Ghostpost is a service that helps businesses plan, write and publish social media posts. This policy explains what information Ghostpost collects, how we use it, who we share it with, and the choices you have. By using Ghostpost you agree to this policy.
Ghostpost is operated by Valley CTC (“we”, “us”). You can reach us about privacy at mike@valleyctc.ca. The service is available as a website at ghostpost.valleyctc.ca and through a Windows desktop application, which is a window onto the same service.
When you connect a social account, the platform gives us limited information and permission to post for you:
| Platform | What we receive and store | Why |
|---|---|---|
| Your name and member identifier, email address, an access token, the token’s expiry, and (if you have access) the company pages you administer. Permissions requested: sign-in (openid, profile, email) and posting on your behalf (w_member_social). | To identify the account you connected and to publish the posts you approve or schedule. | |
| Facebook / Instagram (Meta) | The Facebook Pages you manage, the Instagram business accounts linked to them, their names and identifiers, and access tokens. Permissions requested include listing your Pages, reading Page engagement, managing Page posts, and Instagram basic access and content publishing. | To show you which accounts are connected and to publish the posts you approve or schedule. |
We use this information only to provide Ghostpost to you. We do not use it for advertising, do not sell it, and do not combine it with data from other sources for unrelated purposes.
Payments are handled by Stripe. We never see or store your card number. We keep only your Stripe customer and subscription identifiers, your plan, and the number of business profiles (“seats”) you have purchased.
Our hosting provider and our servers record standard technical data such as IP address, browser type, requested pages, timestamps and error details. We use it to operate, secure and debug the service.
Ghostpost uses only the cookies needed to work:
We do not use advertising, tracking or analytics cookies. The desktop application also keeps a local browser profile on your computer so you stay signed in, plus downloaded update files and a small update log.
To write content, Ghostpost sends the relevant parts of your business profile (name, industry, description, audience, goals, tone, call-to-action) and the topic or instructions you provide to Anthropic’s Claude service. If you use AI video generation, your prompt is sent to xAI’s Grok video service. We send only what is needed for the request. AI output can contain mistakes, so every post can be reviewed and edited before it is published.
We do not sell your personal information. We share it only with service providers that help us run Ghostpost, and only as needed:
| Provider | Purpose |
|---|---|
| Google Cloud | Application hosting, file storage for uploaded media, scheduling and logs |
| Neon | Database hosting |
| Anthropic | AI text generation |
| xAI | AI video generation (when you use it) |
| Stripe | Payments and subscriptions |
| LinkedIn and Meta (Facebook, Instagram) | Publishing the posts you create to the accounts you connect |
Content you publish is, of course, visible on those platforms according to your settings there. We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety and security of users or the service, and in connection with a merger, sale or reorganization of the business (in which case we will make sure this policy continues to protect your data or tell you first).
Ghostpost’s servers and databases are located in the United States. If you use Ghostpost from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.
All traffic between you and Ghostpost uses HTTPS. Passwords are hashed. Access to our systems is limited, secrets are kept in a managed secret store rather than in the desktop application, and our database and storage providers encrypt stored data. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify affected users and authorities where the law requires.
Posts already published to LinkedIn, Facebook or Instagram are controlled by those platforms and are not removed by deleting your Ghostpost data; delete them on the platform if you want them gone.
Depending on where you live (for example under Canada’s PIPEDA, the EU/UK GDPR, or US state laws), you may have the right to access the personal information we hold about you, correct it, delete it, object to or restrict certain uses, withdraw consent, and receive a copy of your data. To exercise any of these rights, contact mike@valleyctc.ca. We may need to verify your identity first. You may also complain to your local privacy regulator.
Ghostpost is a business tool intended for people 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.
We may update this policy as Ghostpost changes. When we do, we will change the effective date above and, for material changes, notify you in the app or by email. Continued use after an update means you accept the revised policy.
Questions, requests or complaints about privacy: mike@valleyctc.ca
Ghostpost, operated by Valley CTC.