Privacy Policy

Last updated: September 18, 2026Ghost of You is operated by Ghost of You LLC ("Ghost of You," "we," "us," or "our"), the company responsible for your data under this policy. Ghost of You lets you create an AI voice clone of your own voice and have spoken, AI-generated phone conversations — with your own clone, with a friend’s clone, or by sending your clone to call a friend who has accepted you. This policy explains what we collect, how the AI conversation pipeline works, and the third parties that process your data.1. Information We CollectAccount and identity. Your phone number, used for sign-in via SMS one-time passcode, your display name, and any optional profile photo you add.Contacts, optional. Only if you choose to use the contact picker: the app reads your device's contacts to help you find friends and send invites. Contact information is used on your device to display the picker. A contact's phone number is sent to our servers only when you take an action with it, meaning matching a contact to an existing user or sending them an invite. When you invite someone who isn't on Ghost of You yet, we keep a scrambled record of their phone number, protected by a key we store separately, so we can connect you and credit you if they join. The number can't be read back from that record, and it is deleted when they join or after thirty days, whichever comes first. We do not upload, copy, or store your address book.Voice and audio. The voice sample you record to create your AI voice clone, and the live audio of calls while you are using the service.Your voiceprint. The AI voice model created from your sample. This is a biometric identifier. See Section 4.Conversation content. The text of your conversations, meaning your speech converted to text and the AI’s spoken replies, the purpose and personality text you write, and AI-generated summaries. We store a transcript and a short summary of completed calls so you can review your recent calls in the app.Clips. If you or a friend creates a clip, we store a rendered video of up to the last thirty seconds of that conversation, including its audio and on-screen captions, plus the separate audio stems used to build it. See Section 6.Safety data. Reports you submit, blocked-user relationships, and related moderation records.Usage and diagnostics. Call-session metadata such as duration and timestamps, device and app information, IP address, and crash and error diagnostics used to operate and improve the service.Calendar Presence, optional and off by default. Only if you turn it on and grant calendar access: a minimal summary of your current and next calendar event, at the detail level you choose. See Section 5.Call invites, optional. If your call produces a concrete plan, we store the proposed title, time, and location so both people can confirm or dismiss it. If you choose to add it to your calendar, the event is written to your own device’s calendar. We do not store a copy of your calendar or write to it ourselves.Payment information. Subscriptions are sold and billed by Apple. We receive a record that a subscription started, renewed, or ended, and the plan level. We do not receive your card number or your full payment details.2. How Your Voice Calls Are ProcessedCreating your voice clone and running a live conversation require specialized third-party providers, which are named in Section 8.Your voice sample is sent to Cartesia, our voice provider, to create your personal AI voice model. We do not keep a copy of the raw sample on our own systems once the clone is created.During a call, your voice, the call audio, and the text of the conversation are processed by the audio and AI providers named in Section 8 in order to generate and speak your clone’s replies.The free text you write, meaning a call purpose or a clone personality, is screened by an automated content-moderation service before use, to block harassment, hate, threats, and other prohibited content.What Cartesia keeps. Cartesia stores your voice sample and the voice model built from it for as long as your clone exists, because the clone cannot run without them. When you delete your clone or your account, we delete both at Cartesia and confirm the deletion.Model training, xAI. Our agreement with xAI prohibits them from retaining, logging, or using your call audio or conversation text to train or improve their models.Model training, Cartesia. Cartesia has confirmed to us in writing that the voices we generate and the source clips behind them are not used for model training, and we have disabled the organization setting that would permit it. We hold that confirmation on file and we check the setting periodically. We describe this as their current practice rather than as a contractual guarantee, because that is what it is and we would rather be precise with you than reassuring. If it ever changes, we will update this section and tell you.3. How We Use Your DataWe use your data to authenticate your account, to create and operate your voice clone, and to power live conversations. We use it to store transcripts and summaries so you can review your recent calls. We use it to enforce safety, meaning content moderation, reports, blocking, and abuse prevention. And we use it to operate, secure, debug, and improve the service.We do not sell your personal data. We do not share it for cross-context behavioral advertising. We do not share it with advertisers. We do not use your