Privacy Policy

Last updated: May 6, 2026

Overview

Ghostgram is a privacy-first messaging application. We are committed to protecting your personal information. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

Ghostgram collects the absolute minimum data required to operate:

  • Account identifiers: A randomly generated Ghost ID. No phone number or email is required.
  • Public keys: Your encryption public keys are stored on our relay to enable key exchange with other users.
  • Encrypted messages in transit: Messages are temporarily queued on our relay until delivered, then deleted. We cannot read them — they are end-to-end encrypted.
  • Anonymous usage metrics: We collect anonymous, non-identifying metrics (e.g., message count, app opens) to understand overall usage patterns. No user IDs or personal data are attached.
  • Username (optional): If you claim a @username, it is stored in our registry.

Data We Do NOT Collect

  • Message content (all messages are end-to-end encrypted)
  • Contact lists or address books
  • Location data
  • Device identifiers for tracking
  • Browsing history or usage patterns tied to your identity
  • Biometric data

Encryption

All messages, media, and calls are protected with end-to-end encryption using X3DH key exchange (Curve25519), AES-256-GCM for message encryption, and Ed25519 for message signing. Your private keys never leave your device.

Data Storage

Messages are stored locally on your device. Our relay server only temporarily holds encrypted messages until they are delivered. Encrypted attachments are stored on Cloudflare R2 with per-file access tokens. We cannot decrypt any stored data.

Third-Party Services

  • Cloudflare: Our relay infrastructure runs on Cloudflare Workers. Cloudflare may process metadata (IP addresses) according to their privacy policy.
  • Apple Push Notification Service: Used to deliver push notifications. Apple does not have access to message content.

Data Retention

Encrypted messages in transit are deleted from the relay once delivered. If a message cannot be delivered within 30 days, it is permanently deleted. Account data is retained until you delete your account.

Your Rights

You can delete your account and all associated data at any time from within the app. Since messages are end-to-end encrypted and stored on your device, deleting the app removes your local message history permanently.

Children's Privacy

Ghostgram is not intended for children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

If you have questions about this privacy policy, contact us at privacy@ghostgram.chat.