Privacy Policy

This Privacy Policy explains how Authentic Code LLC (“we”, “us”, “our”) handles information in connection with Ghost: Speed Camera Detector, a mobile application (“Ghost” or the “App”). It covers what we process, why, who we share it with, and the choices and rights you have. It should be read together with our Terms of Use.

1. Who we are

Ghost is made by Authentic Code LLC, the controller responsible for the information described here. You can reach us at Authentic Code LLC, 680 S Cache Street, Suite 100-7414, Jackson, WY 83001, United States, or at support@drivewithghost.com. This policy covers the Ghost app for iOS and Android, including its Apple Watch app and what it shows in Apple CarPlay and Android Auto, and the website drivewithghost.com.

2. Our approach to your privacy

Ghost is built to need as little of your information as possible. The core job — warning you about cameras while you drive — runs on your device, using camera data stored locally. We designed Ghost so that driving does not require us to collect a continuous record of where you go.

3. Information we process

Depending on how you use Ghost and the permissions you grant, the following may be processed:

• Location, speed, and direction of travel. Ghost uses your device’s GPS and motion sensors while you drive to detect nearby cameras and to show your speed. The warnings are calculated on your device, and this information is not used to build a profile of your journeys; section 4 sets out exactly when your position leaves the device.
• Device & installation data. Basic technical details such as device type, operating-system version, app version, language and region settings, and a pseudonymous installation identifier used to make the App work and to keep it reliable.
• Subscription status. Whether you have an active trial or subscription, provided through Apple, Google, and our subscription-management provider RevenueCat. We do not receive or store your full payment card details.
• Usage and crash data. Which steps in the app are reached, counted by Ghost without coordinates, speeds or time of day, and — through Google Firebase Analytics and Crashlytics — how the app is used and where it fails, never with your position; in the European Economic Area, the United Kingdom and Switzerland Analytics only with your consent. Section 6 sets out exactly what is sent.
• Support requests & voluntary reports. If you contact us or choose to send feedback, we process what you send us — such as your message and the email address you use.
• Visiting this website. Our host, Cloudflare, processes technical data such as your IP address, browser and the pages requested, to deliver the website and protect it from abuse. The website loads no advertising scripts. Google Analytics (Google Ireland Limited; Google LLC in the United States) counts which pages are visited, from which site a visitor came, the approximate country and the type of device and browser; it sets first-party cookies (_ga, _ga_<ID>, kept up to 14 months), and the data is kept for 14 months. Google Signals and ad personalisation are switched off. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google Analytics loads only after you choose “Accept” in the bar at the bottom of the page; “Decline” keeps it off, and “Analytics choice” in the footer lets you change your answer at any time. Your answer is stored in your browser’s local storage. Elsewhere Google Analytics runs without asking, based on our legitimate interest in knowing which pages help drivers. The spam check on our forms (Cloudflare Turnstile) loads only once you start using a form and may use strictly necessary cookies or local storage for that check alone. The fonts on this website come from our own server. Our error page loads one font from Fontshare, which receives your IP address. If you pick a language on the website, a small cookie (ghost_lang) remembers that choice for 12 months and does nothing else.
• Contact form on this website. When you use our Contact Us form we process the name, email address, subject and message you enter, so we can answer you. To keep the form free of spam and abuse we use Cloudflare Turnstile, which performs a security check in your browser; we also process your IP address and country for that check and to limit abuse. The form is not used for advertising, and we do not keep a public record of it.
• Ghost community on this website. If you enter your email address to join the Ghost community on this website, we store that address so we can send you special offers, news about Ghost and invitations to community drives, together with the country you choose in the form and the country your request came from. We use both countries only to send you what fits where you drive. We do not store your name or your IP address for this. Each signup is also sent to our support inbox as an email. You can leave at any time through the link in every email or the contact form; we then delete your address and that email. If you joined before 6 November 2026, when this form was a waiting list, we send you only the message that Ghost is available unless you join again. The legal basis is your consent, which you can withdraw at any time.