voiceprint for any purpose other than operating your clone inside this app.4. Your Voiceprint and Biometric DataWhat it is and that we store it. When you record your voice sample, we create and store a voiceprint — an AI voice model derived from your voice. A voiceprint is a biometric identifier under the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Washington law, and Colorado law, and we treat it as one.The specific purpose. We collect, store, and use your voiceprint for one purpose: to create and operate the AI voice clone that you and the friends you approve can talk to inside Ghost of You. We do not use it to identify you, to authenticate you, to build a profile, or for any other purpose.The length of the term. We store your voiceprint until the earliest of the following: you delete your clone, you delete your account, twelve months pass without you using Ghost of You, or our annual review determines we no longer need it, in which case we destroy it within forty-five days. Our full Biometric Data Retention and Destruction Schedule is published at privacy.ghostofyouapp.com/#retention and is part of this policy.Who receives it. Your voice sample and your voiceprint are disclosed to Cartesia, which builds and operates your voice model. During a call, your call audio and the text of your conversation are disclosed to LiveKit, which carries the audio, and to xAI, which generates the words your clone speaks. No one else receives your voiceprint. We do not sell, lease, trade, or otherwise profit from it.Your consent is separate from this policy. Before you record your voice sample, we ask you to read a disclosure and sign a release specifically authorizing the collection, storage, use, and disclosure described above. That release, not this policy, is your consent. You may withdraw it at any time by deleting your clone or your account in Settings, and we will destroy your voiceprint, including at Cartesia.Your voice must be your own. You may only create a clone of your own voice. See our Terms of Service.5. Calls Involving Other PeopleCalls connect two people’s accounts, for example you talking to a friend’s clone, or your clone calling a friend who accepted you. During such a call, the live audio of both participants is processed as described above, and a transcript and summary may be stored and made available to participants of that call. Only people who have mutually accepted each other as friends can call one another.Calendar Presence, optional. If you enable Calendar Presence during onboarding or in Settings and grant calendar permission, the app reads a minimal summary of your current and next calendar event, at the detail level you choose, and stores that small summary so your AI voice clone can reference it to approved friends who call you. We read only your current and next event. We do not read or store event notes, attendees, invitation links, all-day events unless you allow them, or events marked private. Because the summary is included in the prompt that generates your clone’s replies, it is processed by xAI during such a call. Any friend you have approved may hear the summary if they call you. People who call you never see or browse your calendar, and only friends you have accepted can call you. You can turn Calendar Presence off at any time, which deletes the stored summary immediately.

6. ClipsWhat a clip is. A clip is a short video, up to the last thirty seconds of a conversation, rendered from the call’s audio with on-screen captions, the participants’ names and profile photos, and a visible label identifying the voices as AI clones. We store the rendered video and the separate audio stems used to build it.Consent is required, per friendship, and revocable. A clip of your clone can only be created by a friend you have accepted, and only if you have separately allowed that friend to make clips. You choose that when you accept them, and you can withdraw it at any time in the Friends screen. Withdrawing it stops any new clips of your clone from being made. It does not un-make clips that already exist, and it cannot recall a clip that has already been shared outside the app. Blocking someone additionally hides their existing clips from you.Who can make one. Only a live participant in a conversation can create a clip of it, and only of a conversation their own voice is in. Our servers enforce this, not just the app. No one can create a clip of a conversation they were not audibly part of.Two people appear in a clip. A clip necessarily contains both sides of the conversation. Whoever creates it can see, trim, and share it.The other participant is notified. When a clip is finalized, the other person in the conversation is notified that it was created.Sharing leaves our control. Once a clip is exported or shared to another app or service, that copy is outside Ghost of You and outside this policy. Deleting a clip here does not retrieve copies already shared elsewhere.What happens to clips when an account is deleted. This is deliberately asymmetric, because a clip involves two people. Clips of your clone are deleted with your account — the video, the audio stems, and the preview image. Clips you made of a friend’s clone are not deleted, because that friend consented to those clips existing and they remain available to them, no longer linked to your account. You should know what that means for you: because a finished clip contains both sides of the conversation, your own