Privacy Policy

GhostNote helps teams capture and transfer institutional knowledge. This policy explains what data we collect, how we use it (including AI processing), who processes it, and the choices you have. We collect only what is needed to provide the product.

• Account data: your name, email, and organisation — used to sign you in and scope your data to your company.
• Content you create: check-ins, decisions, notes, uploaded spreadsheets, and the structured memory derived from them.
• Connected sources (optional): if you connect Gmail or Google Calendar, recent items you choose to sync, to suggest reviewable drafts.
• Operational data: standard logs needed to run and secure the service.

GhostNote uses large language models to structure your inputs and answer questions about your own records. The primary model is Anthropic Claude, with Google Gemini available as a fallback, accessed under their commercial API terms.

Your data is not used to train any model. Prompts are processed only to generate your result and are subject to the providers’ enterprise/API data-handling terms (which prohibit training on API content). AI answers are grounded strictly in your captured records and include a source citation and a confidence level — but AI can still make mistakes, so please verify anything important before acting on it.

Each organisation’s data is logically isolated at the database level; nothing is shared between companies. Access to the application requires authentication, and data is encrypted in transit (HTTPS/TLS) and at rest by our infrastructure providers.

If you connect Gmail (read-only gmail.readonly) or Google Calendar, we read only the items needed to suggest drafts. We never send, modify, or delete your messages or events. Nothing becomes shared knowledge until you approve a draft. You can disconnect at any time in Settings, which revokes our token with Google.

GhostNote’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not use Google user data for advertising, do not sell it, do not transfer it except to provide the feature you requested or as required by law, and do not let humans read it except with your consent, for security, or to comply with the law.

We rely on a small set of vetted providers to operate the service:

• Anthropic & Google (Gemini) — AI model processing
• Supabase — database hosting
• Vercel — application hosting
• Google — Gmail/Calendar (only if you connect them)

We retain your content until you delete it or your organisation is removed. You can export or request full deletion of your data at any time. Disconnecting a source stops future syncing.

We use a single essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Questions about this policy or a data request? Email paramsabnani@gmail.com or visit our contact page.