4. Location, and how Ghost knows you are driving

Ghost reads your position. There is no version of a speed-camera warning that does not: what lies ahead of you cannot be worked out from anything else.

While you drive it is read continuously, including when the app is closed and the screen is off. The warning has to arrive whether or not Ghost is the app you are looking at, and that is what the background permission is for. Both systems make it visible while it runs — an indicator in the status bar on iOS, a permanent notification on Android — and both let you withdraw the permission at any time.

Outside a drive the precision drops, deliberately. Ghost then asks only to be told that the phone has moved a significant distance, at an accuracy of a few hundred metres to a few kilometres: enough to notice that a drive may be starting, far too coarse to follow anyone. The exact position is read while a drive is running and at no other time. That is a battery decision as much as a privacy one — here they point the same way.

The position is evaluated on the device. The camera data sits on the phone and the calculation happens on the phone, so producing a warning sends nothing anywhere. Ghost keeps no track, no route and no history of drives. There is no file and no database of where you have been, on the device or anywhere else, which is also why there is none to lose, sell or be asked for.

Your position leaves the device in four cases, and only one of them is something you send.

• A camera report, because you tapped to send it. What that carries is the next section.
• The country lookup, once per drive. To know whether the road signs around you say km/h or mph, Ghost asks the operating system's own reverse geocoder which country a coordinate is in. That question goes to Apple on iOS and to Google on Android; the answer that comes back is a two-letter country code. It is asked when a drive begins and re-used until you have travelled about 20 km — not on every position — and nothing else about the drive travels with it.
• The road name, when you open the report sheet. The sheet asks the same reverse geocoder what the road at that spot is called, so you can see whether it is the road you mean. The name is shown to you and is never sent with the report; the coordinate that asks for it does leave the device.
• Map tiles, on the map screen only. A map is drawn by asking Google for the tiles of the area on screen, and that area is where you are. The driving screen draws no map and makes no such request.

What Apple and Google do with a coordinate they are asked about is governed by their own privacy policies, not by this one. What Ghost controls is how often it has to ask: the country is kept for 20 km rather than looked up per fix, and the road name is only ever looked up because you opened the sheet yourself.

One more route carries no coordinate, but does carry the area: the road map, fetched along the way. To tell the road you are on from the one beside it, the phone needs the road map of the area. It is not shipped for the whole world; it is fetched in squares of roughly 27 × 20 km (0.25 degrees): the square you are driving in and the squares ahead in your direction of travel. Each square is fetched once and then read from the phone, offline too — until it is cleared to keep the map under 150 MB, or an app update brings a new map version.

• What is sent: in the address of the request, the number of the square (for a whole area file, the name of the area) and the name of the map version. No coordinate, no speed, no installation identifier, no cookie. As with any request on the internet, the server sees the IP address of your connection.
• What could be read from it: a single request places nobody. The order of the requests on one drive does trace the route at that coarse resolution, direction included — and that is exactly why it is not written down.
• Who receives it: Ghost's own server. It runs on Cloudflare, Inc., San Francisco (USA), which operates it on our behalf — as a processor under Art. 28 GDPR, on the basis of Cloudflare's data processing addendum; transfers to the US rely on Cloudflare's participation in the EU-U.S. Data Privacy Framework. Nothing is passed on.
• How long: only for as long as the request takes. Request logging is switched off for this server: Ghost stores neither the address nor the IP address of a map request. Error messages the server records itself carry no map address and remain retrievable at Cloudflare for at most seven days.
• Legal basis: Art. 6(1)(b) GDPR. Fetching the map is part of the warning service you use Ghost for: without the map of the area the app cannot tell a camera on your road from one on the road next to it. The brief processing of the IP address to deliver the answer and to protect the server against abuse rests on Art. 6(1)(f) GDPR — our legitimate interest is a reachable, secure service.
• Without a connection nothing is fetched. Where no map is on the phone, Ghost still warns, only without that distinction.

