Privacy policy
Your photos stay on your device.
Last updated November 12, 2026.
This policy covers VideoGhost for Mac, VideoGhost for iPhone and this website.
The short version
- On both Mac and iPhone, your photos, video, your voice and faces are processed on your device and never sent.
- On iPhone, to write its suggestions, VideoGhost sends text to our server: what you said, the words around each moment, place names, and a short text summary of the kinds of photos in your library. Never photos, video, audio or faces. Our server doesn't store that text.
- On Mac, editing, search and rendering work with the network off.
- Both apps have two switches, shown during setup and in Settings: Share anonymous usage stats and Share transcripts and edits. On the Mac both are on by default. On iPhone, usage stats are on by default and transcripts and edits are shared only if you choose to. Turn either off and that data stops.
- Before transcripts and edits are sent, VideoGhost removes the names of people you've tagged, email addresses, phone numbers and street addresses on your Mac. Other personal details you say out loud may remain.
- Both are linked to a random install ID, never your name, email, Apple ID or license.
- On iPhone, feedback is sent only when you send it, and you can switch off most of what a report includes first.
- Continue on Mac moves a project from your iPhone to your Mac through your own iCloud, never through our servers.
- Neither app edits or deletes anything in your photo library, and neither has ads or ad trackers.
- This website uses cookies for analytics and to show our ads to people who visited. Opt out at the bottom of any page.
Who we are
CZL Labs LLC, San Francisco, California, makes VideoGhost and is responsible for the data described here. Contact: support@getvideoghost.com. A person replies within 2 business days.
VideoGhost for Mac: what the app sends, and when
- Model downloads. On first run, the app downloads its on-device models from our server. Nothing from your library is sent.
- Update checks. The app version. Our server logs your IP address.
- License activation. When you activate, your license key is checked with Creem once, and your install ID is linked to your purchase email so we can help you with support. Usage stats, transcripts and edits are never linked to your license or purchase email.
- Share anonymous usage stats, on by default: speed, errors, your Mac model and roughly how big your library is, never what's in your shorts. In detail: app version, chip, memory, macOS version, library size in buckets, how long each step took, video length, which steps you reached, error codes and thermal state. Sent to api.getvideoghost.com.
- Share transcripts and edits, on by default: what you say, search and change in each short, so suggestions learn what works. One record per short you render:
- the transcript words with their timings, which words you removed and how you corrected them;
- your photo spots and whether VideoGhost suggested them;
- each spot's search text and whether you kept, replaced or skipped its photo (never which photo);
- the headline as drafted and as kept, and your project choices, such as remove silences and the end card;
- the app version, the speech and AI model names, and the day (not the time).
- Continue on Mac, only if you turn on Receive projects from your iPhone (off by default). About once a minute, the Mac app checks your own private iCloud database for projects you sent from your iPhone. It opens each one, deletes it there, and leaves a short note (the project's ID, your Mac's name and the time) for your iPhone to read and delete. It never passes through our servers. See Continue on Mac.
- Publishing, only if you turn it on. The shorts you choose to post are sent to your publishing service (Zernio) and on to the platforms you pick.
What we never collect from the Mac app
Photos, thumbnails, videos, voice audio, faces, photo IDs, album names, places from your library, file paths, the names of people you tag, or your email. Our servers reject any payload with fields they don't know.
VideoGhost for iPhone
What stays on your iPhone.
- Camera and microphone. When you record a take in the app, it's saved to your Photos library like any camera video. Nothing from the camera or microphone leaves your iPhone, and your takes are never uploaded.
- Your videos, audio and voice. Transcription uses Apple's speech recognition on your iPhone.
- Your photos. Photo search runs on your iPhone. Your photos, and the search data made from them, never leave it.
- Faces and People. Off until you turn it on. Faces are found and grouped on your iPhone, and people you mark "never use" are kept out of your shorts there too.
- Place names. Looked up in a list built into the app, offline.
The app asks for access to your Photos library to search it, and permission to add to it so finished shorts can go in a VideoGhost album. If a photo or video is only in iCloud, the app asks Apple's Photos to download it. That's between your iPhone and Apple's iCloud, under Apple's privacy policy, not ours.