recorded voice remains inside the clips you made of other people, even after you delete your account. See Section 8.7. Ghost Stories and Ghost MessagesGhost Stories. A Ghost Story is an AI-generated argument between two voice clones on a topic chosen by the person who starts it. If your Ghost Stories setting is on, a friend you have accepted can start a story that includes your clone. Your clone’s voice, your display name, and your avatar appear in it. Your clone will say things you did not write and may not agree with, generated by our AI model provider. A story can be saved as a clip and shared outside Ghost of You if you have allowed that friend to make clips of your ghost. We store the story audio, its transcript, and any clip rendered from it, on the same schedule as clips.You control this. You can turn Ghost Stories off at any time in Settings, which stops your clone from being included in any new story. Turning it off does not delete stories that already exist. Because a story contains two people’s clones, a story you appear in also belongs to the other participant, and it follows the same asymmetry described for clips in Section 6.Ghost Messages. Ghost Messages are text threads in which a clone replies with AI-generated voice messages. We store those messages and their audio, and they are covered by the retention periods in Section 9.8. Third-Party Service ProvidersWe share data with third-party processors only as needed to provide the service. The providers that process your voice, your call content, or the text you write are named here.Cartesia performs AI voice cloning and real-time speech processing. LiveKit carries real-time call audio. xAI, through its Grok models, generates your clone’s conversational replies. OpenAI performs automated content moderation of text you submit. Apple delivers push and incoming-call notifications to your device and processes any subscription payments.We also rely on standard infrastructure and operational service providers: authentication, database, and file storage providers; an SMS delivery provider for sign-in verification codes; cloud hosting providers; crash and error diagnostic services; and email delivery services for safety-report notifications to our moderation team.Each of these providers is bound by contract to process your data only to provide services to us, and not for their own purposes.9. Data Retention and DeletionWe keep your data only as long as we need it. The specific periods for your voice data are set out in our Biometric Data Retention and Destruction Schedule at privacy.ghostofyouapp.com/#retention, and the short version is that your voiceprint is destroyed no later than twelve months after you last use Ghost of You, and your other voice-derived data no later than twenty-four months, whether or not you ever delete your account.Deleting your account from Settings removes your profile and phone number, your voice clone including at Cartesia, your transcripts and call summaries, your voice messages and their audio, your avatar, clips of your clone, your calendar snapshot, and your push notification tokens.Some records are deliberately kept, because they are not solely yours. Clips you made of a friend’s clone remain with that friend, who consented to them, and your own voice remains inside them, as explained in Section 6. Records of calls other people made to your clone are retained in reduced form — the conversation transcript is deleted, but the basic call record remains, because it is also the other person’s usage and billing history. Safety reports you filed or that were filed about you are retained for moderation integrity. Subscription and billing records, including the complete event records we receive from our payment processor, are retained for the period required by tax and accounting rules.Each third-party provider stores and deletes what it processes under its own policy. Limited records may be retained where required for legal, security, billing, or abuse-prevention purposes.Deleting your account does not cancel an Apple subscription. You must cancel that separately in your Apple ID settings, or Apple will continue to bill you.10. Your Rights and How to Use ThemYou can delete your voice clone or your entire account at any time from the Settings screen, without giving a reason and without contacting us. That is the fastest route and it is always available to you.You can also email [email protected] to ask us to give you a copy of the data we hold about you, correct data that is wrong, delete your data, send your data to you in a portable format, or limit our use of your sensitive personal information. We will verify that the request is really from you, usually by confirming control of the phone number on the account, and we will respond within forty-five days. If we need more time we will tell you why and take no more than an additional forty-five days.We will not charge you, deny you service, give you a lower level of service, or charge you a different price because you exercised any of these rights.You may use an authorized agent to make a request on your behalf. We will ask for proof that you authorized them and may still ask you to verify your own identity.If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the word appeal in the subject line. We will review the appeal and respond in writing within forty-five days, and if we deny it again we will tell you how to contact your state attorney general.

