).
• If you sign in with Google or Discord: your account ID, name, email and profile picture from that service, so that sign-in links to your GhostChat account. We only link by email when the provider says the email is verified. We never get your Google or Discord password.
• Your plan and, if you upgrade, the Whop membership ID.

Your sites and training content

The sites you add, their settings, and the content you train them on: pages we fetch from your site, files you upload, text you paste and Notion pages you import. It is used only to answer questions for that site.

Visitors who chat with a GhostChat widget

• Their messages and the replies, so site owners can read transcripts and improve answers. Emails, phone numbers and ID numbers are masked before storage.
• A random chat ID and a sound preference in the browser's local storage. The widget sets no cookies and no ad trackers.
• An email address, only if the visitor chooses to leave one for a follow-up.
• The page the chat was opened on.

Who helps run GhostChat

• Render hosts the app.
• Supabase stores the database and, for Google and Discord sign-in, handles the sign-in step.
• OpenRouter passes each question, with the matching parts of the site's content, to the AI model that writes the reply.
• Whop handles payments if you upgrade. GhostChat never sees your card details.
• Google and Discord, if you choose them to sign in.

What we don't do

• No selling or renting of data.
• No ads and no ad or analytics trackers.
• Your training content and transcripts aren't shared with other customers.

Your choices

You can delete training content from your dashboard at any time. To delete your account and everything linked to it, or for any privacy question, open a request on GitHub issues (don't post personal details there; we'll follow up privately).