Privacy Policy

1. Controller

Ghosted is operated by Lost Signals Studio (legal entity to be formalized — operator details are kept minimal to protect the operator’s privacy).
Contact for privacy matters: hey@lostsignals.studio

2. Data we process

• Account data: name, email address and a password hash (bcrypt, cost factor 12). OAuth sign-in identifiers if you use Google or LinkedIn.
• Job application data you enter: company, role, job-posting URL, contact details, notes and your milestone timeline. This data is yours and only used to provide the service.
• Session data: one essential session cookie (a signed JWT) required to keep you signed in.
• Local preferences: your theme choice and collapsed sections are stored in your browser’s local storage only and never transmitted to us.

3. Purposes and legal bases

• Providing the service (storing your account and applications): Art. 6(1)(b) GDPR (performance of a contract).
• Security and abuse prevention (rate limiting, auth logging): Art. 6(1)(f) GDPR (legitimate interest).
• Consent, where we explicitly ask for it: Art. 6(1)(a) GDPR.

We do not sell your data and do not run tracking or advertising cookies.

4. Storage and security

Data is stored in a PostgreSQL database. Connections are encrypted (TLS); passwords are never stored in plain text (bcrypt, cost 12); session cookies are httpOnly and secure. Access to your data is strictly scoped to your account.

5. Retention

Your data is kept while your account is active. You can delete individual applications at any time. On account deletion we erase your personal data within 30 days, except where we are legally required to keep it.

6. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) with regard to your personal data. To exercise any of these rights, contact hey@lostsignals.studio. You also have the right to lodge a complaint with your supervisory authority (in the EU/EEA, your local data-protection authority).