Privacy Policy
Effective Date: April 30, 2026 · Last Updated: October 7, 2026
1. Introduction
2. Information We Collect
Account and Host Profile Information
When you create or use an account, we may collect:
- Account identifiers and sign-in information, such as your email address, phone number, Supabase user ID, and the sign-in method or identity provider connected to your account. Supported methods may include phone verification, email and password, email magic link, Sign in with Apple, and Google sign-in.
- Host profile information, such as your name, default tip, notification and theme preferences, and PayPal, Venmo, Zelle, or Apple Cash handles or contact details you choose to save.
- Persistent account history, including meals you host or join that are associated with your account or verified phone number.
- Apple authorization credentials, when Apple supplies one, retained in encrypted form only so GhostCheck can revoke Sign in with Apple when you delete your account.
Authentication providers receive the information needed to authenticate you. We do not receive your Apple or Google password.
Meal and Bill-Splitting Information
- Meal names, host and guest names, phone numbers provided for a meal, and participant rosters.
- Receipt images and extracted receipt data, including items, prices, subtotal, tax, tip, and totals.
- Item claims, shared-item splits, amounts allocated or owed, claim status, payment status, amounts marked paid, payment-related actions, timestamps, and meal-related notes or messages.
- Host payment handles or contact details displayed to participants so they can pay outside GhostCheck.
GhostCheck does not process payments or collect credit card numbers, bank account credentials, or payment account passwords. A payment handle, email address, or phone number entered for a payment service is contact information, not payment card or bank data.
Guest phone numbers and notification destinations are used by GhostCheck to deliver requested meal communications. They are not displayed to meal hosts or other participants. Hosts may see the selected notification channel and delivery status and may ask GhostCheck to send a meal-related reminder without receiving the underlying phone number, email address, or device token.
Receipt Images
Before a receipt photo is processed, the signed-in host must allow receipt processing. This choice is saved to the host's account, can be changed in Settings, and must be enabled for receipt photos to be sent to an AI provider. Pasted receipt text is processed by GhostCheck and is not sent to an AI provider. When receipt photo processing is enabled and a host uploads or photographs a receipt, the image may be:
- Sent to Google or Anthropic for AI-assisted text extraction.
- Stored in private Supabase Storage so the host and guests in that meal can review it through an access-checked GhostCheck page.
- Saved to the device photo library only if the user enables that app setting and grants the required device permission.
Photos, Profiles, Meal Details, and Recaps
- Profile and seat photos you choose as your look on your account or at a meal, stored privately and shown to people at the meals you join.
- Group photos a participant adds to a meal's recap. The person who adds a group photo chooses whether it is shared with the whole table and can remove it.
- Meal details, such as the restaurant name, city, and meal type, read from the receipt or entered by the host. When the host picks the restaurant from Apple Maps search, we also keep that place's Apple Maps identifier.
- Profile information, such as a profile handle, trophies, stats, and meal recaps you save. Profiles are off by default. If you turn on a profile, the people you choose (tablemates or anyone with your link) can see your name, look, trophies, stats, and the recaps you mark public, never amounts or where you ate.
- Recap cards are drawn on your device and shared only if you share them. They never show amounts, and you can keep your name off them.
Notifications, Device, and Technical Information
- SMS consent and delivery information, phone numbers, message status, and provider message identifiers.
- Email addresses and delivery information for account and transactional emails.
- Web push subscriptions and iOS push notification device tokens, together with the associated platform and notification preferences.
- Essential authentication cookies, local storage preferences, and security or operational logs generated when the service is used.
- Anonymous usage counts: we count anonymous page visits and button taps, without cookies or identifiers, to improve GhostCheck. Each count records only the action, the page, the platform (web, iOS, or Android), and the campaign tag of the link you arrived from, if any. It is never linked to your name, account, phone number, IP address, or device.
We do not collect precise location data. We do not use third-party advertising cookies, tracking pixels, or cross-site tracking technologies.
3. How We Use Information
We use information to:
- Create, authenticate, secure, and maintain accounts and host profiles across the website and iOS app.
