Privacy Policy

GhostRelay ("we," "our," or "us") operates the ghostrelay.me website and email forwarding service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

We are committed to protecting your privacy. Our business model is built on privacy — we have no incentive to collect or sell your data.

We use the information we collect solely to:

• Forward emails from your aliases to your real email address
• Authenticate you when you log into your account
• Display forwarding statistics in your dashboard
• Send you critical service notifications (e.g., security alerts)
• Prevent abuse of our service (rate limiting, spam detection)

When an email arrives at one of your aliases, we process it in real-time:

Emails are processed in-memory and are never written to disk or stored in any database. We operate as a pure relay — no email content is ever retained.

We implement industry-standard security measures:

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Passwords are hashed with bcrypt (cost factor 12)
• Authentication tokens are cryptographically signed JWTs
• Infrastructure runs on Cloudflare's global edge network
• Rate limiting protects against brute force attacks
• Regular security audits and penetration testing

We retain your account data for as long as your account is active. When you delete your account:

• All aliases are immediately deactivated
• Your personal data is permanently deleted within 30 days
• Forwarding statistics are anonymized and aggregated
• Backups containing your data are purged within 90 days

We use minimal third-party services:

We do NOT use Google Analytics, Facebook Pixel, or any advertising trackers.

Under GDPR and CCPA, you have the right to:

• Access — Request a copy of all data we hold about you
• Rectification — Correct any inaccurate personal data
• Erasure — Request permanent deletion of your account and data
• Portability — Export your data in machine-readable format (CSV)
• Objection — Object to processing of your personal data
• Restriction — Request limitation of processing

To exercise any of these rights, contact us at privacy@ghostrelay.me. We respond within 30 days.

We use only essential cookies:

• Authentication token — Keeps you logged in (localStorage)
• Theme preference — Remembers your light/dark mode choice

We do not use any tracking cookies, advertising cookies, or third-party cookies.

Our service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it immediately.

We may update this policy from time to time. Significant changes will be communicated via email notification to registered users. The "Last updated" date at the top indicates when this policy was last revised.

For privacy-related questions or concerns: