Privacy Policy

Ghosted is built around one promise: we don't keep your screenshots. This policy explains what personal data we process, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

Who is responsible

The data controller is Jessen Thinkmatic, CVR 45634248, Roskildevænget 60, 1. th., 4000 Roskilde, Denmark. Contact us about anything in this policy at support@aighosted.com.

Screenshots you upload

• Images are compressed in your browser before upload, which also strips photo metadata such as location.
• On our servers they exist only in memory while the analysis runs, and are then discarded. We never write them to disk or to a database.
• So that a paid unlock can be analysed without re-uploading, your browser keeps a copy of the compressed screenshots on your own device (local browser storage) for up to 3 days, or until the unlock completes. We can't access it, and clearing your browser data removes it.
• To produce your result, the images are sent to our AI provider, Anthropic, which processes them on our behalf and may not use them to train its models.

Sensitive information and other people

Chats and dating profiles can reveal sensitive details about your love life and relationships, and they usually contain messages from other people. We process this only because you ask us to: you give your explicit consent when you start a scan (GDPR Art. 9(2)(a)), and you can withdraw it at any time by deleting the result or your account. Only upload conversations you're part of, and never share other people's messages publicly. The other person's messages are processed only for the moment it takes to analyse them; results describe the conversation, not the person, and never include their name, number or photos.

What we store, why, and for how long

• Account: your email address, sign-up date, age confirmation and marketing choice. Needed to provide your account (contract, Art. 6(1)(b)). Kept until you delete your account.
• Results: the text analysis (scores, flags, suggestions) and the options you picked, so you can come back to it. Your consent and our contract with you. Kept until you delete the result or your account.
• Purchases: what you bought and when, so we can unlock it. Contract. Deleted with your account. Card details are handled entirely by Link/Stripe; we never see them.
• Withdrawal statements: if you use our withdrawal form, we keep your name, email, the contract and the date and time as proof for 5 years (legal obligation and our legitimate interest in documenting consumer-law requests).
• Login codes: stored hashed, valid for 10 minutes. Login sessions: up to 60 days, or until you log out.
• Security data: a random device identifier, and IP-based rate-limit counters (stored hashed) that expire within 48 hours. Our legitimate interest in preventing abuse and protecting the service (Art. 6(1)(f)).
• Usage and cost data: which AI model ran and how much it cost, attached to each result. Legitimate interest in running the service.
• Backups: a database backup is made daily on our EU server and kept for 14 days, so deleted data disappears from backups within 14 days.

Sharing your result

Results are private by default. If you tap share, a public page is created that shows only your score, verdict and roast line, never messages, photos, names or your email. You can make it private again at any time.

Cookies

• Essential (no consent needed): gh_session keeps you logged in (up to 60 days); gh_device is a random device ID used to prevent abuse of free scans (1 year).
• Marketing (only with your consent): the TikTok Pixel, which tells us whether our TikTok ads lead to visits, sign-ups and purchases. It never receives your screenshots or results. You can change your choice at any time via “Cookie settings” in the footer. TikTok's use of this data is covered by TikTok's privacy policy.

Who we share data with

We use these providers. Those marked “processor” only act on our instructions under a data processing agreement.

• Anthropic (USA), AI analysis, processor. Transfers to the US rely on the EU Standard Contractual Clauses and Anthropic's commercial terms; API data isn't used for model training and is kept only for a limited period under Anthropic's data retention policy.
• Hostinger (servers in Germany, EU), hosting of the app and database, processor.
• Simply.com (Denmark, EU), sending login emails, processor.
• Link / Stripe, payments. Link is the merchant of record for purchases and processes payment data as an independent controller under its own privacy policy, including to calculate taxes and prevent fraud.
• TikTok, ad measurement, only if you accept marketing cookies.

We never sell your data, and we don't use it to train AI models.

Your rights

You have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent at any time (this doesn't affect processing that already happened). You can delete any result from its page and delete your whole account, which cancels any subscription and erases your results, from your account page. For anything else, email support@aighosted.com; we reply within 30 days.

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk, or to the authority in the EU country where you live.

Age

Ghosted is for people aged 18 and over. We don't knowingly process data about minors, and our AI refuses content that appears to involve them.

Changes

If we change this policy in a meaningful way, we'll update the date above and, where appropriate, email account holders.