- Create meals, manage participants, process receipts, calculate shares, record claims, and show payment status.
- Display a host’s selected payment handles to participants in the applicable meal.
- Send verification codes, claim links, reminders, meal updates, and payment-status notifications.
- Link hosted and attended meals to an account or verified phone number.
- Show the profiles, trophies, and meal recaps you choose to share, and summarize your own dining history for you, such as a year in review.
- Understand how GhostCheck is used in aggregate, for example how many meals take place at a restaurant location, to improve GhostCheck and develop restaurant partnerships. Aggregated information does not identify you.
- Detect errors, prevent abuse, protect the service, comply with law, and improve reliability.
- Respond to feedback, support questions, privacy requests, and deletion requests.
We do not use personal information for targeted advertising or sell it to data brokers.
4. How We Disclose Information
We disclose information only as needed to provide and protect GhostCheck:
- Supabase provides authentication, database services, and private receipt image storage. Account information, profiles, meal data, push subscription data, and receipt images may be stored or processed by Supabase.
- Twilio processes phone numbers, verification or transactional SMS content, consent and delivery information, and message identifiers to deliver texts.
- Google and Anthropic may process receipt images, related prompts, and extracted receipt content for AI-assisted OCR. The provider used for a receipt may vary.
- Resend and email infrastructure providers process email addresses and transactional email content. Supabase or its configured email provider may also deliver authentication emails.
- Apple Push Notification service (APNs) processes iOS device tokens and notification payloads. Browser push services may process web push subscriptions and payloads.
- Apple Maps receives the search text, and the meal's city as a hint, when a host searches for the restaurant on a meal. Searches are sent from GhostCheck's servers, without your name or account.
- Apple and Google authentication services process sign-in requests when you choose those identity providers. GhostCheck may retain an encrypted Apple authorization token solely to revoke that authorization during account deletion.
- Other meal participants can see information needed to coordinate their meal, including names, receipt and item information, claims, shares, payment status, and the host’s selected payment handles, along with meal details, looks, and any group photo shared with the table. Hosts may also see a guest's selected notification channel and delivery status. Guest phone numbers, email addresses, and notification tokens are not displayed to hosts or other participants.
- Legal, safety, and business disclosures may occur when required by law, needed to protect users or the service, or as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.
We do not sell personal information. Text messaging originator opt-in data and consent are not shared with third parties or affiliates for marketing or promotional purposes.
5. No Advertising or Cross-Service Tracking
6. Data Retention and Deletion
Host accounts and profiles are persistent and remain until deleted. Meal records, receipt images, claims, and payment status may remain available to authorized users until the meal is deleted or deletion is requested. GhostCheck does not currently apply a fixed automatic deletion period to all account and meal data.
When a host or administrator deletes a meal, GhostCheck deletes the associated database records and attempts to remove its receipt images from Supabase Storage. Some information may remain for a limited period in backups, security logs, provider systems, or records we must keep for legal, fraud-prevention, or dispute-resolution purposes.
Signed-in users can permanently delete their account in Settings. Account deletion removes the host profile, hosted meals, and associated receipt images, and anonymizes participation in meals hosted by someone else so those meals keep accurate bill totals. When a retained Apple authorization token is available, GhostCheck attempts to revoke it before deletion and then deletes the retained token. Older accounts without a retained token receive instructions for removing GhostCheck in Apple ID settings. You may also request deletion or help by emailing feedback@ghostcheck.co. We may need to verify your identity and clarify the account, phone number, email address, or meals covered by an emailed request.
7. Communications and Notification Choices
Hosts may receive verification codes and meal-related updates. Guests who choose SMS at check-in may receive claim links, bill reminders, and meal-related messages. Message frequency varies, and carrier message and data rates may apply. Reply STOP to opt out of SMS and HELP for help. SMS consent is not a condition of purchase, and GhostCheck does not send marketing SMS.
You can disable push notifications through your browser or iOS device settings and change available notification preferences in GhostCheck. Disabling notifications does not delete the related account or meal data.