Privacy Policy

This Privacy Policy explains how Authentic Code LLC (“we”, “us”, “our”) handles information in connection with Ghost: Speed Camera Detector, a mobile application (“Ghost” or the “App”). It covers what we process, why, who we share it with, and the choices and rights you have. It should be read together with our Terms of Use.

1. Who we are

Ghost is made by Authentic Code LLC, the controller responsible for the information described here. You can reach us at Authentic Code LLC, 680 S Cache Street, Suite 100-7414, Jackson, WY 83001, United States, or at support@drivewithghost.com. This policy covers the Ghost app for iOS and Android, including its Apple Watch app and what it shows in Apple CarPlay and Android Auto, and the website drivewithghost.com.

2. Our approach to your privacy

Ghost is built to need as little of your information as possible. The core job — warning you about cameras while you drive — runs on your device, using camera data stored locally. We designed Ghost so that driving does not require us to collect a continuous record of where you go.

3. Information we process

Depending on how you use Ghost and the permissions you grant, the following may be processed:

• Location, speed, and direction of travel. Ghost uses your device’s GPS and motion sensors while you drive to detect nearby cameras and to show your speed. The warnings are calculated on your device, and this information is not used to build a profile of your journeys; section 4 sets out exactly when your position leaves the device.
• Device & installation data. Basic technical details such as device type, operating-system version, app version, language and region settings, and a pseudonymous installation identifier used to make the App work and to keep it reliable.
• Subscription status. Whether you have an active trial or subscription, provided through Apple, Google, and our subscription-management provider RevenueCat. We do not receive or store your full payment card details.
• Anonymous usage counts. Which steps in the app are reached, counted without coordinates, speeds or time of day, as described in section 6. There is no crash-reporting service in Ghost.
• Support requests & voluntary reports. If you contact us or choose to send feedback, we process what you send us — such as your message and the email address you use.
• Visiting this website. Our host, Cloudflare, processes technical data such as your IP address, browser and the pages requested, to deliver the website and protect it from abuse. The website uses no advertising or analytics cookies and loads no advertising or analytics scripts. The spam check on our forms (Cloudflare Turnstile) loads only once you start using a form and may use strictly necessary cookies or local storage for that check alone. The Ghost display typeface is loaded from Fontshare, a font service of the Indian Type Foundry, which therefore receives your IP address and browser details when the font is requested; no cookies are set for this.
• Contact form on this website. When you use our Contact Us form we process the name, email address, subject and message you enter, so we can answer you. To keep the form free of spam and abuse we use Cloudflare Turnstile, which performs a security check in your browser; we also process your IP address and country for that check and to limit abuse. The form is not used for advertising, and we do not keep a public record of it.
• Website waiting list. If you enter your email address to join the waiting list on this website, we store that address so we can tell you when Ghost is available, together with the country you choose in the form and the country your request came from. We use both countries only to judge where to launch next. We do not store your name or your IP address for this. You can ask us to remove you at any time through the contact form, and we delete the list once everyone on it has been told the app is live.

4. Location, and how Ghost knows you are driving

Ghost reads your position. There is no version of a speed-camera warning that does not: what lies ahead of you cannot be worked out from anything else.

While you drive it is read continuously, including when the app is closed and the screen is off. The warning has to arrive whether or not Ghost is the app you are looking at, and that is what the background permission is for. Both systems make it visible while it runs — an indicator in the status bar on iOS, a permanent notification on Android — and both let you withdraw the permission at any time.

Outside a drive the precision drops, deliberately. Ghost then asks only to be told that the phone has moved a significant distance, at an accuracy of a few hundred metres to a few kilometres: enough to notice that a drive may be starting, far too coarse to follow anyone. The exact position is read while a drive is running and at no other time. That is a battery decision as much as a privacy one — here they point the same way.

The position is evaluated on the device. The camera data sits on the phone and the calculation happens on the phone, so producing a warning sends nothing anywhere. Ghost keeps no track, no route and no history of drives. There is no file and no database of where you have been, on the device or anywhere else, which is also why there is none to lose, sell or be asked for.

Your position leaves the device in four cases, and only one of them is something you send.

