Privacy and your data

Ghost Services stores your provider-verified email, name, connected sign-in identities and revocable sessions to operate your account. We store encrypted provider tokens only for sign-in lifecycle and revocation. We do not offer local passwords. Marketing is an independent, optional choice, recorded with time, source and policy version. Withdraw it from your account or a valid unsubscribe link.

Successful sign-in times and limited security references connect Manager sessions to your verified authentication for acquisition checks. These records follow the security-log retention below. They do not contain authorization codes or access/refresh token contents and do not monitor installed plugins.

Manager reports only completed installation, update and uninstall events: product, version, format, installation scope and time. Downloads are not installation events. Installation history remains while the account exists. We do not collect DAW, audio or plugin activity, continuously monitor your system, or collect diagnostics automatically.

Support tickets are retained for 24 months after closure. Private support attachments are deleted 90 days after closure. Each ticket permits at most 5 files, each up to 10.0 MB, in PNG, JPG, JPEG, WEBP, PDF, TXT, LOG, ZIP formats. Files are private and checked server-side. Diagnostics require you to initiate them, review/redact the files and explicitly consent before upload.

Application logs are retained for 30 days and security logs for 90 days. Access is restricted. Security records may remain in that period with identifiers removed after account deletion; release approval/audit history remains with the deleted account reference removed. These records protect service integrity. We do not claim an additional legal retention period; any legal hold requires a documented policy change and authorized handling.

Use your account to export personal data or request deletion after signing in again. Deletion immediately revokes account access and marketing consent. Scheduled cleanup revokes provider connections and deletes or anonymizes personal information; failed provider revocation is retried. Previously sent email and external provider records are outside Services. Existing backups are protected and not edited in place: operators must restrict backup access, apply deletion tombstones before restoring service, and verify the hosting backup lifecycle before production launch. Backup expiry has not been verified or promised.

When you request account notifications, Ghost stores account-owned read/dismiss preferences for published announcements. Listing does not mark them read. These preferences remain while your account exists and are included in export and removed on account deletion. No background push or system monitoring is used.

If a product ownership record is granted, we retain the product, grant/revocation times and an internal approval reference while the account exists. Your export includes ownership state; account deletion removes it. V1 has no payment or licensing system.

Official acquisition records the exact agreement version/digest, products, release/artifact hashes, affirmative action and server time, separately from marketing. Account-linked acceptance remains for the active account/license relationship and is included in your export. Account deletion removes the account link and replaces the subject reference; minimal pseudonymized evidence is then deleted after 90 days by scheduled cleanup. This is an operational retention period, not an asserted legal obligation or a limitation on an installed plugin's license.

Account-free acquisition uses only a session-bound guest transaction and agreement/acquisition details, without an email, IP or user-agent in the acceptance ledger. Guest receipts expire and are deleted after 24 hours; browser-session expiry may end access earlier. Ordinary hosting/security logs follow their separately disclosed retention. Exact published agreement archives are retained without personal acceptance data. Backup restoration must apply account-deletion tombstones and expired-receipt cleanup before serving acquisition.

Public GitHub binary links may bypass official agreement presentation. Services enforces acceptance on its website and Manager acquisition paths; it does not control all access to public GitHub assets.

Operational policy version: v1. This describes implemented Services behavior; live provider and hosting integration are pending. Manage your account.