11. SecurityWe protect your data in transit and at rest using measures at least as protective as those we use for our own confidential information, and we review our storage and deletion practices at least once a year. No system is perfectly secure, but we work to safeguard your information and we will notify you of material incidents where required by law.12. Sensitive Personal InformationYour voiceprint, the voice recordings and call audio it comes from, and the contents of your conversations are sensitive personal information under state privacy laws. We collect and use them only to provide the service you asked for — creating and operating your voice clone. We do not use or disclose them to infer characteristics about you, and we do not use them for advertising or for any purpose you would not expect. Because we limit our use of this data to providing the service, there is nothing further to limit, but you may still ask us to confirm that in writing at any time, and you may delete the data at any time in Settings.13. ChildrenGhost of You is intended for users eighteen years of age and older. We do not knowingly collect data from anyone under eighteen. If we learn that we have, we will delete the account and its data. If you believe a minor is using the app, email [email protected].14. ChangesWe may update this policy from time to time. We will revise the last updated date above and, for material changes, notify you in the app before the change takes effect. We will not apply a materially different use of your voiceprint to data we already hold without asking you again.15. Where We OperateGhost of You LLC is a California limited liability company and the service is offered in the United States. Your data is stored and processed in the United States. If you use the app from outside the United States, you are sending your data to the United States, where privacy law differs from the law where you live.16. ContactThis service is operated by Ghost of You LLC. For questions, privacy requests, or appeals, email [email protected].

Ghost of You Biometric Data Retention and Destruction ScheduleGhost of You LLC. Published at privacy.ghostofyouapp.com/#retention. Effective August 24, 2026. Last updated September 17, 2026. This schedule is published to satisfy Section 15(a) of the Illinois Biometric Information Privacy Act and Section 6-1-1314 of the Colorado Revised Statutes, both of which require a publicly available written retention schedule and destruction guidelines. It is written to what our systems actually do.What we treat as biometric dataYour voiceprint is the mathematical voice model created from the sample you record. It is held by our voice provider, Cartesia, and it is what allows your clone to speak in your voice. We treat the voiceprint as a biometric identifier.We also apply this schedule to the data derived from it or captured alongside it: the voice sample you record at signup, the live audio of your calls, the transcripts and summaries of those calls, your voice messages and their audio, and the clips rendered from your conversations. Not all of these are biometric identifiers in the legal sense, but they come from your voice and we hold them to the same schedule so there is one rule rather than several.How long we keep each thingYour voice sampleThe raw sample you record is sent to Cartesia and used to build your voice model. We do not keep a copy on our own systems once the clone is created. Cartesia keeps the sample for as long as your clone exists, because your clone cannot run without it. When your voiceprint is destroyed under the rule below, the sample held at Cartesia is destroyed with it.Your voiceprintWe keep your voice model for as long as you have an active clone, and we destroy it at the earliest of four events: you delete your clone in Settings, you delete your account, twelve months pass without you using Ghost of You, or an annual review determines we no longer need it, in which case we destroy it within forty-five days of that determination, or within ninety days where the volume genuinely requires the extra time. Destruction includes deletion at Cartesia, not only in our own systems.Live call audioCall audio is processed in real time to run the conversation and is not stored as audio by us once the call ends. What survives a call is the transcript and the summary, covered below, and any clip someone chose to create.Transcripts, call summaries, and the personality and purpose text you writeWe keep these so you can review your recent calls. We destroy them at the earliest of account deletion, your deletion of the individual item, or twelve months after your last use of Ghost of You.Voice messages and their audioVoice messages and the underlying audio files are destroyed at the earliest of account deletion or twelve months after your last use of Ghost of You. When you delete a conversation it is removed from your app, and once everyone in that conversation has deleted it we destroy the messages and their audio within thirty days. Both the database record and the stored audio file are deleted.ClipsA clip involves two people, so it follows two rules. Clips of your clone are destroyed when you delete your account, and otherwise twenty-four months after your last use of Ghost of You. Clips you made of another person’s clone are not destroyed when you delete your account, because that person consented to those clips existing and they remain that person’s to keep or delete. Those clips are unlinked from your account and follow that person’s schedule instead. Because a finished clip contains both sides of a conversation, your own recorded voice remains inside clips you made of other people. A clip you or anyone else has already shared outside the app is a copy we cannot reach and cannot delete.Ghost StoriesA Ghost Story is an AI-generated argument between two voice clones. Because a story contains two people’s clones, it follows the same rule as clips. Stories your clone appears in are destroyed when you delete your account, and otherwise twenty-four months after your last use of Ghost of You. A story you started that