• A camera report, because you tapped to send it. What that carries is the next section.
• The country lookup, once per drive. To know whether the road signs around you say km/h or mph, Ghost asks the operating system's own reverse geocoder which country a coordinate is in. That question goes to Apple on iOS and to Google on Android; the answer that comes back is a two-letter country code. It is asked when a drive begins and re-used until you have travelled about 20 km — not on every position — and nothing else about the drive travels with it.
• The road name, when you open the report sheet. The sheet asks the same reverse geocoder what the road at that spot is called, so you can see whether it is the road you mean. The name is shown to you and is never sent with the report; the coordinate that asks for it does leave the device.
• Map tiles, on the map screen only. A map is drawn by asking Google for the tiles of the area on screen, and that area is where you are. The driving screen draws no map and makes no such request.

What Apple and Google do with a coordinate they are asked about is governed by their own privacy policies, not by this one. What Ghost controls is how often it has to ask: the country is kept for 20 km rather than looked up per fix, and the road name is only ever looked up because you opened the sheet yourself.

One more route carries no coordinate, but does carry the area: the road map, fetched along the way. To tell the road you are on from the one beside it, the phone needs the road map of the area. It is not shipped for the whole world; it is fetched in squares of roughly 27 × 20 km (0.25 degrees): the square you are driving in and the squares ahead in your direction of travel. Each square is fetched once and then read from the phone, offline too — until it is cleared to keep the map under 150 MB, or an app update brings a new map version.

• What is sent: in the address of the request, the number of the square (for a whole area file, the name of the area) and the name of the map version. No coordinate, no speed, no installation identifier, no cookie. As with any request on the internet, the server sees the IP address of your connection.
• What could be read from it: a single request places nobody. The order of the requests on one drive does trace the route at that coarse resolution, direction included — and that is exactly why it is not written down.
• Who receives it: Ghost's own server. It runs on Cloudflare, Inc., San Francisco (USA), which operates it on our behalf — as a processor under Art. 28 GDPR, on the basis of Cloudflare's data processing addendum; transfers to the US rely on Cloudflare's participation in the EU-U.S. Data Privacy Framework. Nothing is passed on.
• How long: only for as long as the request takes. Request logging is switched off for this server: Ghost stores neither the address nor the IP address of a map request. Error messages the server records itself carry no map address and remain retrievable at Cloudflare for at most seven days.
• Legal basis: Art. 6(1)(b) GDPR. Fetching the map is part of the warning service you use Ghost for: without the map of the area the app cannot tell a camera on your road from one on the road next to it. The brief processing of the IP address to deliver the answer and to protect the server against abuse rests on Art. 6(1)(f) GDPR — our legitimate interest is a reachable, secure service.
• Without a connection nothing is fetched. Where no map is on the phone, Ghost still warns, only without that distinction.

How a drive is recognised. Three signals, any one of them enough:

• Motion. Both systems can tell an app that the phone is in a moving vehicle. That yes/no is the whole of what Ghost reads from the motion sensors — no step count, no walking or cycling, no fitness data, nothing describing how you moved. It needs its own permission, it is a switch in Settings called drive detection, and the app works without it.
• The audio route. A phone connected to a car — CarPlay, a head unit, a hands-free kit — is a phone in a car. Ghost looks at what kind of output audio would go to, never at the device, its name or its address. Bluetooth music output is deliberately not counted, because that is how headphones connect.
• Speed. A position moving faster than 8 km/h.

A drive ends by itself after five continuous minutes below that speed with none of these signals present.

5. Camera reports

Ghost lets you report an error in the camera database: a camera that is missing, an average-speed zone that is missing, a camera that has gone, a position that is wrong, or a confirmation that a doubted camera is still there. There are five kinds of report and every one of them is a correction to fixed equipment. There is no way to report a mobile speed check or a police patrol, and there is not going to be one.

What is sent when you submit a report:

• the coordinates of the reported place,
• the heading and speed at the moment of the report, because without them there is no way to tell which carriageway the report applies to,
• the time,
• the kind of report,
• which camera in the database the report is about — the database's own identifier for it and what kind of object it is — for the reports that correct an existing entry rather than add one,
• an identifier for the report itself, generated on the device, so that a report arriving twice stays one report,
• a random installation identifier, created when the app is installed,
• and, if you corrected the position on the map by hand, a note that you did.

What is not sent: no name, no email address, no device identifier, no phone number, no advertising ID. Ghost has no user accounts, and there is nothing a report could be linked to you by.

Reports are correction data, never a live warning. Nothing you send reaches another driver's phone, and it does not create or strengthen a warning on your own phone either.