How a drive is recognised. Three signals, any one of them enough:

• Motion. Both systems can tell an app that the phone is in a moving vehicle. That yes/no is the whole of what Ghost reads from the motion sensors — no step count, no walking or cycling, no fitness data, nothing describing how you moved. It needs its own permission, it is a switch in Settings called drive detection, and the app works without it.
• The audio route. A phone connected to a car — CarPlay, a head unit, a hands-free kit — is a phone in a car. Ghost looks at what kind of output audio would go to, never at the device, its name or its address. Bluetooth music output is deliberately not counted, because that is how headphones connect.
• Speed. A position moving faster than 8 km/h.

A drive ends by itself after five continuous minutes below that speed with none of these signals present.

5. Camera reports

Ghost lets you report an error in the camera database: a camera that is missing, an average-speed zone that is missing, a camera that has gone, a position that is wrong, a speed limit that is wrong, a direction that is wrong, or a confirmation that a doubted camera is still there. Added to those is the mobile speed check: a measurement standing there today. There are eight kinds of report.

The mobile one is treated unlike all the others. It reaches every driver nearby at once — one report is enough — and it expires by itself after eight hours, sooner as soon as one driver reports that nothing is standing there any more. What reaches other phones is the place, the direction and the word «mobile», and nothing about the reporter: no identifier, no time, no speed. And it is never passed on: an observation from this afternoon belongs in no database but ours, and not for long even there — after the eight hours nothing of it is served to anybody.

There is no way to report a police patrol, and there is not going to be one.

What is sent when you submit a report:

• the coordinates of the reported place,
• the heading and speed at the moment of the report, because without them there is no way to tell which carriageway the report applies to,
• the time,
• the kind of report,
• which camera in the database the report is about — the database's own identifier for it and what kind of object it is — for the reports that correct an existing entry rather than add one,
• an identifier for the report itself, generated on the device, so that a report arriving twice stays one report,
• a random installation identifier, created when the app is installed,
• the speed limit, if you stated one: the report sheet offers a short list for it, and “Don’t know” stands first in that list and is pre-selected. Leave it there and no value is sent at all, and the app never guesses a limit, because the road data on the phone carries none,
• and, if you corrected the position on the map by hand, a note that you did.

What is not sent: no name, no email address, no device identifier, no phone number, no advertising ID. Ghost has no user accounts, and there is nothing a report could be linked to you by.

A missing fixed camera you report warns you, and later others. Apart from the mobile speed check above, every kind of report is correction data and never a warning. A report that a fixed camera is missing is the one further exception, and only for permanently installed equipment: from your next approach, your own phone warns you about it exactly as it warns about any other fixed camera. Other drivers are warned about it only once three different installations have reported the same place, and only as long as we have not removed it after review. What reaches them is the camera — its position and direction — and nothing about who reported it, when, or how fast they were driving. A missing average-speed zone does not warn: one report marks one end of a zone, and a zone needs both.

Where a report goes. Straight to our own server, as soon as this phone has a connection. Correcting the camera database is the whole point of reporting, and our server is where a correction belongs. What travels is the list above: the position, the direction, the speed at that moment, what kind of correction it is, the report's own identifier — and the installation identifier, so that the same phone sending the same thing twice is recognised as one report rather than two.

For a report of a missing fixed camera, the server also counts how many different installations have reported the same place. That is what the installation identifier is used for there: the same phone reporting the same camera twice counts once. The server keeps these reports for as long as the camera may be warned about; the list it hands back to the app contains positions and directions only.

A report Ghost cannot deliver waits on this phone until there is a connection, and leaves the queue the moment our server has taken it.

A report is only ever sent because you tapped to send it. Ghost never asks: there is no screen after a drive, no notification, no reminder and no points.

