GhostLab: Spirit Vision Privacy Policy

Effective date: November 5, 2026 · Applies to the iOS app “GhostLab: Spirit Vision”

Spirit Vision is an experimental, AI-powered investigative tool. To generate an image during a session, it sends a text summary of the moment to GhostLab’s server and two outside AI services. This page says what that summary holds, who receives it, what GhostLab keeps, and what stays on your phone. The app asks your permission before your first session, and you can withdraw it in Settings.

Summary

The app never sends audio. Sounds are recognised on the device. What goes out is their names, how sure the phone was, when they happened and how much louder the room got, and the words anyone says never go out.
Your recordings and snapshots stay on your iPhone unless you share them, save them to Photos with iCloud Photos on, or back up your iPhone to iCloud or a computer. GhostLab and the AI services never receive them.
During a session, text goes to AI services. Sensor changes, the names of sounds, whether you seem to be in a car, indoors or outdoors, the place you chose, your local time and a short memory of the session go to Anthropic, and an image description goes to Runware.
GhostLab keeps very little of what is sent. Your sound names, sensor changes, chosen place, local time and the written memory of the session pass through our server and are never written to its storage. Our server stores your time zone offset with your daily count, and its service logs, kept for up to 7 days, note how often the sensors were firing, whether you seemed to be in a car, indoors or outdoors, and the kind of vision with a one-word label.
The camera is never used, and the location your phone reads stays on your phone. During a session the app uses it to tell whether you seem to be in a car, indoors or outdoors, and only that one word is sent.
No third-party ads, no analytics SDKs and no tracking. We do not sell personal data.
No sign-in. The app uses a random account number that names nobody.

What is sent during a session

Nothing about your session is sent until you agree, and none of it is sent outside a session. During a session, each time a sensor change or a recognised sound calls for a vision, the app sends:

the names of sounds the phone recognised from a fixed list, such as a knock, footsteps, whispering, crying, a scream, laughter, singing, a baby crying or children’s voices, with how sure the phone was and how long ago each one happened. The names never include the words anyone says
the sensor change or recognised sound that set it off, such as a shift in the magnetic field, motion or air pressure, a rise in loudness in decibels, or a knock, along with up to two rises in loudness from the last 30 seconds and how long ago each one happened
how fast the sensors have been firing lately, as a level from 0 to 3
whether the phone seems to be in a car, indoors or outdoors, worked out on the phone
the place you chose in the app, your local time and your time zone offset
a short written memory of the session so far, the last six moments with their times and one-word labels, and the kinds of vision already shown. The phone holds these in memory only, until the next session starts or the app closes, and sends them with each moment

Each request also carries your account number and an App Attest signature to GhostLab’s server, which does not send them to Anthropic or Runware.

What is sent outside a session

When the app starts up and each time a session starts, it contacts GhostLab’s server with your account number, a proof from Apple’s App Attest, your time zone offset and, if you have a plan or a purchase still going through, Apple’s signed record of it, so the app can check your plan and show what you have left today. The first of these contacts starts the record described under What GhostLab keeps. They happen before you agree to sharing and carry on if you stop sharing, and they go only to GhostLab’s server.

