Privacy Policy

The Ghost Promise

GhostX tools process your files entirely in your browser. This policy covers every tool at ghostx.tools — GhostSign, GhostPDF, GhostImage, GhostQR, GhostAudio, GhostVideo, GhostSheet, GhostDev, GhostSend, and GhostBeam. For the in-browser tools (PDF, image, audio, video, QR, spreadsheet, and developer tools) and single-signer GhostSign, your files never leave your device. No upload, no server, no database entry. It's like they were never there. Open DevTools and watch the Network tab — there is no upload endpoint to send them to.

What we collect

For the in-browser tools and single-signer signing, your file contents never leave your device. The file lives in browser memory, is processed by client-side code, and downloads directly back to you — there is no upload endpoint, and we never store or see your files. We do collect lightweight, anonymous usage analytics through Google Analytics to see which tools get used: the page or tool, whether an action succeeded or failed, and coarse file metadata such as size and page count — never your file, its name, or its contents. Like any website, our analytics and abuse-prevention providers also receive your IP address and browser user-agent. We don't create accounts and we don't build advertising or identity profiles — but we're not a zero-telemetry product: Google Analytics and the reCAPTCHA we run on server-backed flows collect their own device and behavioral signals. You can turn analytics off entirely by setting ghostx:no-analytics=1 in your browser's local storage.

Server-backed flows: encrypted end to end

A few flows need a server to relay data between people — multi-signer GhostSign documents, GhostSend one-time sends, and GhostBeam transfer signaling. For these we hold ciphertext only. The AES-GCM 256 key is generated in your browser, never sent to our servers, and lives only in the link's URL fragment (the part after the #, which browsers do not transmit). GhostBeam goes further: file bytes travel browser-to-browser over WebRTC and never touch our servers at all.

Everything server-backed auto-deletes on a TTL. Multi-signer documents and their encrypted blobs are wiped 7 days after creation; GhostSend payloads burn the moment they're read (or when they expire). Once a flow completes or expires, every trace is wiped from our servers — we never keep a copy and we have no recovery mechanism.

What we never see: document or file content, signatures, signer names, signer emails, or your recipients' email addresses. Names + emails in multi-signer documents are encrypted inside the document blob; link delivery uses your own email client (no server-mediated send), so we never learn who you sent links to.

Threat model — what to know

We're honest about where the system is strong and where it isn't. These caveats apply to the link-based flows (multi-signer GhostSign, GhostSend, GhostBeam):

• The link is the credential. Anyone with a magic link can sign as the assigned recipient (or read a one-time send). Treat these links like passwords — don't forward, don't paste in public channels.
• Email is a leaky pipe. If you send a magic link by email, every mail server and spam filter it passes through can read and re-use it. We use mailto: so the email goes through your mail provider (we never see the recipient address), but the underlying email pipeline is what it is. For sensitive documents, prefer Signal / iMessage / a private channel where the intermediaries don't keep copies.
• The finalizer renders the signed PDF. When the last signer's browser merges everyone's signatures into the final document, that browser has the power to substitute the underlying PDF. The chain hash detects tampering with individual contributions, but a fully deterministic verify-finalized step is on the roadmap.
• Co-signers share an encryption key. Because we never see the document content, every signer in a multi-party flow needs the same AES key to decrypt the file in their browser. The decrypted document blob includes every signer's signing token (we have no way to encrypt parts of it per signer without server-side keying, which would defeat the "we never see your content" promise). In practice that means: if any one signer's browser is compromised (browser-extension malware, XSS in another tab, screen-share recording with devtools open), the attacker can act as any of the co-signers until the document expires. Mitigation: open multi-party signing links in a browser you trust. Per-signer key derivation is on the roadmap to close this — until it ships, every signer should be treated as having full capability over every other signer's slot.
• We strip embedded JavaScript and document-level scripts from PDFs before encryption — but be cautious with PDFs from unknown sources, as some readers may execute content we can't inspect.
• GhostBeam reveals your IP to the other device. Peer-to-peer transfer works by connecting the two browsers directly, so each side learns the other's IP address, and a public Google STUN server helps them find each other (it sees both IPs but never your file). This is inherent to WebRTC, not something we log — but if you don't want a recipient to learn your IP, use GhostSend (relayed, encrypted) instead.

Cookies & local storage

We store your theme preference and, for signing, your name (so it's pre-filled next time) in local storage. Google Analytics sets its own cookies (such as _ga) to count visits. For link-based flows, the key-bearing URL fragment is briefly stashed in sessionStorage during page load — it's scrubbed from the URL bar before any third-party script (including analytics) can read it, and it is never put in a cookie or sent in any request. Your file contents are likewise never placed in a cookie or transmitted.

Your data, your control

Every multi-signer document auto-deletes 7 days after it's created — Storage blobs and the database record are wiped at that point. GhostSend links burn on first read. We never keep a copy and we have no recovery mechanism. If you sent a link to the wrong person, tell them to ignore it; the link expires on its own.

Third-party services

GhostX loads a small, fixed set of third-party services — all from Google or our payment/abuse providers:

• Google Analytics / Tag Manager — the anonymous usage analytics described above, loaded on every page.
• Google reCAPTCHA Enterprise (via Firebase App Check) — protects the server-backed flows (GhostSend, GhostBeam, multi-signer signing, tips, ratings) from automated abuse. It collects device and interaction signals to score requests.
• Stripe — for optional tips only. You're redirected to Stripe's hosted checkout and your card details go directly to Stripe; they never touch our servers.
• Formspree — powers the contact form. Only what you type there (name, email, message) is sent, and only when you submit it.
• On-device OCR / document-scan engines — text recognition (Tesseract, from jsDelivr) and document edge-detection (OpenCV) download from a CDN the first time you use those specific tools. They run locally in your browser: the CDN sends code to your device, and your image/document is never uploaded to it or to us.

We do not currently display ads. If we add ad-supported hub pages in the future, we'll update this policy and load Google AdSense there; Google may then use cookies for ad personalization, which you can opt out of in your Google ad settings.

Abuse detection & prevention

We monitor for spam, automated abuse, and excessive usage patterns that could degrade the service for others. If we detect activity that appears to be abusive — including but not limited to automated scripting, bot-driven requests, or excessive volume designed to exploit our infrastructure — we reserve the right to rate-limit, temporarily block, or permanently ban the offending IP address or device without prior notice. We do this to keep GhostX free and fast for everyone.

No liability for your data

Because your files are processed entirely in your browser and never touch our servers (for the in-browser tools and single-signer signing), we have no access to, no control over, and no responsibility for your files, documents, signatures, or any data you process through any GhostX tool. You use these services entirely at your own risk. See our Terms of Service for full details.