Scope
This policy covers summonghost.com, its installer, and the account tools retained for existing users. Ghost itself is open-source software that runs on your computer. Using the local app does not send your ghost home or local files to SummonGhost.
Data we process
- Website data: IP address, request details, browser and device information, and security logs needed to deliver and protect the site.
- Existing accounts: OAuth identity data such as your provider ID, name, email, avatar, and the session cookie needed to sign you in.
- Legacy content: data already stored in your hosted account, including your Character note, notes, memories, conversations, and the archive prepared for you to download.
- Legacy APIs: authenticated requests and content sent through an existing API key before those migration-era endpoints were withdrawn.
- Diagnostics: minimized, pseudonymous error and performance logs recorded by Cloudflare, our hosting provider.
- Messages: information you send to our support or legal addresses.
We use necessary cookies for sign-in and security. We do not use advertising cookies or sell personal data.
Why we use it
We process this data to serve and secure the website, authenticate existing users, deliver account exports, complete deletion requests, answer support requests, and meet legal obligations.
Who receives it
- Cloudflare for hosting, security, storage, and limited analytics.
- Google or X when you choose that provider to sign in.
- Authorities or advisers when required by law or needed to protect legal rights.
When you install or configure Ghost, your computer may contact GitHub, package repositories, or an AI provider you choose. Those services act under their own terms and privacy policies, not this policy.
Retention
Legacy account data is kept while needed to provide the ghost export. Deletion is no longer self-service; email us to request it and we will erase your account. Content-free model cost records may remain for up to two years, pseudonymous analytics for up to three months, and minimized diagnostic logs for up to 90 days. Opaque deletion tombstones may remain for up to seven years to stop delayed work from recreating deleted data.
Your choices
Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal data. Email us to make a request. You may also complain to your local data protection authority.
Security and transfers
We use HTTPS, OAuth, access controls, and data minimization. No system is completely secure. Our providers may process data outside your country using the safeguards available under applicable law.
Children
The website and legacy account tools are not directed to children under 13, and we do not knowingly collect their personal data.
Google API data
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Changes
We may update this policy as the legacy hosted system is retired. The date above shows the latest version.
Contact
Privacy requests: privacy@summonghost.com