The installation identifier is not linked by us to your name, email address or device, and reinstalling produces a new one — with the one exception named under device backups below.

6. Usage measurement and crash reports

Ghost measures how the app is used and where it fails, in two places: its own server, and Google Firebase. Neither receives your position.

Ghost's own count. Ghost counts which steps in the app are reached — that onboarding was completed, for instance, or that the paywall was shown. The counts are batched and sent rarely, never one at a time and never when a warning fires.

What is sent: the name of the event, and for some events a coarse bucket instead of an exact figure — "20–60 minutes" rather than the length of a drive. Each batch also carries, once, the app version, the platform, the language and a random installation identifier: once per batch, not once per event. A batch keeps the version and the language it was recorded under, even when it is only sent after an update.

No timestamp. The events carry no time of day. The server keeps the day a batch arrived and nothing more — for this count, when something happened does not leave the device.

Google Firebase Analytics and Crashlytics. Ghost also uses Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf as a processor under Art. 28 GDPR. Google LLC in the USA may process it too; transfers to the US rely on Google's participation in the EU-U.S. Data Privacy Framework and on Google's standard contractual clauses.

In the European Economic Area, the United Kingdom and Switzerland, Firebase Analytics is used only if you agree. For drivers there — the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland — Ghost asks once, while the car is parked and never over a warning: “Help make Ghost's warnings better”, with “Accept” and “Decline” side by side. Until you accept, nothing of the Analytics part below is collected; “Decline” keeps it that way, and Settings › Support & Legal › “Usage Analytics (Google)” changes your answer at any time. Everywhere else Analytics is used without asking. Ghost tells where you are from by the country of your App Store or Google Play account and, until it knows that, by the region set for your device's language; if neither says, Analytics is used without asking. Crashlytics is used everywhere, without asking.

• What Firebase Analytics receives: the same events as above, through the same filter — the event name and at most two short fields of fixed values. In addition: the steps of the introduction and the setup, the answers to the permission prompts, what came of the subscription page (shown, trial started, purchase, restore, cancelled — never a price and never a payment detail), which setting you changed and to which of its choices, whether a car audio connection (CarPlay, a hands-free kit) or an Apple Watch came or went, and, when a drive ends, how often something went wrong in it — a tone that could not be played, a lost GPS signal — as a coarse number. A few coarse properties go with it: the app language, the unit setting, whether a subscription is active, whether drive detection is on, and whether this is a test build.
• What the Firebase SDKs add themselves: a random app-instance identifier created on this device, the device model, the operating system and its version, the app version, the language, a country derived from the IP address of your connection — Firebase does not store the IP address itself — and the start and length of app sessions. Firebase keeps the time at which each event happened, for instance when a drive was detected and when it ended; it never receives where.
• What Crashlytics receives: when the app crashes or runs into an error, the error message, the stack trace (the place in the code where it happened), the device model, the operating system, the app version, the free memory and storage, the time, and a random Crashlytics installation identifier. Ghost cleans the messages and stack traces of the errors it records itself before they go: anything shaped like a coordinate, a file path, an email address or a long token is removed.

What is explicitly never sent, to either: no coordinates, no speeds, no camera identifiers, no route data, and neither the time nor the place of a warning. That a warning fired is not counted at all. Firebase learns only, when a drive has ended, how often in that drive a warning's sound or notification could not be delivered — a number, without time or place. The list of forbidden fields is in the code and is checked on every build; an event carrying one cannot be created, and the filter in front of Firebase lets through only two short fields.

No advertising identifier, no advertising. Ghost does not read the advertising identifier (IDFA on iPhone, advertising ID on Android) or the iPhone's vendor identifier, does not use Google Signals, and allows no ad personalisation. The data is not joined to other data about you, not used for advertising and not sold. There is no tracking prompt, because there is no tracking.

