Privacy Policy

1. Who we are

Noir Global LLC ("Ghosts", "we", "us") runs ghosts.sh and the Ghosts service. This policy explains what personal information we collect, why, who we share it with and the choices you have. For any question, email hello@ghosts.sh.

2. What we collect

When you request access

• your email address (required);
• optionally, your name, company, team type and how many devices you expect to need;
• which form you used and when you signed up;
• a referral code we create for you, and the code of whoever referred you, if anyone.

When you use the service

• account details: name, work email, team, role and the permissions you set;
• service records: which devices you use, live sessions, agent plans and runs, and the activity log of who did what, when and on which device;
• device health data such as battery, storage and connectivity;
• billing details, handled by our payment processor. We don't store full card numbers.

Automatically, when you visit the site

• standard request data such as IP address, browser and device type, which our hosting provider processes to serve and protect the site;
• page views and performance measurements through Vercel Web Analytics and Speed Insights, which don't use cookies and don't identify you;
• browser signals checked by Cloudflare Turnstile when you submit a form, to keep bots out.

We don't ask for or store the passwords to your social or app accounts. You sign in to those on the devices yourself.

3. How we use it

• to run the service: provisioning devices, powering live sessions and agents, and keeping your activity log;
• to contact you about access, your account, billing and important changes;
• to show your place in line to anyone holding your referral link (nothing else about you is shown);
• to secure the service, prevent abuse and enforce our Terms;
• to understand demand and improve the product, using aggregated data where we can;
• to meet legal obligations.

We don't sell your personal information, and we don't use it for third-party advertising.

4. Who we share it with

Only the providers that help us run Ghosts, each limited to what they need:

• Vercel: website and application hosting, analytics;
• Supabase: our database;
• Resend: sending email;
• Cloudflare: DNS, email routing and bot protection;
• our payment processor, for billing;
• mobile carriers, only as needed to provide connectivity to the devices.

We may also disclose information when the law requires it, to protect people or the service, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to it.

5. Data on the devices

Apps, accounts and media you put on a device stay on that device and are visible only to your team. When a device leaves your fleet, we factory reset it before it's assigned to anyone else. See Security for how we keep each team's data separate.

6. How long we keep it

• waitlist details: until you ask us to delete them, or 24 months after we last contacted you;
• account and service records: for as long as your account is active, then 30 days for you to export them, after which we delete them;
• billing records: as long as tax and accounting law requires;
• backups: overwritten on a rolling basis within 30 days.

7. Security

We protect data in transit with TLS, restrict access to the people and systems that need it, and keep every team's devices, sessions and logs separate. No system is perfectly secure, and we'll notify you without undue delay if a breach affects your information.

8. Your choices and rights

You can ask to access, correct, export or delete your personal information, or to stop receiving non-essential emails, by writing to hello@ghosts.sh. We'll respond within 30 days. Depending on where you live (for example California or the EU/UK), you may have further rights, including to object to or restrict certain processing and to complain to a data protection authority. We won't treat you differently for exercising them.

9. Where your data lives

Ghosts is based in the United States, and we store and process data in the United States. If you use the service from elsewhere, your information will be transferred to and handled in the US.

10. Cookies

We use only the cookies needed to run the site and keep you signed in. Our analytics are cookieless, and we don't use advertising or cross-site tracking cookies.

11. Children

Ghosts is a business service and isn't meant for anyone under 18. We don't knowingly collect their information.

12. Changes

If we change this policy, we'll update the effective date above, and for material changes we'll notify you by email or in the dashboard before they apply.