What's sent to our server, as text only. To pick moments, write photo searches and draft headlines, the app sends text to our language model at brain.getvideoghost.com. The first short in the app's introduction sends nothing; after that, each short sends:
- the transcript of your take, with its words numbered;
- the words around each moment you or VideoGhost chose;
- place names you mention;
- headlines it already suggested, so it doesn't repeat them;
- a short text summary of what kinds of photos your library holds: the kinds of things in them, date ranges and place names. No images, no search data made from photos, no faces.
Our server passes that text to OpenRouter, which runs the language model with providers that, as OpenRouter classifies them, don't store or train on prompts. OpenRouter's prompt logging is off for our account, so it doesn't keep the text either. OpenRouter receives only that text, never anything that identifies you, your iPhone or your subscription. Our server doesn't store or log the text you send, the prompts or the answers, and it never reads or stores your IP address.
What's sent to prove it's the real app and check your subscription. With each request: a key and signature from Apple's App Attest (they show the request comes from the real VideoGhost app on a real iPhone), the App Store's signed record of your subscription, and the app's build number. We keep only:
- a device ID made from that App Attest key, its public key, and when it was first and last seen. It's specific to this install of the app: reinstalling makes a new one;
- your subscription's original transaction ID from Apple, linked to the devices it's used on, so one subscription works on up to 3 devices;
- counts of requests per device and per subscription, to enforce fair-use limits;
- refund and revocation notices Apple sends us.
Subscriptions. Apple handles payment, your Apple ID and billing under its own privacy policy. We receive the transaction details Apple signs, never your name, email, Apple ID or card.
Helping improve VideoGhost. Like the Mac, the iPhone app has two switches, shown during setup after Photos access and in Settings. Share anonymous usage stats is on by default. Share transcripts and edits is off unless you choose to share them. Each uses its own random install ID, never linked to your subscription, your device ID above, your name or your Apple ID. Test versions from TestFlight send transcripts and edits but not usage stats.
- Share anonymous usage stats: counts and timings, never what's in your shorts. Whether suggestions worked and how long they took, errors by code, rendering and saving, when the paywall was shown and whether a purchase, trial or restore happened, your Photos access level, background indexing runs, Low Power Mode, library size in buckets, crash and hang counts, your iOS version and a rough iPhone model class. Sent to api.getvideoghost.com, only from the App Store version of the app.
- Share transcripts and edits: one record per short you save, as on the Mac: the transcript words with their timings, what you cut and corrected, where photos went and whether VideoGhost's pick was kept (never which photo), and the headline as drafted and as kept. Before sending, the app replaces names, email addresses, phone numbers and street addresses with placeholders on your iPhone. Sent to edits.getvideoghost.com. Records that can't be sent yet wait on your iPhone for up to 7 days. Turning it off deletes what your install already sent.
Send Logs. Only when you tap Send in Settings, the app sends the last day of its own log, Apple's crash and hang reports for the app, and an optional note you write, with personal text removed on your iPhone first. You get a short code to quote to us. Logs go to edits.getvideoghost.com, only we can read them, and they're deleted after 30 days.
Send Feedback. Only when you send a report from the app or shake to report. Before it goes, you see what it includes, and each of these has its own switch:
- your iPhone's exact model (such as iPhone16,2) and iOS version, and the app version;
- which screen you were on;
- the last error: its code and message, and up to 50 lines of the app's log, with file paths, IDs, names, email addresses, phone numbers and street addresses removed on your iPhone first;
- for feedback on a short: its settings, each part's photo searches, a scrambled code and rank for each photo (never the photo or its Photos ID), and the headline and whether you edited it.
A report always includes what you write and the reasons you pick, whether you're in your free trial, subscribed or expired, and your language setting. Your email address is included only if you type one, and it's used only to reply to you; your iPhone remembers the last one until you tap Forget in Settings › About. Screenshots (up to 10 MB) and screen recordings (up to 50 MB) are added only if you attach them. Shaking to report attaches a screenshot, which may show your photos, with a button to remove it.
Reports use their own random feedback ID, not linked to your subscription, your device ID above, or your usage stats, transcripts and edits or logs. They're kept in private storage on Cloudflare and emailed to our support inbox through Resend, our email delivery service. The email holds the report and links to any attachments, which stop working after 90 days. Our server doesn't log what you send, request headers or IP addresses.
Quick feedback. Only while Share anonymous usage stats is on, the app sends the quick feedback you tap, in batches within a few minutes: a thumbs up or down on a headline, with the headline; a rating of a short, with the short's random ID; Wrong Photo, with a scrambled code for the photo and the search words or reason; and Never use on a photo, with only its scrambled code. Each also carries a random ID, the time and your feedback ID. Our server drops anything else. Quick feedback isn't emailed; we read it as weekly totals.
Continue on Mac. Only when you tap it, the iPhone app saves that project to your own private iCloud database (Apple's CloudKit), and VideoGhost on your Mac opens it from there, if you've turned on Receive projects from your iPhone on the Mac. The project holds the transcript words and their timings, your cuts, the iCloud IDs of the photos you chose (never the photos or the video), the photo search words, the headline and the project's settings. The text is kept in CloudKit's encrypted fields. It travels between your devices through your iCloud account and never reaches our servers. Your Mac deletes the project from iCloud as soon as it opens it, and leaves a small note with the project's ID, your Mac's name and the time, so your iPhone can show where it opened; your iPhone then deletes the note. If you cancel before a Mac opens it, your iPhone deletes the project. A project you sent stays in your iCloud until a Mac opens it, you cancel the send or you delete the short on your iPhone; if no Mac has opened it after 30 days, the app offers to cancel it when you open the project. If your iPhone never reads the note, for example because you deleted the app, your Mac deletes it after 30 days. All of this sits in your own iCloud, which we can't see.
What the iPhone app doesn't have. No accounts, no ads, no tracking and no third-party SDKs. The free-trial reminder is a notification scheduled on your iPhone.
Your choices
On iPhone, both sharing switches are in Settings and work as on the Mac: off means not sent, and turning off Share transcripts and edits also deletes what was sent. Logs are sent only when you tap Send; to delete them sooner, email us the code. To delete feedback you sent, tap Settings › About › Delete Feedback I Sent, which removes your reports, quick feedback and attachments from our storage, or email us the Feedback ID shown in Settings › About. Turning off Share anonymous usage stats stops quick feedback. That button can't recall report emails already in our support inbox; ask us and we'll delete those too. Turning off Settings › Photo spot ideas stops the text sent for suggesting photo spots. Picking moments, writing searches and drafting headlines still need the text described above, and there's no switch for those. To have us delete the device and subscription records we keep, email us and we'll help you find them from your App Store receipt. Devices that haven't used VideoGhost for 180 days are deleted automatically.
On Mac, both switches are in Settings › Help Improve VideoGhost. Turning off Share transcripts and edits also deletes the transcripts and edits your install already sent. Turning off Share anonymous usage stats stops usage stats. With both off, nothing is sent. Uninstall VideoGhost… deletes what was sent, then removes the app and all its data from your Mac.
Retention
iPhone: transcripts and edits, and raw usage events, are kept up to 90 days. Installs that send nothing for 180 days are deleted. Logs you send are kept 30 days. Feedback reports are kept 2 years, quick feedback 1 year, and screenshots and recordings 90 days; report emails stay in our support inbox until we delete them. Text sent for suggestions isn't stored. Device records and their subscription links are deleted after 180 days without use. Per-day request counts are kept 7 days, and refund and revocation notices 400 days.
Mac: transcripts and edits are kept up to 90 days, then deleted automatically. Raw usage events are kept 90 days, and installs with no activity for 180 days are deleted. Purchase records are kept by Creem and by us as long as tax law requires.
How we use your data, and why
- To run VideoGhost and this site, deliver your license and help you. Needed to provide what you bought or asked for. On iPhone this includes sending text to our language model for suggestions, checking your subscription, and limiting it to 3 devices.
- To improve VideoGhost. Usage stats show us bugs and slow steps. Transcripts and edits teach VideoGhost's suggestions what works. Both run on your consent through the two switches, which you can turn off at any time. Logs and feedback you choose to send help us fix the problem you report, and we use your email only to reply.
- To measure this website and show our ads to people who visited it. In the US this is our legitimate interest, and you can opt out at any time. In the EU, EEA, UK and Switzerland it only happens if you press Accept.
- To keep purchase and tax records and prevent fraud. Required by law, and our legitimate interest in keeping VideoGhost safe.
This website: analytics and advertising
Analytics. This site uses Google Analytics to count visits and see which pages help people. It sets cookies and sends Google the pages you view, where you came from, your rough location, browser and device.
Advertising. We show VideoGhost ads to people who've visited this site, on Google. To do that, this site sets advertising cookies from Google that let them recognize your browser on other sites and apps. We never let anyone else advertise on this site, and we never use what the app sends (usage stats, transcripts or edits) for advertising. The app itself has no ads and no advertising trackers.
