Last updated: August 29, 2026
This Privacy Policy explains what information GHOST ("GHOST," "we," "us") collects when you use the GHOST mobile app, why we collect it, and how you can access, control, or delete it. GHOST is built to watch publicly available Instagram activity for accounts you choose — it never accesses private accounts, direct messages, or anything Instagram itself doesn't make publicly visible.
Account & authentication data. When you sign in, GHOST uses Sign in with Apple or Sign in with Google, handled by our authentication provider, Supabase. Depending on the method you choose and what you authorize, we receive:
We never see or store your Apple ID or Google account password — authentication is handled entirely by Apple/Google and Supabase.
Watch configuration. When you add a Watch, GHOST stores the public Instagram username you've chosen to watch, tied to your account.
Public Instagram profile data. GHOST's core profile monitoring (bio, display name, profile photo, website, account type, follower/following counts, and public posts) is provided through Instagram's official API. For certain additional public observations where available — such as Stories or Highlights — GHOST may also use other supported third-party services that retrieve publicly available Instagram content, using the same publicly-available-data-only principle. Regardless of source, GHOST only ever reads information that is publicly visible on the account being watched; it does not and cannot access private accounts, direct messages, or any other non-public data.
Watch history and detected changes (Spotted & Rewind). GHOST stores the snapshots it captures over time and the specific changes it detects (for example, a new post or a bio update), so it can show you Spotted and Rewind. This history is tied to your account and only visible to you.
Ask GHOST answers your questions using only the observation history already described above. Questions and answers are processed entirely within GHOST's own systems — no data from Ask GHOST is sent to any external AI or language-model provider. Ask GHOST never guesses or infers; it only reports what has actually been observed.
GHOST+ includes a Private Vault where you can save specific Spotted items you want to keep. The Vault is designed to prioritize saving event metadata — what changed, when it was detected, and which Watch it relates to — rather than automatically or permanently archiving the underlying third-party media (images/video) itself. If media saving is ever enabled as an explicit, separate action, this policy will be updated first. Vault data is private to your account, protected the same way as your other Watch data (see Data security below).
If you enable notifications, we store a device push token (provided by Apple's push notification system via Expo) so we can deliver GHOST's own alerts to your device when something you're watching changes. This token is not used for anything other than delivering GHOST notifications, and is deleted when you sign out or delete your account.
GHOST+ subscriptions are purchased and billed entirely through Apple's App Store In-App Purchase system. We use RevenueCat to manage and verify subscription status. GHOST never receives, processes, or stores your payment card details — Apple handles all payment information directly. We only receive subscription status (for example, whether you have an active GHOST+ subscription) to unlock the corresponding features.
We use the information above only to operate GHOST's core features: authenticating you, running the Watch you've set up, detecting and showing you changes (Spotted, Rewind), answering your questions in Ask GHOST, delivering notifications, and managing your GHOST+ subscription entitlement.
GHOST does not use advertising or ad-tracking SDKs, does not track your location, does not request access to your contacts, and does not sell your personal information to third parties. We do not use analytics tools beyond what's necessary to operate and maintain the service described above.
Your account and Watch data are stored on Supabase's infrastructure and protected by row-level security policies, so your data is only ever readable by your own authenticated account — never by other users. All traffic between the app and our servers is encrypted in transit. We never store your Apple ID or Google password, and payment details are handled entirely by Apple.
We retain your account and Watch data for as long as your account remains active, so GHOST can continue showing you accurate history. If you remove a Watch, its history is deleted along with it. If you delete your account, everything described in this policy is permanently deleted, as described below.
You can permanently delete your account at any time directly in the app (Profile → Delete Account). This immediately and permanently deletes your account and all of your associated data — your Watches, observation history, detected Spotted signals, Vault entries, and your push notification token. This action cannot be undone. Public-profile observation data that other GHOST users still rely on (for example, if someone else is also watching the same public Instagram account) is not affected by your deletion — only your own account and your own association with that data is removed. If you're unable to use the in-app flow for any reason, you can request deletion by contacting us at the email below.
Deleting your GHOST account does not automatically cancel an active GHOST+ subscription purchased through the App Store — subscriptions are managed separately through your Apple ID. You can manage or cancel a subscription anytime in Settings → Apple ID → Subscriptions.
Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain processing. You can exercise most of these rights directly in the app; for anything else, contact us using the details below.
GHOST is not directed at children, and we do not knowingly collect personal information from children under 13 (or the relevant minimum age in your jurisdiction). If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app.
Questions about this policy or your data? Contact us at contact@ghostapp.com.