The short version. GHOSTFACE is built so that we hold as little about you as possible. We don't ask for your name, phone number or email address. Your in-app messages and calls are end-to-end encrypted — we cannot read them, and neither can anyone who compromises our servers. Your conversations, contacts and call history live on your device, not ours.
The one exception is the optional Ghost Number feature: ordinary SMS text messages travel through the phone network, so they are not end-to-end encrypted. We do not keep the texts you send, and texts you receive are locked to your device the moment they reach us. Section 3 says exactly what that involves.
This page explains exactly what does reach us, and why.
Ghostface Limited, a company registered in New Zealand, operates the GHOSTFACE application and this website. Where privacy law applies, Ghostface Limited is the data controller.
Contact: support@ghostface.co.nz
Because these are the questions people actually ask, they come first:
The service cannot function without a small amount of data. This is the whole of it. Rows marked optional exist only if you use that feature.
| Data | Why | Notes |
|---|---|---|
| Alias | So others can find you and start an encrypted session | Chosen by you. 3–20 characters, letters, digits and underscore. |
| Delivery ID | Routing messages to you | A random token generated at registration. Messages are addressed to this, not to your alias, so stored rows and network frames don't reveal who a message is for. |
| Public keys | Letting other people start an encrypted session with you | Identity, signed prekeys, post-quantum prekeys and their signatures. Public halves only — private keys never leave your device. |
| Queued messages | Holding a message until your device comes online | Stored as encrypted payload addressed to a delivery ID, with a delivered flag and a timestamp. We cannot read the contents. Delivered messages are removed within about an hour; undelivered ones after 7 days. |
| Encrypted attachments | Delivering photos, files and voice notes | Stored as encrypted files named by a random ID. The key travels only inside your end-to-end-encrypted message, so we cannot read them — and no account is recorded against them. They are deleted after 30 days. |
| Push tokens | Waking your device for a new message or call | The tokens Apple or Google issue for your device, stored as issued because they are needed to send the wake-up. The notification carries no message content. (Your device's separate sign-in token is stored only as a hash.) |
| Invite codes | Letting someone you invite connect to you | Classic invite codes record your alias as the owner. They last at most 7 days and are deleted a day after they expire or are used. Word-bound invite cards store only one-way hashes of the code — never the code or the word — and expire within 24 hours. |
| Plan and payment records | Unlocking paid features | Which plan is active (deleted 30 days after it ends), and for each plan payment: your alias, the plan, the USDC amount, and the Solana transaction it was paid in. Payments are made on the public Solana blockchain; we never see card details. Plan payment records are kept for seven years as financial records, including after an account is deleted. Payment requests that were never paid are deleted 30 days after they expire. Payments between users sent in the app are recorded for 30 days, so the conversation can show whether they arrived, then deleted. |
| Wallet address (optional) | Letting other users pay you | Only if you publish it. Public on the blockchain by nature. Removed from our servers when you delete your account, or on request. |
| Ghost Number (optional) | Sending and receiving SMS through a number we provide | The real phone number you exchange texts with, linked to your account while you hold the number. Texts you send are passed to our SMS provider, Vonage, and not stored by us. Texts you receive are sealed to your device's key the moment they reach our server, so the stored copy is one we cannot read. They are deleted when your Ghost Number timer runs out (5 seconds to 7 days, 1 hour by default), when you release the number, or when you delete your account; anything left is removed after 30 days. SMS is not end-to-end encrypted: while a text crosses the phone network, the carriers, Vonage and our server handle it in readable form. |
| Unknown-sender replies (Ghost Number) | Replying once to someone who texts a number nobody is using | That sender's phone number and the pool number they texted, so we reply only once. Kept for 90 days. This concerns outside senders, not your account. |
| VPN registration (optional) | Connecting you to the GHOSTFACE VPN | Your VPN public key, your assigned tunnel address and which VPN server you use, linked to your account. The VPN is part of the PHANTOM plan. Our VPN servers are not set up to record the sites you visit or the content of your traffic. |
| Device integrity check (Android) | Protecting the service from automated abuse | A Google Play Integrity token, sent to Google to confirm the app is genuine. We do not store it. If a check fails, our server log records Google's verdict, not your alias. |
Logs. Our own server logs are built so that they do not contain aliases, phone numbers, IP addresses, invite codes or message content — they record that things happened (counts, errors, timings), not who did them. Separately, our hosting provider, Railway, records each request that reaches our servers — the address requested, the IP address it came from and the app version — and keeps those records for 30 days. Some requested addresses currently include an alias; we are removing them.
These never reach our servers at all. They are stored in encrypted storage on your phone, and are lost if you delete the app or trigger a wipe:
Messages and calls use end-to-end encryption with a hybrid classical and post-quantum handshake — X25519 combined with ML-KEM-768 (NIST FIPS 203) — followed by a Double Ratchet using ChaCha20-Poly1305. Every algorithm is a published public standard; we have not designed or implemented any proprietary cryptography.
Practically, this means the encryption keys exist only on the devices at each end of a conversation. We do not hold them and cannot recover your messages for you, for law enforcement, or for anyone else.
Messages expire automatically. The timer can be set between 5 seconds and 7 days, and defaults to 1 hour. Expiry is enforced on both devices; undelivered messages also expire from our queue.
The in-app cryptocurrency wallet is non-custodial. Keys are generated on your device and never transmitted to us. We do not hold your funds, cannot move them, and cannot restore them. If you lose your device and your recovery phrase, the funds are unrecoverable — by us or by anyone.
GHOSTFACE is not directed at children and is not intended for use by anyone under the age required by their app store's terms.
If this policy changes materially we will update this page and revise the effective date above.
Questions, requests, or anything that looks wrong: support@ghostface.co.nz