Who receives it

GhostLab’s server, which runs on Cloudflare, receives everything above. It uses your time zone offset to start your daily limit at your own midnight, and it passes the session summary on to Anthropic. The offset is saved in your account’s record, described below. The session summary is otherwise not saved, with one exception: service logs, which Cloudflare keeps for up to 7 days and which we use to keep the service running and watch its costs. They note whether the phone seemed to be in a car, indoors or outdoors, how often the sensors had been firing, the kind of vision and a one-word label for it. They also record that a vision happened, what it cost, how long it took, your plan, how many visions the session has had, and technical details about how the vision was made. Cloudflare handles your IP address to carry the connection. Its logs for our service can hold your IP address, the rough location Cloudflare works out from it, your account number, and the time and address of each request, along with the notes listed above, for up to 7 days. We do not use your IP address for anything. Cloudflare’s terms let it use what passes through or is stored on our server only as needed to provide its services or as the law requires, and for that content and the logs we can see, it is our data processor. Cloudflare is its own data controller for other traffic data about you, such as IP addresses outside those logs. Its privacy policy lets it use that data to run, protect, improve and promote its services, and it publishes no time limit for those records.
Anthropic receives the session summary, except your time zone offset, account number and App Attest signature, so that its Claude model can plan each image. Anthropic handles it as our data processor under its Commercial Terms and Data Processing Addendum, which bar it from selling this data or training models on it and require confidentiality and security measures. Anthropic says it deletes API inputs and outputs within 30 days. That is its published practice and is not a term of our contract, and it does not delete individual requests on demand. If its automated safety systems flag content, Anthropic says it keeps that content for up to 2 years and safety scores for up to 7 years, and it may keep data longer where the law requires or to combat violations of its usage policy. Anthropic’s retention page has the details.
Runware receives the image description Claude writes, and generates the image from it. Runware says it does not use API data to train models. Its documentation says it can return the complete request and response of past tasks, so it keeps the image description for a period it does not state, and its pages disagree on whether a copy of the image stays for up to 7 days. We are on Runware’s standard terms, with no data processing agreement and no Zero Data Retention. Each image comes back through our server to your phone, and GhostLab does not keep a copy. Runware’s data page has the details.

GhostLab is run from the United States, and nothing in our service keeps your data in one country or region. Cloudflare, Anthropic and Runware may handle your data in the United States and other countries, whose data protection laws can differ from yours. Some of those countries have no adequacy decision from the European Commission or the UK. Cloudflare and Anthropic say they use standard contractual clauses for transfers from Europe and the UK, and their privacy policies linked above explain how. To ask what protects your data in these transfers, email us at the address below.

If you’d rather not share this, press Not now when the app asks, or choose Stop sharing in Settings. Stop sharing ends a running session at once. A vision already on its way when you press it can still reach Anthropic and Runware. A session cannot start without sharing. The smoke, the readings, recordings and snapshots keep working.

What GhostLab keeps

To enforce each plan’s daily limits, and to keep pack balances safe across a reinstall, our server keeps a small record for each account:

a random account number, made by the app and kept in your iCloud Keychain
a public key from Apple’s App Attest, which proves requests come from a real device running this app
the current day’s date, your time zone offset, the count of visions used that day and what they cost us
the date you first used the service
your plan, its renewal date and Apple’s transaction numbers for your purchases
your vision pack balance
a mark on any purchase Apple has refunded or revoked

For a subscription, the daily count is kept under Apple’s original transaction number. This record holds no name, email address or pictures. We do not delete it on a schedule, and deleting the app does not remove it, so it stays after you stop using the app.

If you bought something, email us at the address below with your App Store order number. We handle these requests by hand and they can take some time, because we have to look up the purchase through Apple and change our server to remove the record. If you never bought anything, nothing in the record lets us tell it is yours, so we cannot find it from an email. The app has no delete control yet, so a record with no purchase stays on our server.

The microphone, sensors and location

With your permission, the app measures how loud the room is, on the device, whenever it is open, so the smoke and the SOUND reading can react. This happens even when no session is running, and it keeps no audio unless you press record. During a session the app also recognises sounds, on the device.
When you press record, the app saves a video of its own screen with the room’s sound, voices included, on your phone. The recording stays there until you delete it. A copy leaves the phone only if you share it or your iPhone backs it up.
Motion, magnetic and pressure readings drive the smoke and the readings on screen.
During a session, your location and motion, if you allow them, and whether you are on Wi-Fi, which needs no permission, tell the app if the phone seems to be in a car, indoors or outdoors. If you refuse location, the app can still send indoors when you are on Wi-Fi, or car when your motion shows a vehicle. Location is read only during a session, is never stored and never leaves the phone.
If you turn off the microphone or Motion & Fitness in iOS Settings, the app shows the sound or air pressure reading as off. The motion and magnetic readings need no permission and stay on. Location has no reading on screen, so turning it off only changes how the app works out whether you are in a car, indoors or outdoors.