Where a report goes. Straight to SCDB, the camera-data provider, as soon as this phone has a connection. Correcting their database is the whole point of reporting, the licence requires us to take part in it, and their endpoint is where a correction is owed. What travels is the list above, in the shape their schema prescribes: the position, the direction, the speed at that moment, what kind of correction it is, the report's own identifier — and the installation identifier, so that the same phone sending the same thing twice is recognised as one report rather than two.

A report Ghost cannot deliver waits on this phone until there is a connection, and leaves the queue the moment the provider has taken it.

A report is only ever sent because you tapped to send it. Ghost never asks: there is no screen after a drive, no notification, no reminder and no points.

The installation identifier cannot be traced back to you, and reinstalling produces a new one — with the one exception named under device backups below.

6. Anonymous usage measurement

Ghost counts which steps in the app are reached — that onboarding was completed, for instance, or that the paywall was shown. The counts are batched and sent rarely, never one at a time and never when a warning fires.

What is sent: the name of the event, and for some events a coarse bucket instead of an exact figure — "20–60 minutes" rather than the length of a drive. Each batch also carries, once, the app version, the platform, the language and a random installation identifier: once per batch, not once per event. A batch keeps the version and the language it was recorded under, even when it is only sent after an update.

No timestamp. The events carry no time of day. The server keeps the day a batch arrived and nothing more — when something happened does not leave the device.

What is explicitly never sent: no coordinates, no speeds, no camera identifiers, no route data, and neither the time nor the place of a warning. That a warning fired is not counted at all. The list of forbidden fields is in the code and is checked on every build; an event carrying one cannot be created.

There is no switch for it, and that is deliberate. A switch would imply there is something here that could be traced to a person. There is nothing: no place, no time of day, no identifier beyond the random installation identifier, and none of it goes to anyone else.

7. Checking the network connection

Ghost checks periodically whether the device is online, by resolving a hostname — the same address the app already talks to.

No data is sent in the process. No request is made, no content leaves the device, and no identifier is involved. The only party that learns anything is the name server the operating system was going to use anyway.

The result has exactly one effect: Ghost can tell you that map tiles do not load offline, and that your warnings are unaffected because the camera data is on the phone.

8. Where the camera data comes from

The locations of fixed cameras and average-speed zones come from the SCDB database (scdb.info), a licensed provider of such data.

The data sits on your device. Ghost downloads it and evaluates it locally. Nothing is requested and nothing is sent in order to produce a warning — your position never leaves the device for that purpose.

The licence is counted, and counting it is all these calls do. There are three of them, and this is the complete list:

• At start-up the app tells the provider that a licensed installation is active. What is sent is the random installation identifier and the version of the app, and nothing besides.
• Once per calendar month it tells Ghost's own server the same thing — the identifier and the month. Both counts exist because a count that only ever agrees with itself proves nothing, and the provider's invoice has to be checkable against a number of our own.
• At start-up it also asks Ghost's own server whether this installation has been switched off, which sends the identifier and nothing else.

None of the three carries a position, a speed, a time of day, or anything at all about a drive. They are a licence count, not a location.

9. What is stored on the phone, and for how long

All of it is on your device. None of it goes anywhere except where a section above says so, and all of it is gone when you delete the app.