The switch. Settings › Support & Legal › “Share Usage & Crash Data” turns Firebase Analytics and Crashlytics off together, wherever you are; from then on nothing more is sent to Firebase. Ghost's own count has no switch, and that is deliberate: it carries no place, no time of day and no identifier beyond the random installation identifier, and none of it goes to anyone else.

How long: Firebase Analytics keeps event data for 14 months, Crashlytics keeps crash reports for 90 days. Ghost's own counts stay on Ghost's server.

Legal basis: for crash reports, Art. 6(1)(f) GDPR — our legitimate interest is a stable warning service that does not fail unnoticed; they carry no location data. For Analytics in the countries named above, your consent, Art. 6(1)(a) GDPR (and the equivalent rules on storing information on your device), which you can withdraw at any time in Settings. Elsewhere, our legitimate interest in understanding which parts of the app work, so that the warning service gets better. You can object at any time with the switch above.

7. Checking the network connection

Ghost checks periodically whether the device is online, by resolving a hostname — the same address the app already talks to.

No data is sent in the process. No request is made, no content leaves the device, and no identifier is involved. The only party that learns anything is the name server the operating system was going to use anyway.

The result has exactly one effect: Ghost can tell you that map tiles do not load offline, and that your warnings are unaffected because the camera data is on the phone.

8. Where the camera data comes from

The locations of fixed cameras and average-speed zones come from Ghost’s own database, which also draws on reports sent by drivers. It describes cameras, not people, and our Legal Notice gives the attributions.

The data sits on your device. Ghost downloads it and evaluates it locally. Nothing is requested and nothing is sent in order to produce a warning — your position never leaves the device for that purpose.

Access is counted and checked, and that is all these calls do. There are two of them, and this is the complete list:

• Once per calendar month the app tells Ghost's own server that this installation is active: the identifier and the month, so that we can count active installations.
• At start-up it asks Ghost's own server whether this installation has been switched off, which sends the identifier and nothing else.

Neither carries a position, a speed, a time of day, or anything at all about a drive. They are a count and an access check, not a location.

9. What is stored on the phone, and for how long

All of it is on your device. None of it goes anywhere except where a section above says so, and all of it is gone when you delete the app.