Data the app keeps on your device

Snapshots and recordings are saved in the app’s Library. Like other app documents, they are included in your device backup. Deleting an item, or the app, removes them from the phone. Copies you have shared or saved to Photos stay where they are, and a backup already made keeps its copy until that backup is replaced.
Settings and counts, such as whether you agreed to sharing, whether you have seen the tour, your App Attest key name, and the visions, days and dates the app counts to decide when to ask for a rating, stay on the device and are included in your device backup. Your chosen place is not saved.
Your account number stays in your iCloud Keychain, so it can outlast deleting the app.

Sharing and Photos

Saving to Photos uses add-only access. The app cannot see anything already in your photo library.
The share sheet sends a capture wherever you choose. Once it leaves the app, whoever receives it decides what happens to it.

Purchases

Subscriptions and vision packs are handled by Apple through the App Store. The app gives Apple your random account number with each purchase, and Apple returns it in its signed record, so each purchase stays with your account. Apple can connect that number to your Apple Account. The app passes the signed record to our server when you buy, when you restore purchases, when the app starts up or a session starts while you have a plan, and when Apple sends a renewal or other update while the app is open. Our server reads the product, dates, transaction numbers and account number from it. We receive no name, email address or card details. Apple’s signed record also holds the price, currency and App Store country of the purchase, and our server does not use or keep those. Apple tells our server when a purchase is refunded or revoked, so that it can end the plan or take the pack’s visions off your balance, and our server keeps a mark against that purchase. If Apple reverses a plan’s refund, our server clears the mark and the plan returns. A reversed pack refund does not put the visions back.

What we do not do

We do not sell personal data.
We do not run analytics SDKs, advertising SDKs or trackers.
We do not upload your audio, recordings or snapshots.
We do not use the camera, and the location your phone reads never leaves it. Your IP address and time zone offset can still show a rough area, as described under Who receives it.

Children

The app carries the age rating shown on its App Store page and is not meant for children. We do not knowingly collect personal information from children under 13. If you believe a child has used the app and a purchase was made on that account, send us its App Store order number. We handle these requests by hand and they can take some time, because we have to look up the purchase through Apple and change our server to remove the record. An account with no purchase has no order number, so we cannot tell which record is theirs and cannot delete it.

Your rights and choices

We handle your session data because you agreed to it. You can withdraw that at any time in Settings. Once you do and the running session has ended, no more session data goes to Anthropic or Runware. Withdrawing does not recall what was already sent, and the app still contacts our server to check your plan, as described under What is sent outside a session.

We keep your account record and service logs because we have a legitimate interest in running the service, applying each plan’s limits and stopping abuse. If you have a plan or a vision pack, we also need the record to give you what you bought. The record starts the first time the app contacts our server, which is before you agree to sharing.

Depending on where you live, you may have the right to ask what we hold about you, to correct it, to delete it, to get a copy, to limit how we use it and to object to how we use it. To ask, email us at the address below with your App Store order number. We handle these requests by hand, so they can take some time. A request can reach only your account record. What went to Anthropic and Runware carries no account number, so we cannot find it or have it removed for you. If you never bought anything, we cannot find your record from an email, as explained under What GhostLab keeps.

Deleting your record also removes any vision pack balance, and we cannot restore it. It does not cancel a subscription, so cancel that in your Apple Account settings if you want the charges to stop. After we delete your record, the app cannot get visions on your phones until you delete and reinstall it, and using it again starts a new record.

You can also complain to your local data protection authority. The app does no tracking, so it does not respond to Do Not Track signals.

Changes

If our practices change, we will update this page and the effective date above before the change takes effect. If the list of AI services changes, we will update this page first, and the next version of the app will ask your permission again. A phone on an older version is asked once it updates.

Contact

Privacy questions about GhostLab: Spirit Vision are welcome at [email protected]. GhostLab: Spirit Vision is published by Jack F Miller, doing business as Signal x Noise, who is responsible for the data described on this page.