• Your settings — units, which kinds of camera you want warnings for, volume, language, map style. Kept until you change them.
• The camera database, downloaded from the provider and replaced when a newer version arrives. It describes cameras, not you.
• The road map of the areas you drive in — the centre lines of the roads, fetched when you first drive there: one file per area, and the road network in squares of roughly 27 × 20 km, which as a rule takes at most 150 MB; what has gone unused longest is cleared first. How the fetching works is under «Location» above. Ghost uses it to tell the road you are on from the one running beside it, so it does not warn you about a camera on a different street. It is public map data: it describes roads, and it records nothing about where you have been.
• Two random installation identifiers, each created once at installation and neither derived from the device. One is what the calls described above carry instead of anything about you — the licence count, the usage counts and a camera report all use that one. The other appears only in the local consent record below. They are two rather than one on purpose: a single identifier would let a licence count and a consent record be laid side by side, and there is no reason for anyone to be able to do that.
• Reports you have sent that could not be delivered yet. They wait here until they can go, at most 500 of them, and each one holds the coordinates of the place it reports. This is the only thing stored on the phone that says anything about where you have been, it is there because you chose to send it, and it is deleted once it has been delivered.
• The pending usage counts, until the next batch is sent.
• The subscription and licence state — whether a trial is running and when it ends, whether a subscription was reported active and when that was last checked, whether this installation has been switched off, the month last counted, and the prices last seen so the paywall can show them without a network call. No account, no receipt, no payment data: Apple and Google take the payment and Ghost never sees a card.
• The cameras you have muted — an identifier for each, its coordinate, and when you muted it. This is the only list in Ghost that holds places you chose yourself, and it leaves this device by no route at all: no upload, no address lookup, no backup. Muting only stops the sound and the vibration — the camera stays on the map and still warns you on screen. You can see the whole list in Settings and clear it one at a time or all at once.
• A handful of counters that stop the app repeating itself — how many drives have finished (a number, not the drives), when the app last asked you to rate it, whether you have seen the introduction to reporting, and how often a reporting prompt was dismissed. Numbers and dates; none of them says where or when you drove.
• The last ten errors the app itself ran into — a short code, one line, and a few lines of stack. They are cleaned before they are stored: anything shaped like a coordinate is stripped, because the likeliest thing to turn up in an error message from this app is a latitude. They are never sent anywhere on their own; their one purpose is that a support mail you write can name the error you hit.
• A record of each time you accepted the Terms and this Privacy Policy — which versions, when, the platform, the app version, the language, and the installation identifier. These are only ever added to, never overwritten and never deleted: a consent record that can be changed afterwards records nothing.

There is no crash-reporting service in Ghost — no Sentry, no Firebase Crashlytics, no third-party SDK watching the app and reporting home. The price of not having one is that a failure only becomes visible if you write in, which is what the support mail is for.

Nothing here is backed up to us or to anyone else. On Android, backup of the app's data is switched off, so it is not copied into a Google account and a reinstall genuinely starts with a fresh installation identifier. On iPhone the settings and counters described above are part of the device backup you make yourself: restoring a phone from your own backup restores them with it, including the installation identifier. That backup is between you and Apple; Ghost is not a party to it.

The camera database is the one thing on your phone that is deliberately kept out of that backup, on both platforms. It is licensed data rather than yours, and the licence requires the app to be able to destroy it — which it can only do for a copy that is still on the phone. A copy carried into a backup would come back on a restore, months later, and no longer be reachable. It is also the largest thing Ghost stores, so keeping it out of your backup is smaller and faster for you as well.

10. When you write to support

Writing to support is a mail from your mail app to ours, so it carries your mail address, as any mail does. Ghost attaches a short block of technical detail to it: app version and build, platform and OS version, the device model identifier (which says what kind of hardware this is, not which device), language, the state of your location and background permissions, subscription state, the camera-data version, and the code of the last error if there was one.

You see that block on screen before the mail opens, in full, and it is the same text the mail carries — you can delete any of it, or not send at all.

What it never contains: no coordinates, current or past, no drive history, and no logs of where you have been or what you were warned about.

11. The waiting list

If you dismiss the subscription page, Ghost offers to tell you when it launches where you drive. That is the only place in the app that asks for an email address, and it is the only thing in Ghost that could ever identify you. Nothing else here has your name on it, and there is no account to make.

What is sent when you tap the button, and nothing else: the address you typed, the country you picked, whether this is iOS or Android, the app version, the language the app is in, and your phone's own clock reading at that moment. The clock reading is used to check the request and is not stored — the day you signed up is the day the entry arrived on the server, not the day your phone believes it is.

It travels without the installation identifier. Every other thing Ghost sends carries a random identifier so that repeated calls from one phone can be counted; this one does not, deliberately. If it did, an address and that identifier in the same message would make every other anonymous thing that identifier appears in a thing about a named person. The two never meet.

What the address is used for: one mail, saying Ghost has launched in the country you picked. It is not sold, not shared, not passed to any advertising network, and not matched against anything. Every one of those mails carries a one-tap unsubscribe, and you can ask us to remove the entry at any time by writing to support@drivewithghost.com.

Joining changes nothing else. No push permission is asked for — the notice is a mail. No camera data is downloaded, nothing is purchased, and the subscription page is still there when you come back from it.

12. Apple Watch, CarPlay and Android Auto

What Ghost shows on your paired Apple Watch, in Apple CarPlay and in Android Auto is worked out on your phone and passed to those devices by Apple’s and Google’s own systems. It is not sent to us, and none of these surfaces adds anything to what sections 4 to 11 describe.

13. How and why we use it

We use the information above to: provide the camera-warning features and show your speed; deliver and manage your subscription and free trial; keep Ghost secure, stable, and working across devices and operating systems; understand aggregate, anonymous feature usage so we can improve the App; and respond to your support requests.

Where the law requires a legal basis, we rely on performing our contract with you (providing the App and your subscription), our legitimate interest in keeping Ghost reliable and improving it, your consent where we ask for it, and compliance with legal obligations.

14. Subscriptions & payments

Purchases are processed by Apple or Google as the seller of record, and subscription status is managed with RevenueCat. These providers handle the payment itself under their own privacy policies; we receive the information needed to know whether your subscription or trial is active. We do not collect or store your full card number.

15. Who we share information with

We share information only as far as it is needed to run Ghost, and only with: Apple and Google (app distribution and payments; and, as described in section 4, the operating system’s reverse geocoder and map tiles on the map screen), RevenueCat (subscription management), SCDB, the camera-data provider, a service of Eifrig Media GmbH, Hamburg, Germany (camera reports and the licence count, sections 5 and 8), Cloudflare, which runs Ghost’s own server and this website on our behalf, including email routing and the spam check on our forms; and our email service providers, to receive and answer your messages. Some of these companies process data under their own terms and privacy policies, as independent controllers, and we do not control that processing. Sections 4 to 11 describe what the app sends and to whom.

We may also disclose information if we are legally required to, or to protect our rights, users, or the public, and we may transfer information as part of a business reorganisation, merger, or sale, subject to this policy.

16. What we never do

• We do not show ads in Ghost.
• We do not sell or rent your personal data.
• We do not publish your personal driving history.
• We do not use your data to build advertising profiles about you.
• We do not track you across other companies’ apps or websites, and Ghost does not use your device’s advertising identifier.
• We do not share personal data for cross-context behavioural advertising.

17. How long we keep information

We keep information only for as long as needed for the purposes described here. Data that stays on your device remains until you delete the App or clear it; section 9 lists it. Subscription records are kept as needed for our contractual and legal obligations. Anonymous usage counts (section 6) may be kept without a fixed limit because they no longer identify you. Support messages are kept for as long as needed to help you and to keep a record of the request.

18. Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent you have given. You can also control key choices directly: manage location and motion permissions in your device settings, switch drive detection on or off in Settings, and clear the cameras you have muted there.

To make a request, contact us using the details below. Because Ghost has no accounts and most of the data it sends is not linked to your identity, we can often find your data only if you tell us something that identifies it — for example the email address you wrote from — and some anonymous data cannot be traced back to you at all. We will respond as required by applicable law. You also have the right to complain to your local data-protection authority.

19. Additional information for your region

European Economic Area, United Kingdom and Switzerland

The rights and legal bases described in this policy are those of the EU General Data Protection Regulation, the UK GDPR and the Swiss Federal Act on Data Protection. Where we rely on legitimate interests, you have the right to object at any time.

United Arab Emirates

Where the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, you have the rights it gives you, including to obtain information about and access to your personal data, to have it corrected or erased, to restrict or stop its processing, and to object to decisions based solely on automated processing. You may complain to the UAE Data Office.

California and other US states

Ghost collects these categories of personal information: identifiers (the installation identifier, and your email address if you give it to us); precise geolocation (in the cases set out in section 4, including camera reports you choose to send); internet or other electronic network activity (anonymous usage counts); commercial information (whether your trial or subscription is active); and the content of messages you send us. Sources, purposes and recipients are described above. We do not sell personal information and do not share it for cross-context behavioural advertising, and we use precise geolocation only to provide the service you asked for. You have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights; you may use an authorised agent. Residents of other US states with comparable laws have the same rights. Because we neither sell nor share personal information, a Global Privacy Control signal is treated as already honoured.

20. Children

Ghost is intended for licensed drivers and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, please contact us and we will take appropriate steps.

21. International transfers

We and our service providers may process information in countries other than yours, including the United States. Where we transfer personal data internationally, we take steps to ensure it is protected in line with applicable law — for example by relying on the European Commission’s Standard Contractual Clauses offered by our service providers, or on another mechanism the law permits.

22. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the version and the date above and, where appropriate, notify you in the App. Your continued use of Ghost after an update means you accept the revised policy.

23. Contact us

For any privacy question or request, write to support@drivewithghost.com or use the contact form. Our postal address is Authentic Code LLC, 680 S Cache Street, Suite 100-7414, Jackson, WY 83001, United States.