1. Information we collect
- Account details: your name, email address and password. Passwords are stored only as a salted scrypt hash, never in readable form.
- Billing details: payments are handled by Stripe. We receive and keep your Stripe customer and subscription IDs, your plan, its status and renewal date. We never receive or store full card numbers.
- Connected social accounts: when you link X, a Facebook Page, Instagram, LinkedIn, YouTube or TikTok, we receive access tokens (and refresh tokens where offered) plus basic account details such as the account ID, name or handle. Tokens are encrypted at rest with AES-256-GCM. If you use your personal Facebook profile, we store only the profile name (and the profile link, if you add it); nothing is posted to your profile by us — you post each item yourself.
- Your content: niches, posts, scripts, video plans, uploaded images, video and audio, rendered videos, replies, schedules and settings.
- Usage and logs: credit and post counts, a log of publishing attempts and errors, and timestamps. Our hosting provider also keeps standard server logs (such as IP address and browser type) for security and troubleshooting.
- Cookies: we use one essential cookie to keep you signed in. We don't use advertising cookies or third-party analytics. If you install the app, your device may cache app files so it can open offline.
2. How we use it
- to run the Service for you: generate drafts, render videos and publish content to the accounts you connect, on the schedule and approval settings you choose;
- to read comments and mentions on your connected accounts when you turn on the reply features, so you can review and send replies;
- to process payments, manage subscriptions and apply plan limits;
- to provide support, keep the Service secure, prevent abuse and meet legal obligations.
We use the permissions you grant to a social platform only for these purposes. We don't sell your personal information, and we don't use it, or data from your connected accounts, for advertising.
3. Who we share it with
We share only what each provider needs to do its job for us:
- Anthropic (Claude API) — prompts containing your niche, settings and drafts, to generate text.
- Google (Gemini API) — the same kind of prompts, when we use Gemini to generate text (for free trials, or as a backup when Claude is unavailable).
- ElevenLabs — script text, to create voiceovers, when voiceover is used.
- Pixabay and Pexels — search keywords, to find stock footage. No personal information is sent.
- Stripe — payment and subscription processing.
- Our hosting and database providers — to store and serve the app and your data.
- The social platforms you connect — the content you publish and the requests made on your behalf.
- Legal and safety: when the law requires it, to protect rights and safety, or as part of a merger or sale of the business (with notice to you).
4. Google and YouTube
If you connect YouTube, Ghost Post uses YouTube API Services to upload the videos you choose to your channel. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Ghost Post's access at any time from your Google account permissions.
Ghost Post's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Media links
So platforms such as Instagram and Facebook can fetch your images and videos when publishing, uploaded and rendered media files are served from unlisted, hard-to-guess links. Anyone who has such a link can open that file, so only upload material you intend to publish.
6. How long we keep it
We keep your information while your account is open. When you delete your account, we immediately cancel any subscription and delete your posts, stories, uploads, rendered videos, connected-account tokens, logs and the account itself from our systems. Stripe keeps its own payment records as the law requires. Content you already published stays on each platform until you delete it there. See the data deletion instructions.
7. Security
We use HTTPS, hashed passwords, encrypted tokens and admin-only access controls. No system is perfectly secure, so please use a strong, unique password.
8. Your choices and rights
- Update your details and settings, or disconnect any social account, in Settings at any time.
- Delete your account and data yourself in Settings → Account → Delete account.
- Ask for a copy of your data, a correction or deletion by contacting info@lmtj.net.
Depending on where you live (for example California, the EEA or the UK), you may have rights to access, correct, delete or port your personal information and to object to or restrict some processing. We'll respond within the time the law requires and won't treat you differently for using these rights. We don't sell personal information or share it for cross-context behavioural advertising.
9. International processing
We and our providers process information in the United States and in other countries where those providers operate.
10. Children
The Service is for adults (18+) and isn't directed to children. If we learn that we collected information from a child, we'll delete it.
11. Changes
We may update this policy. If a change is material, we'll tell you by email or in the app before it takes effect.
12. Contact
Privacy questions or requests: info@lmtj.net.