• Your settings — units, which kinds of camera you want warnings for, volume, language, map style. Kept until you change them.
• The camera database, downloaded from Ghost’s own server and replaced when a newer version arrives. It describes cameras, not you.
• The road map of the areas you drive in — the centre lines of the roads, fetched when you first drive there: one file per area, and the road network in squares of roughly 27 × 20 km, which as a rule takes at most 150 MB; what has gone unused longest is cleared first. How the fetching works is under «Location» above. Ghost uses it to tell the road you are on from the one running beside it, so it does not warn you about a camera on a different street. It is public map data: it describes roads, and it records nothing about where you have been.
• Two random installation identifiers, each created once at installation and neither derived from the device. One is what the calls described above carry instead of anything about you — the monthly count, the usage counts and a camera report all use that one. The other appears only in the local consent record below. They are two rather than one on purpose: a single identifier would let a monthly count and a consent record be laid side by side, and there is no reason for anyone to be able to do that.
• Firebase’s own identifiers — the app-instance identifier of Firebase Analytics and the installation identifier of Crashlytics, both random, both created by the Firebase components on this device, and neither derived from the device or from Ghost’s two identifiers. Events and crash reports that have not been sent yet wait beside them. With the switch in Settings off, nothing more is sent; deleting the app deletes them.
• Reports you have sent that could not be delivered yet. They wait here until they can go, at most 500 of them, and each one holds the coordinates of the place it reports. Together with the next item, this is the only thing stored on the phone that says anything about where you have been, it is there because you chose to send it, and it is deleted once it has been delivered.
• The fixed cameras you reported as missing — the position and, where you were moving, the direction of each, at most 200, so that your phone warns you about them. They stay after the report is delivered; reporting one of them as gone removes it, and deleting the app removes all of them.
• The fixed cameras other drivers reported — positions and directions as Ghost's server lists them, replaced by each newer list. They describe cameras, not you.
• The pending usage counts, until the next batch is sent.
• The country of your store account — a two-letter code, remembered so that the next start knows whether Analytics needs your answer (see section 6). It is not sent anywhere.
• The subscription and licence state — whether a trial is running and when it ends, whether a subscription was reported active and when that was last checked, whether this installation has been switched off, the month last counted, and the prices last seen so the paywall can show them without a network call. No account, no receipt, no payment data: Apple and Google take the payment and Ghost never sees a card.
• The cameras you have muted — an identifier for each, its coordinate, and when you muted it. Unlike the cameras you reported above, it leaves this device by no route at all: no upload, no address lookup, no backup. Muting only stops the sound and the vibration — the camera stays on the map and still warns you on screen. You can see the whole list in Settings and clear it one at a time or all at once.
• A handful of counters that stop the app repeating itself — how many drives have finished (a number, not the drives), when the app last asked you to rate it, whether you have seen the introduction to reporting, and how often a reporting prompt was dismissed. Numbers and dates; none of them says where or when you drove.
• The last ten errors the app itself ran into — a short code, one line, and a few lines of stack. They are cleaned before they are stored: anything shaped like a coordinate is stripped, because the likeliest thing to turn up in an error message from this app is a latitude. Kept here so that a support mail you write can name the error you hit; the same cleaned lines also go to Crashlytics, unless you switched that off.
• A record of each time you accepted the Terms and this Privacy Policy — which versions, when, the platform, the app version, the language, and the installation identifier. These are only ever added to, never overwritten and never deleted: a consent record that can be changed afterwards records nothing.

Crash reports go to Firebase Crashlytics — what it receives, what is removed first and how to switch it off is in section 6. What reaches it has been cleaned exactly like the error log on the phone.

Nothing here is backed up to us or to anyone else. On Android, backup of the app's data is switched off, so it is not copied into a Google account and a reinstall genuinely starts with a fresh installation identifier. On iPhone the settings and counters described above are part of the device backup you make yourself: restoring a phone from your own backup restores them with it, including the installation identifier. That backup is between you and Apple; Ghost is not a party to it.

The camera database is the one thing on your phone that is deliberately kept out of that backup, on both platforms. It is Ghost’s data rather than yours, and the app must be able to delete it when access ends — which it can only do for a copy that is still on the phone. A copy carried into a backup would come back on a restore, months later, and no longer be reachable. It is also the largest thing Ghost stores, so keeping it out of your backup is smaller and faster for you as well.

10. When you write to support

Writing to support is a mail from your mail app to ours, so it carries your mail address, as any mail does. Ghost attaches a short block of technical detail to it: app version and build, platform and OS version, the device model identifier (which says what kind of hardware this is, not which device), language, the state of your location and background permissions, subscription state, the camera-data version, and the code of the last error if there was one.

You see that block on screen before the mail opens, in full, and it is the same text the mail carries — you can delete any of it, or not send at all.

What it never contains: no coordinates, current or past, no drive history, and no logs of where you have been or what you were warned about.

11. The waiting list

If you dismiss the subscription page, Ghost offers to tell you when it launches where you drive. That is the only place in the app that asks for an email address, and so the only place in the app that asks for something that names you. Nothing else here has your name on it, and there is no account to make.

What is sent when you tap the button, and nothing else: the address you typed, the country you picked, whether this is iOS or Android, the app version, the language the app is in, and your phone's own clock reading at that moment. The clock reading is used to check the request and is not stored — the day you signed up is the day the entry arrived on the server, not the day your phone believes it is.

It travels without the installation identifier. Every other thing Ghost sends carries a random identifier so that repeated calls from one phone can be counted; this one does not, deliberately. If it did, an address and that identifier in the same message would make every other pseudonymous thing that identifier appears in a thing about a named person. The two never meet.

