Privacy

Last updated: July 2026

What we collect

Nothing about you. Ghostroom has no accounts — no email, no phone number, no password. Your nickname is stored in your browser only and never persisted server-side. This site and the app run no analytics, no tracking scripts, and no advertising of any kind.

What the server stores

Room content only, and only until the room expires: messages (the 500 most recent per room), uploaded images and voice messages, reactions, and room settings. Every room is deleted in full — messages, media, and all state — exactly 48 hours after it was created. Deletion is automatic and unconditional.

Voice calls

Call audio is peer-to-peer between browsers (WebRTC). It never passes through or gets stored on our servers.

Passcodes

Optional room passcodes are hashed in your browser before being sent; the server stores and compares only the digest.

Infrastructure

Ghostroom runs on Cloudflare (Workers, Durable Objects, R2). Standard operational processing by Cloudflare — such as DDoS protection and the Turnstile bot check on room creation — applies; see Cloudflare's privacy policy. Messages are encrypted in transit (TLS) and stored server-side until room expiry; they are not end-to-end encrypted.