What is kept, where, and for how long

Retention at a glance

Your album

Only in this browser, encrypted, until you delete it. Back it up — we have no copy.

Photos/videos sent to the Ghost

Encrypted on the server until you add or skip them, at most 1 hour unless you chose longer, then deleted.

Message text

Deleted once used for a suggestion, or after at most 2 hours (or your longer choice).

Webhook receipts

Keyed hashes only (no content), kept 8 days to stop duplicates.

Ghost activity log

Decisions and reasons only — no message text — kept 7 days.

Google sign-in (optional)

A keyed fingerprint of your Google account id, until you unlink, say “ghost forget me”, or turn the Ghost off.

Opt-out (“forget me”)

That person's temporary data is deleted immediately; albums remove their unconfirmed details next time they unlock.