includes another person’s clone is not destroyed with your account, because that person allowed their clone to be included and the story remains theirs. Turning Ghost Stories off in Settings stops your clone from being included in any new story, and does not destroy stories that already exist.Your consent recordsWhen you sign the release on the voice-recording screen, we record which version of the disclosure you were shown, that you checked each box, and a timestamp set by our server. We keep those records after you delete your account. They are the evidence that we collected your voiceprint lawfully and with your consent, and they are the first thing we would be asked to produce if that were ever questioned, so deleting them would leave both of us worse off. We keep them for five years after your account is deleted, which matches the limitations period for the claims they exist to answer, and then we destroy them. They contain no voice recording, no voiceprint, and no conversation content.Your Calendar Presence summaryIf you use Calendar Presence, the stored summary of your current and next event is destroyed the moment you turn the feature off, and otherwise at account deletion. We keep no history of it.Records that are not biometric but that we keep longerTwo categories survive account deletion, and you should know about them. Basic records of calls other people placed to your clone are kept in reduced form, because they are also the other person’s usage and billing history. The conversation content in those calls is deleted; what remains is the fact that the call happened and its topic. Safety and moderation records, meaning reports you filed or reports filed about you, are kept so that our moderation is not defeated by deleting and recreating an account. Billing records associated with subscription payments, including the complete event records we receive from our payment processor, are kept for the period required by tax and accounting rules. None of these contain your voiceprint or your voice. Your consent records also survive account deletion, and are covered separately above.Events that do not delete anything, stated so you are not surprisedTurning off a friend’s clip permission. This stops that friend from making any new clip of your clone from that moment forward. It deletes nothing. Clips that friend already made continue to exist and remain theirs. Blocking someone goes one step further and hides their clips from your own view, but that is a change to what you see, not a deletion — the clip and its video file still exist and the person who made it still has it.Turning off Ghost Stories. Same rule. Your clone stops being included in new stories. Stories that already exist are untouched.A subscription lapsing, being cancelled, or expiring. Nothing is deleted at all. The only thing that changes is the plan level recorded on your profile, which controls how many minutes you may use. Your voice clone, recordings, clips, transcripts, and profile text are all retained exactly as they were. If you want your data gone, cancelling a subscription is not how to do it — delete your clone or your account in Settings.Deleting your account does not cancel an Apple subscription. Those are separate systems and we cannot reach Apple’s. Cancel the subscription yourself in your Apple ID settings or Apple will keep billing you.If there is ever a security incidentWe maintain a written protocol for responding to a data security incident that may compromise biometric identifiers or biometric data, including how we determine what happened, how we contain it, and how we notify affected users as Colorado law requires. The protocol itself is internal, because publishing the mechanics of our incident response would make it less effective, and Colorado expressly does not require it to be public. What we will tell you is this: if your voiceprint or the data derived from it is ever compromised, we will notify you.

The outer limits, stated plainlyNo matter what else is in this schedule, we destroy your voiceprint no later than twelve months after your last interaction with Ghost of You, and we destroy all other biometric data covered by this schedule no later than twenty-four months after your last interaction. These limits are set to the strictest rule that applies to us. Illinois requires destruction when the initial purpose is satisfied or within three years of your last interaction, whichever comes first. Colorado requires destruction by the earliest of purpose satisfaction, twenty-four months after your last interaction, or forty-five days after an annual review. We have set our own limits inside all of them.How destruction happensDeletion is permanent, not a hidden flag. When a destruction event occurs, the underlying files are deleted from storage and the database records are deleted, in that order, so that no file is left behind with nothing pointing at it. Deletion of a voiceprint is executed against Cartesia’s systems as well as our own, and we verify the deletion rather than assuming it. Once each year we review every category in this schedule and destroy anything we no longer have a reason to hold, within forty-five days of that review.Some things we cannot reach. If you or a friend has already exported a clip out of Ghost of You through the share sheet, that copy exists outside our systems and outside this schedule. Each third-party provider named in our Privacy Policy also holds and deletes what it processes under its own retention terms.How to make us delete something nowYou can delete your voice clone or your entire account at any time from the Settings screen, and you do not have to give a reason. You can also email [email protected] and ask us to delete your data, and we will do it. Deleting your account does not cancel an Apple subscription. You must cancel that separately in your Apple ID settings or Apple will continue to bill you.Changes to this scheduleIf we change these periods we will publish the change here before it takes effect, and we will not extend a retention period for data we have already collected without telling you first.