Skip to content

Privacy policy

Last updated: 15 October 2026

The short version

  • We only use your email to sign you in. Nobody else ever sees it.
  • Your reports are not linked to you anywhere on the site.
  • We keep a scrambled version of your IP address for 90 days to stop spam, then delete it.
  • We don't sell your data and we don't show ads that track you.
  • You can ask us to show, fix, or delete your data at any time.

This Privacy Policy explains how the Ghosted team (“we”) processes personal data when you use Ghosted. We designed the Platform to collect as little as possible. We intend to act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and to comply with the Information Technology Act, 2000 and rules made under it.

1. Summary

  • Your email is used only to sign you in. It is never shown publicly and never returned by any public API.
  • Reports are published without any link to your account. Not even your random handle appears on them.
  • We store a salted, one-way hash of your IP address with each submission, for abuse prevention only, and delete it after 90 days.
  • We don't sell personal data and don't run third-party advertising trackers.

2. What we collect

Account data

  • Email address: to send one-time sign-in codes. Stored by our authentication provider.
  • Random handle (e.g. Candidate_4821), role (user/admin), strike and ban status.

Content you submit

  • Reports: company, role, month/year, round reached, outcome, issues, rating, and your text.
  • Flags you raise, company claims (job title, optional message, and the domain of your email, not the full address), and official replies.

Grievance and legal requests

  • Name, email, organisation (optional), report link, and details you provide, so we can respond.

Technical data

  • A salted SHA-256 hash of your IP address when you submit a report. We cannot reverse it to your IP.
  • Essential cookies to keep you signed in. Your theme preference is stored in your browser.
  • Standard server logs kept by our hosting providers for security and reliability.

3. Why we use it (purposes and legal basis)

  • To provide your account and the Platform (your consent and our legitimate use of data you voluntarily provide).
  • To moderate content, enforce our rules, and prevent abuse such as mass false reporting.
  • To respond to grievances, takedown requests, and legal obligations, including lawful orders from authorities.

4. Who can see what

  • The public: published report content and aggregate statistics only. No account identifiers.
  • Companies: the same as the public. Verified representatives see no additional user data.
  • Moderators: report content plus the author's random handle and strike history. Moderators do not see email addresses in the admin panel.
  • Service providers: our database/authentication provider (Supabase) and hosting provider (Vercel) process data on our behalf under contract. Data may be processed outside India where permitted by law.
  • Authorities: we may disclose data when required by applicable law or a valid legal order, after reviewing its validity.

5. Retention

  • Account data: while your account exists.
  • Reports: until withdrawn or removed; moderation records may be kept for up to 3 years for legal and dispute purposes.
  • IP hashes: 90 days.
  • Grievance records: as required under the IT Rules (at least 180 days after resolution) or longer if required by law.

6. Your rights

Subject to the DPDP Act and other applicable law, you can:

  • access a summary of the personal data we hold about you;
  • correct or update it;
  • withdraw your reports at any time from My reports;
  • request erasure of your account;
  • withdraw consent (this may mean you can no longer use the Platform);
  • nominate another person to exercise your rights in case of death or incapacity;
  • raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Use the grievance form (type: Privacy request) or email yourproblems98@gmail.com.

7. Security

We use row-level security in our database so public pages can only read anonymised views, encryption in transit, and least-privilege access for moderators. No system is perfectly secure. We will notify affected users and authorities of personal data breaches as required by law.

8. Children

The Platform is not intended for anyone under 18. We do not knowingly collect data from children.

9. Changes

We will post updates here and notify you of material changes.

10. Contact

Ghosted Support Team, yourproblems98@gmail.com.