Your choice. In the US and most other places, these cookies are on by default. Turn them off with Do not sell or share my personal information or Cookie settings at the bottom of every page, or with your browser's Global Privacy Control signal, which we honor automatically. In the EU, EEA, UK and Switzerland, nothing is set until you press Accept on the cookie banner. You can also use Google's Analytics opt-out add-on and ad settings.
Feedback board. If you sign in, we check your purchase email and license key with Creem, then keep your email, the name you choose to show and what you post. We store only a fingerprint of your key, never the key itself. Your email is never shown on the board. Leaving the board deletes all of it.
Who we share it with
- Creem: checkout, payment, tax, receipts and license keys, as our reseller and merchant of record. When you buy, Creem collects your name, email, billing details and payment method under its own privacy policy. We receive your name, email and order details, never your card number.
- Apple: App Store payments and subscriptions, App Attest, iCloud downloads in the iPhone app, and Continue on Mac, which uses your own iCloud account, under Apple's own privacy policy.
- OpenRouter, and the model providers it routes to: the text the iPhone app sends for suggestions, never anything that identifies you.
- Cloudflare: hosting, downloads, the network in front of our servers, storage for transcripts and edits, logs, feedback and backups, and the iPhone app's language model service.
- Google: analytics and advertising for this website, and our support email (Google Workspace), which receives feedback reports from the iPhone app.
- Resend: delivers iPhone feedback reports to our support inbox.
- Zernio: publishing, only for posts you choose to schedule.
We also share information if the law requires it, to protect people or VideoGhost from fraud or harm, or with a buyer if CZL Labs or VideoGhost is ever sold, under this policy. We never sell your personal information for money. Our service providers may only use it to work for us.
Where it's stored
We and our providers process data in the United States. If you're outside the US, your data is transferred there, and we rely on our providers' standard contractual safeguards for those transfers.
Security
On the Mac, your VideoGhost library is encrypted, including copies of your videos and your voice recordings, with a key kept in your Mac's Keychain. That covers the photo index, people and faces, transcripts, projects, video copies, recordings and voice audio, the photos used in your projects, thumbnails and caches, so other apps can't read them. Finished shorts are saved as normal videos to your Photos. Uninstalling VideoGhost removes the key. There's no recovery key: if the Keychain key is lost, VideoGhost indexes your library again, and nothing in your Photos is lost.
Everything the app and this site send travels encrypted. Transcripts and edits are kept in private storage, the Mac app's secret token lives in your Mac's Keychain, and we keep access to a minimum. No system is perfectly secure, so we also keep as little as we can, for as short a time as we can.
Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you, and send you a copy you can take elsewhere;
- correct it, or delete it;
- stop or limit how we use it, including objecting to uses based on our legitimate interest;
- withdraw consent you gave, at any time, without affecting what happened before.
Email support@getvideoghost.com, ideally from your purchase address. We may ask you to confirm it's you, and we answer within 30 days. In the EU, EEA, UK or Switzerland you can also complain to your local data protection authority.
California residents
In the last 12 months we collected: identifiers (email and name from Mac purchases, a random install ID, an iPhone device ID and App Store transaction ID, cookie IDs and IP address); purchase records; internet activity on this website; approximate location; usage stats and transcripts and edits from either app, if you share them; logs and feedback you choose to send from the iPhone, including screenshots or recordings you attach and your email if you leave one; and, from the iPhone app, transcript text passed to our language model and not stored. We use them for the purposes above.
Advertising cookies on this site count as "sharing" personal information for cross-context behavioral advertising under California law. You can opt out with Do not sell or share my personal information at the bottom of every page, and we treat a Global Privacy Control signal as an opt-out. We don't sell personal information for money, we don't use sensitive personal information to infer things about you, and we won't treat you differently for using any of these rights. To ask what we hold, or to correct or delete it, email support@getvideoghost.com. Someone you authorize can ask for you.
Children
VideoGhost isn't meant for children under 13 in the US, or under 16 anywhere else, and we don't knowingly collect their data. If you think a child has given us information, email us and we'll delete it.
Changes
When this policy changes, the date at the top changes. If a change reduces your rights, we'll put a notice on this site before it takes effect, and email buyers we can reach. Changes never apply to data we collected before them in a way that reduces your rights.
Contact
CZL Labs LLC, San Francisco, California. support@getvideoghost.com. A person replies within 2 business days.