The short version: we collect what we need to make and post your videos, we don't sell your data, we only use essential cookies, and you can delete everything from Settings anytime.
1. Who we are
GhostPost ("we", "us") is an independent business. We are responsible for the personal information described here. Contact us about privacy through support@useghostpost.com.
2. What we collect
From Google when you sign in: your name, email address, profile picture and a Google account identifier. We do not get your Google password, and we don't access your Gmail, Drive or contacts.
Account and preferences: your plan, default niche, default voice, posting schedule and timezone, and how many videos you've generated.
Content we generate for you: the videos, voiceover audio and caption timing created for your account.
Payment information: handled by Stripe. We receive a Stripe customer ID, your subscription status, and limited billing details (such as card brand, last 4 digits and billing country). We never receive or store your full card number.
TikTok (only if you connect it): your TikTok account identifier, display name and avatar, and the access tokens needed to post on your behalf, plus the IDs and status of videos we post for you.
Technical data: IP address, browser and device type, and logs of requests and errors, used to run and secure the Service.
Messages: anything you send us by email or through the contact page.
3. How we use it
- to create your account, sign you in and keep you signed in;
- to generate, store, show and (if you turn it on) post your videos;
- to process payments and manage your subscription;
- to enforce plan limits, prevent abuse and keep the Service secure;
- to answer your questions and send important service emails (such as billing or policy changes);
- to understand usage and improve the Service, using aggregated or de-identified data where possible.
Legal bases (where GDPR or similar laws apply): performing our contract with you; our legitimate interests in running a secure, working product; complying with legal obligations; and your consent where we ask for it (for example, connecting TikTok). You can withdraw consent at any time.
We don't sell your personal information and we don't share it for cross-context behavioral advertising.
4. Who we share it with
We share data only with service providers that help us run GhostPost, under contracts that limit their use of it:
- Supabase — database, authentication and file storage.
- Google — sign-in.
- Stripe — payments, invoices and subscription management.
- OpenAI — creates the AI voiceover from story text and transcribes that audio to time the captions. We send story text and generated audio, not your name or email. Under OpenAI's API terms, API data isn't used to train their models by default.
- TikTok — only if you connect it, to post the videos you choose.
- Cloudflare — hosts the website. Videos are rendered in your own browser, not on our servers.
We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition (in which case we'll tell you).
5. International transfers
Our database and files are hosted in the United States (US East). Our providers may also process data in other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. Cookies
We use only essential cookies: the ones that keep you signed in and protect sign-in from tampering. Stripe may set its own cookies on its checkout pages to prevent fraud.
We don't use advertising or cross-site tracking cookies. If we ever add analytics or marketing cookies, we'll update this policy and ask for consent where the law requires it.
7. How long we keep it
- Account data: while your account is open.
- Generated videos and audio: while your account is open, unless you delete them sooner. We may remove older videos from our servers after a period of time; download any video you want to keep.
- TikTok tokens: until you disconnect TikTok or delete your account.
- Billing records: as long as tax and accounting laws require (often up to 7 years).
- Server logs: for a short period, generally no more than 30 days.
8. Deleting your data
You can delete your account anytime from Settings → Delete account. When you do, we cancel any active subscription, disconnect TikTok, and delete or de-identify your personal data and generated content within 30 days, except what we must keep by law (such as billing records).
You can also disconnect GhostPost from your Google account at any time at myaccount.google.com/permissions, or reach us through support@useghostpost.com and we'll handle it for you.
9. Your rights
Depending on where you live (for example under GDPR, UK GDPR or California law), you may have the right to:
- access the personal information we hold about you and get a copy;
- correct inaccurate information;
- delete your information;
- object to or restrict certain processing;
- receive your data in a portable format;
- withdraw consent;
- not be discriminated against for using these rights;
- complain to your local data-protection authority.
To use any of these rights, reach us through support@useghostpost.com. We may need to verify your identity, and we'll respond within the time the law requires.
10. Security
We use encryption in transit (HTTPS), row-level access rules so each user can only reach their own data, and restricted access to production systems. No system is perfectly secure; if a breach affects you, we'll notify you as the law requires.
11. Children
GhostPost is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under that age has given us information, tell us through support@useghostpost.com and we'll delete it.
12. Changes to this policy
We'll post any changes here and update the date at the top. If a change is significant, we'll also tell you by email or in the app.
13. Contact
Questions about privacy? Reach GhostPost through support@useghostpost.com.