Privacypolicy

This policy describes how the Ghost project handles your data on the site and in our products. By placing an order, registering, or launching our software, you agree to what's written here.

• Data controller — the Ghost team, a private software store.
• Site — ghost.one. Product — a temporary license to software we build and maintain ourselves.
• We decide what data is processed and why, and we're responsible for keeping it safe.
• The service is meant for adults. We don't knowingly collect data from minors.

Data questionsSupport on Telegram

For anything about your data — from "what do you store about me" to "delete me" — write to support. It's a live channel, and we answer fast.

We split data into three groups: what the service can't run without, what you give by choice, and what we never touch.

Necessary

• Nickname and email — login, orders, purchase emails
• Password — only as an irreversible hash, never in plain text
• Device identifier and basic tech configuration — to bind the license
• IP and login session data — security and account-takeover protection
• Order details — what you bought, amount, payment method

By choice

• Phone — if you decide to add it to your profile
• Avatar — uploaded or from a social network
• Social login — Google, Yandex, Discord, Telegram
• Telegram for notifications — if you connect it

Never

• Your bank card details — only the payment service sees those
• Your password in readable form — even we don't know it
• The content of private messages outside support
• And we don't sell your data — under any circumstances

We get data in a few ways, and all of them are obvious.

We process data only for a specific job. Next to each purpose is the legal basis we rely on.

• Create an account, issue a key, and service your licenseContract
• Bind the license to a device and prevent access theftContract
• Take payment and protect it against fraudContract
• Answer in support and resolve your issuesContract
• Catch multi-accounts, bonus abuse, and misuseLegitimate interest
• Measure traffic and improve the siteConsent
• Send service emails — codes, receipts, order statusContract
• Send news and deals — only if you're subscribedConsent
• Comply with the law and settle disputesLegal duty

Our product is a license bound to a single device. For that to work, the loader reads technical data from your computer. It's not about your identity — it's about the hardware and the launch.

• Device identifier — to bind the key to one machine, one key per device.
• Basic system configuration — components and OS parameters, network identifiers; needed for compatibility and to prevent device spoofing.
• License activity data — loader version, launch times, and approximate region by IP.

This data serves the license itself and protects it from theft. Without access to a device identifier, the one-key-one-device binding is physically impossible.

We use cookies and similar technologies. Some are required for the site to work, others are optional.

Analytics and protective cookies are set by third-party services. You can manage cookies in your browser settings — but without the strictly necessary ones, the site may not work properly.

We don't trade your data. But for the site to work, some data is processed by vetted contractors — strictly to the extent their job requires.

Some contractors are located outside the EEA. In those cases we rely on the legally provided safeguards for transfers — standard contractual clauses and equivalent guarantees.

We don't allow any contractor to use your data for their own purposes — only to provide the service to us.

We keep data exactly as long as the job needs, then delete or anonymize it.

Account and profile

As long as the account exists

Unfinished registration

Up to 30 days, then deleted

Login sessions

From 3 to 30 days

Verification and reset codes

10 minutes

Service and payment logs, analytics

Up to 90 days

Orders and reviews

Indefinitely, anonymized on deletion

We take your data seriously and protect it with technical and organizational measures.

• Passwords and tokens are stored only as irreversible hashes — even we don't see your password.
• Sensitive secrets, such as your two-factor key, are encrypted.
• Sessions live in protected cookies inaccessible to scripts; 2FA login is available.
• Access to data inside the team is limited and role-based.
• When data is served outward, extra fields are stripped automatically.

No system is one hundred percent secure. If you spot a security issue — write to support, and we'll handle it fast and without red tape.

It's your data. By law you have a set of rights, and we respect them — without bureaucracy.

Access

Find out what data we hold about you.

Rectification

Fix inaccurate data — some of it right in your profile.

Erasure

Wipe your account and related data — the right to be forgotten.

Restriction

Pause processing in disputed cases.

Portability

Get your data in a machine-readable form.

Objection

Object to processing based on legitimate interest.

Withdraw consent

Withdraw consent where processing relies on it, such as marketing.

Complaint

Reach out to a data protection supervisory authority.

To use any right — write to support on Telegram. To protect the account, we may ask you to confirm it's yours.

We respond within a reasonable time — usually within 30 days.

When an account is deleted — at your request or automatically — here's what we do:

Fully deleted

• Personal profile and contacts
• Avatar
• Balance and bonus history
• Referral links and notifications

Anonymized

• Orders and reviews
• Support requests
• Detached from you, kept for accounting and guarantees

Kept briefly

• Some service and payment logs
• Up to 90 days for security and disputes
• Then deleted automatically

We must keep certain data if the law, an open payment, or a dispute requires it.

We may update this policy — for example, when we change services or contractors. We'll announce material changes in your account and in the Telegram channel. The date of the latest revision is at the bottom. Continuing to use the site after an update means you accept the new version.