Privacy

Who we are

This policy covers the Ghostdex website and app (together, the site), operated under the name Ghostdex. Ghostdex is software for trading tokenized stocks from addresses you control. It does not hold funds and does not ask you to register. For any question about this policy or your data, write to privacy@ghostdex.app.

What we do not collect

• No name, email address, phone number or identity document. There is no sign-up.
• No private keys, recovery phrases, ghost keys or ghost backup keys. They are created and used in your browser and are never sent to us.
• No advertising identifiers, no analytics and no tracking cookies.

What stays in your browser

A few values are kept in your browser's own storage so the site works the way you left it. They stay on your device, and you can clear them at any time from your browser settings. The full list, with each key, is in the Cookie policy.

• The Ghostdex wallet, if you use it: its recovery phrase or private key, encrypted with a key derived from your passcode. Only the encrypted copy is stored. We cannot read it, reset it or recover it.
• The ghost root: the value your ghost keys are derived from, kept in the session storage of the tab that opened your ghosts, and erased when that tab closes or when you lock your ghosts.
• Ghost names and agents: the names, numbers and funding notes of your ghosts, and the settings and recent conversation of your agents, stored per owner wallet. They contain no keys.
• Preferences: your answer to the storage notice, the wallet you last connected, and whether ghost mode is on.

Some of these keys include your wallet's public address in their name, so anyone with access to this browser's storage can see which wallets were used here. Clearing this site's data removes all of them. Your funds stay on the chain; the recovery phrase of your wallet, or your ghost backup key, brings them back.

Your addresses and the chain

When you connect a wallet, the site reads its public address, and the addresses of your ghosts, to show balances and build transactions. Public addresses and every transaction you send are recorded on public blockchains by design. Anyone can read them, and nobody, including Ghostdex, can change or erase them. The site does not build a profile of you.

The RPC relay

Your browser sends its Robinhood Chain reads, and the transactions your ghosts sign, through a relay on our server at /api/rpc, which forwards them to public nodes. The relay exists so that nodes see our server instead of your IP address. It handles each request only to forward it, and it does not store or log the requests or their contents. If the relay does not answer, your browser contacts public nodes directly. Transactions signed by a browser wallet extension are sent by that wallet, not by the relay.

Agents

When you ask an agent for a plan, your browser sends our server the agent's mandate, name, allowed stocks, limits and end date, the balances of the agent's ghost, your instruction, the last few messages of the conversation, and your main wallet's address. The address is used only to check whether it holds enough $GHOSTDEX for a larger allowance. Our server adds current prices and sends everything except the address to Anthropic, which generates the plan with its Claude models under its own terms and privacy policy. Neither the ghost's address nor any key is sent.

Our server does not store the request or the plan. To apply the daily allowance, it keeps a count of runs per IP address in memory for the current day only.

Services the site talks to

Each of these services is run by a third party under its own terms and privacy policy, and so are the protocols your transactions call: Uniswap, LI.FI, Morpho and Doppler. Requests marked from our server are made by Ghostdex and do not carry your IP address. Your wallet extension, if you use one, works under its own policy.

Server logs

Our hosting provider, Vercel, keeps short-lived technical logs of requests (such as IP address, time, requested URL and user agent) to operate and protect its platform. Quote requests carry addresses and amounts in their URL, so those logs can include them. Ghostdex uses such logs only to fix errors and stop abuse, and they are deleted on the provider's schedule. Our own routes, including the relay and the agent route, do not log the content of requests.

Launch submissions

If you launch a token, the image, name, ticker and optional story, website and X profile you enter are stored and published as the token's metadata. They are public by nature and are referenced by the token on chain, so they cannot be withdrawn after launch.

Legal basis

We process the little personal data described here because it is necessary to provide the site you chose to use (relaying requests, fetching quotes, generating agent plans) and because we have a legitimate interest in keeping the site running and secure.

Your rights

Under the GDPR (and the UK GDPR, or similar law where you live), you have the right to ask what personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to complain to your data protection authority. Because we keep almost nothing, most requests can be answered in a sentence. Blockchain records are beyond anyone's power to change.

To exercise a right or ask a question, write to privacy@ghostdex.app. We answer within 30 days.

Changes

If this policy changes, the new version is published on this page with a new date.