Privacy policy

Your album — photos, videos, names, places, answers and search — is encrypted in your browser with a key derived from your passphrase. The passphrase and the key never leave your device. We cannot read your album or recover it if you forget the passphrase.

What you share with the Ghost — for example a first name or an event title — is shared only after you review the exact facts, for one purpose, and expires automatically. You can revoke it at any time.

What arrives through WhatsApp is not end-to-end private from us. Messages and media sent to the Ghost pass through WhatsApp (Meta) and our server, which must process them to suggest memories. We keep encrypted temporary copies for as short a time as possible and delete them automatically.

Nothing is processed until someone approves the chat. In groups, each person's photos and messages are used only after they send ghost allow. WhatsApp does not give the Ghost anything sent before it joined.

People are never identified from the content of images.

• Photos and videos waiting for you to add or skip them: encrypted, at most 1 hour unless you chose a longer retention (up to 24 hours).
• Message text: deleted once used for a suggestion, or after at most 2 hours (or your longer choice).
• Duplicate-protection receipts: keyed fingerprints only, no content, 8 days.
• Ghost activity log: decisions and reasons, no message text, 7 days.
• Consent records: signed records of what was approved and when, kept as evidence, including after consent is withdrawn. They contain no message content.
• Phone numbers and group IDs: stored only encrypted, with keyed fingerprints for lookup.

If you link a Google account, we ask Google only to confirm who you are (the openid scope). We store a keyed fingerprint of your Google account ID — not your email address, name or photo. Google sign-in never unlocks your album. Unlinking, “ghost forget me” or turning the Ghost off deletes the link. Google learns that you signed in to Whisperboard.

A roster admin can send the Ghost a roster PDF. The file is read in memory and not kept; the names, roles and times in it are stored encrypted and deleted automatically after the roster's last day. If you register your name, an admin confirms it, and the Ghost then sends you only your own shifts in a private chat. “ghost forget me” or “בטל רישום” removes your registration.

• ghost forget me — stop using your content and delete our temporary copies of it.
• ghost stop — turn the Ghost off for the chat and delete its temporary data.
• ghost privacy — a summary of this policy in the chat.
• Delete your album from this browser at any time under Album → Delete.

We cannot delete anything from WhatsApp itself, and we cannot remove copies already in someone else's encrypted album or quoted in other people's messages.

WhatsApp (Meta Platforms) delivers messages to the Ghost under its own terms. Our server runs on Google Cloud and stores temporary data in a managed Postgres database (Neon). We don't sell data, show ads, or use third-party analytics or trackers.

Send ghost privacy to the Ghost on WhatsApp, or write to the operator of this site at the contact address listed in its Google sign-in screen.