What the address is used for: one mail, saying Ghost has launched in the country you picked. It is not sold, not shared, not passed to any advertising network, and not matched against anything. Every one of those mails carries a one-tap unsubscribe, and you can ask us to remove the entry at any time by writing to support@drivewithghost.com.

Joining changes nothing else. No push permission is asked for — the notice is a mail. No camera data is downloaded, nothing is purchased, and the subscription page is still there when you come back from it.

12. Apple Watch, CarPlay and Android Auto

What Ghost shows on your paired Apple Watch, in Apple CarPlay and in Android Auto is worked out on your phone and passed to those devices by Apple’s and Google’s own systems. It is not sent to us, and none of these surfaces adds anything to what sections 4 to 11 describe.

13. How and why we use it

We use the information above to: provide the camera-warning features and show your speed; deliver and manage your subscription and free trial; keep Ghost secure, stable, and working across devices and operating systems; understand how the App and this website are used and where the App fails, so we can improve them (sections 3 and 6); and respond to your support requests.

Where the law requires a legal basis, we rely on performing our contract with you (providing the App and your subscription), our legitimate interest in keeping Ghost reliable and improving it, your consent where we ask for it, and compliance with legal obligations.

Under the GDPR and the UK GDPR, in particular: camera reports, map and camera-data downloads, the subscription check and support mail rest on Art. 6(1)(b). Ghost’s own usage count, the monthly activity count and abuse protection on our forms rest on Art. 6(1)(f), our legitimate interest in a working, secure service. The waiting list and the Ghost community rest on Art. 6(1)(a), your consent, which you can withdraw at any time. The contact form rests on Art. 6(1)(b) or, where no contract is concerned, Art. 6(1)(f).

14. Subscriptions & payments

Purchases are processed by Apple or Google as the seller of record, and subscription status is managed with RevenueCat. These providers handle the payment itself under their own privacy policies; we receive the information needed to know whether your subscription or trial is active. RevenueCat receives a random app-user identifier and the purchase and renewal records the store sends, so we know whether your subscription is active; it acts as our processor. We do not collect or store your full card number.

15. Who we share information with

We share information only as far as it is needed to run Ghost, and only with: Apple and Google (app distribution and payments; and, as described in section 4, the operating system’s reverse geocoder and map tiles on the map screen), RevenueCat (subscription management), Google (Firebase Analytics and Crashlytics in the App, section 6, and Google Analytics on this website, section 3), Cloudflare, which runs Ghost’s own server and this website on our behalf, including email routing and the spam check on our forms; and our email service providers, to receive and answer your messages. Apple and Google act as independent controllers when they sell the subscription, and when they answer the reverse-geocoder and map-tile requests described in section 4; that processing is governed by their own terms and privacy policies, and we do not control it. RevenueCat, Google Firebase, Google Analytics, Cloudflare and our email service providers act as our processors. Sections 4 to 11 describe what the app sends and to whom.

We may also disclose information if we are legally required to, or to protect our rights, users, or the public, and we may transfer information as part of a business reorganisation, merger, or sale, subject to this policy.

16. What we never do

• We do not show ads in Ghost.
• We do not sell or rent your personal data.
• We do not publish your personal driving history.
• We do not use your data to build advertising profiles about you.
• We do not track you across other companies’ apps or websites, and Ghost does not use your device’s advertising identifier.
• We do not share personal data for cross-context behavioural advertising.

17. How long we keep information

We keep information only for as long as needed for the purposes described here. Data that stays on your device remains until you delete the App or clear it; section 9 lists it. Subscription records are kept as needed for our contractual and legal obligations. On our server, camera reports are kept while we review them and for at most 24 months; a report of a mobile speed check is deleted 24 hours after it arrives. The monthly activity records and Ghost’s own usage counts are deleted after 13 months. Google Analytics data from the App and this website is kept for 14 months, Crashlytics crash reports for 90 days. Support messages are kept for as long as needed to help you and to keep a record of the request.

18. How we protect it

Everything the app and this website send travels encrypted (HTTPS). Our server accepts only the fields this policy names. Only we can reach stored reports, the waiting list and support mail. Our processors are bound by contract to protect the data at least as this policy does.

19. Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent you have given. You can also control key choices directly: manage location and motion permissions in your device settings, switch drive detection on or off in Settings, turn off usage and crash data with “Share Usage & Crash Data” in Settings, change your answer on Analytics there if you were asked, clear the cameras you have muted there, and change your Analytics answer on this website with “Analytics choice” in the footer.

To make a request, contact us using the details below. Because Ghost has no accounts and most of the data it sends is not linked to your identity, we can often find your data only if you tell us something that identifies it — for example the email address you wrote from — and some pseudonymous data is not linked by us to your name, email address or device, so we may not be able to find it at all. We will respond as required by applicable law. You also have the right to complain to your local data-protection authority.

Ghost makes no decision based solely on automated processing with legal or similarly significant effects on you. Wherever you live, you can use the rights your local law gives you by writing to us.

20. Additional information for your region

European Economic Area, United Kingdom and Switzerland

The rights and legal bases described in this policy are those of the EU General Data Protection Regulation, the UK GDPR and the Swiss Federal Act on Data Protection. Where we rely on legitimate interests, you have the right to object at any time.

United Arab Emirates

Where the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, you have the rights it gives you, including to obtain information about and access to your personal data, to have it corrected or erased, to restrict or stop its processing, and to object to decisions based solely on automated processing. You may complain to the UAE Data Office.

California and other US states

Ghost collects these categories of personal information: identifiers (the installation identifier, and your email address if you give it to us); precise geolocation (in the cases set out in section 4, including camera reports you choose to send); internet or other electronic network activity (pseudonymous usage counts, and website and app usage measured with Google Analytics); commercial information (whether your trial or subscription is active); and the content of messages you send us. Sources, purposes and recipients are described above. We do not sell personal information and do not share it for cross-context behavioural advertising, and we use precise geolocation only to provide the service you asked for. You have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights; you may use an authorised agent. Residents of other US states with comparable laws have the same rights. Precise geolocation is sensitive personal information; we use it only after you grant location permission, and only to provide the service. If we decline your request, you may appeal by replying to our answer, and then contact your state attorney general. Because we neither sell nor share personal information, a Global Privacy Control signal is treated as already honoured.

Brazil

Where the LGPD applies, you have the rights in its Article 18, including confirmation, access, correction, anonymisation or deletion, portability, information about sharing and withdrawal of consent, and you may complain to the ANPD. Our contact for data-protection matters (encarregado) is support@drivewithghost.com.

21. Children

Ghost is intended for licensed drivers and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, please contact us and we will take appropriate steps.

22. International transfers

We and our service providers may process information in countries other than yours, including the United States. Where we transfer personal data internationally, we take steps to ensure it is protected in line with applicable law — for example by relying on the EU-U.S. Data Privacy Framework where a provider such as Google takes part in it, on the European Commission’s Standard Contractual Clauses offered by our service providers, or on another mechanism the law permits.

Authentic Code LLC is based in the United States, so what you send us goes there directly. For transfers from the UK and Switzerland we rely on the UK Extension and the Swiss-U.S. Data Privacy Framework where our processors are certified, and otherwise on standard contractual clauses.

23. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the version and the date above and, where appropriate, notify you in the App. Where a change needs your consent, we will ask for it in the App.

24. Contact us

For any privacy question or request, write to support@drivewithghost.com or use the contact form. Our postal address is Authentic Code LLC, 680 S Cache Street, Suite 100-7414, Jackson, WY 83001, United States.