Ghostli Terms of Service

Last updated: June 2026 · Effective immediately upon use of the Service.

1. Introduction

Ghostli is a privacy-first AI-powered developer tool with token-based access, local encrypted app data, and optional workspace features. By using the Service, you accept these Terms of Service in full.

These Terms cover everything: access, payments, delivery, refunds, data handling, and operator anonymity. Read them before purchasing or using the Service.

2. Definitions

"Service" / "Ghostli" - the desktop application, API interfaces, and infrastructure operated under this domain; "Operator" - the person or entity running the Service; "User" - any person or entity accessing the Service; "Token" - an 8-digit access identifier used to authenticate and limit usage; "User Content" - data, prompts, code, files, or materials submitted to the Service.

3. Access and Token System

Access is provided via tokens rather than traditional username/password accounts. Tokens are validated against hashed server records. To provide access control, usage limits, and simultaneous-device management, Ghostli processes token status, package type, device identifiers, active-session state, heartbeat timestamps, and usage counters. The User is responsible for safeguarding their token. Lost or exposed tokens should be rotated immediately via support channels.

4. Permitted Use

The Service is intended for development, educational, and research purposes, in compliance with applicable laws. Commercial use is permitted provided it does not violate these Terms or third-party rights.

5. Prohibited Activities

Prohibited uses include: illegal purposes; creating or distributing malware; infringing intellectual property, privacy, or security; de-anonymization attempts or circumvention of security controls; abuse or evasion of usage limits. Violations may result in immediate restriction or termination of access without refund.

5A. User Conduct and Abuse Controls

No General Monitoring Obligation. Ghostli does not routinely review every prompt, file, or output. However, Ghostli may process operational signals and technical metadata required to provide the Service, protect infrastructure, enforce limits, investigate abuse, respond to lawful requests, or maintain payment and access systems.

Privacy-by-Design Architecture. The Service is designed to minimize account identity, reduce profiling, redact sensitive request fields from technical logs where possible, and store chat history locally in the desktop app. This does not mean no data is processed. AI requests, selected workspace content, payment data, token data, usage counters, and security metadata may be processed where necessary.

Abuse Controls. Ghostli may rate-limit, suspend, block, rotate, or terminate access tokens, payment sessions, devices, or service access where abuse, security risk, legal risk, suspicious payment activity, or Terms violations are suspected.

User Responsibility. The User bears sole and full responsibility for all actions taken using the Service, including compliance with applicable laws, regulations, and third-party rights.

6. Payments and Token Delivery

6A. Valid Payment

A payment is considered valid when all of the following conditions are met:

• The exact amount specified in the invoice or checkout flow was transmitted - no partial payments.
• For cryptocurrency: funds were sent to the exact wallet address generated for the specific order, the transaction received sufficient network confirmations, and the payment was submitted within the invoice expiry window displayed at checkout.
• For card/BLIK: the transaction was completed successfully through the checkout flow without error, decline, or subsequent chargeback.

Payments that do not satisfy all of the above conditions are considered invalid. Ghostli is under no obligation to deliver a token in response to an invalid payment. Invalid payments include, but are not limited to: incorrect amounts, funds sent to an expired or unrelated address, transactions submitted after invoice expiry, and payments made outside the provided checkout flow.

6B. Token Delivery

For each valid payment, Ghostli will deliver the corresponding access token. Delivery is typically automated and occurs within a short period following payment confirmation. If a valid payment was received and no token has been delivered within a reasonable timeframe, the User should contact support through the channels listed in Section 26, providing the transaction hash or payment confirmation reference. Ghostli will investigate and, where a system-side failure is confirmed, deliver the token or issue an equivalent replacement.

6C. No Refunds

All purchases are final. Ghostli does not offer refunds, chargebacks, or compensation under any circumstances, including but not limited to: change of mind, unused token allocation, accidental purchase, dissatisfaction with AI output quality, model changes, or service modifications. Cryptocurrency transactions are irreversible by nature. Users are solely responsible for verifying payment details before transmitting funds.

Refunds are not available for invalid payments as defined in Section 6A. If an incorrect amount or address was used, contact support immediately - resolution cannot be guaranteed and depends entirely on technical feasibility and network state at the time of contact.

6D. Cryptocurrency Compliance

The User is solely responsible for ensuring all cryptocurrency transactions comply with applicable AML/CFT regulations including MiCA, the Travel Rule, and the Polish AML Act. Users are responsible for their own tax reporting obligations, including any applicable capital gains tax on cryptocurrency transactions. Ghostli does not provide exchange or custody services.

7. Privacy and Data Minimization

Ghostli is built around data minimization. The Operator prioritizes your privacy through the following design choices:

• No traditional accounts. You identify with an 8-digit token, not an email/password pair.
• Local encrypted app data. Chat sessions and settings are encrypted locally on your device using a password-derived key.
• No advertising profiles. Ghostli does not sell User data or build profiles for advertising purposes.
• No AI training on User Content. Ghostli does not use your prompts, code, or files to train or fine-tune Ghostli-owned models.
• Redacted logs. Sensitive request fields are redacted from technical/operational logs where possible.
• Reverse API privacy layer. Ghostli's API is designed to operate as a privacy-preserving reverse API / proxy layer between the User and upstream AI or infrastructure providers. Where technically feasible, Ghostli avoids forwarding direct User identifiers such as access tokens, payment emails, raw IP addresses, stable fingerprints, payment details, or device identifiers to upstream AI providers as part of ordinary model requests.
• Technical anonymization. Ghostli anonymizes, truncates, hashes, redacts, aggregates, or otherwise minimizes all User data that is technically possible and operationally reasonable to anonymize, including IP addresses, device/session identifiers, browser or app fingerprints, user-agent data, rate-limit signals, and similar technical metadata. Some raw technical data may be processed transiently where required for routing, security, abuse prevention, payment confirmation, troubleshooting, or legal compliance before being deleted, anonymized, or reduced.
• No long-term sensitive retention by default. Ghostli does not intentionally retain sensitive User data long-term unless retention is necessary for access control, token delivery, payment handling, fraud or abuse prevention, security, legal compliance, or dispute resolution.
• Privacy-conscious email use. For paid purchases, if the checkout flow requires or allows an email address, the User may provide any reachable email address they control, including a privacy-preserving alias or disposable email address, subject to payment provider rules. Ghostli encourages Users to use safe, privacy-conscious email addresses rather than exposing unnecessary personal identity.
• Free token email retention. For free-token or free-subscription claims, Ghostli must store the submitted email address because the subscription type is limited to one free token per User. This email is used to prevent repeated free-token claims and maintain fairness of the free access system.

Ghostli may process operational data required to run the Service: token status, package type, device/session state, usage counters, rate-limit signals, payment/session status, and User Content required to generate AI responses. AI requests are processed by upstream AI providers; their data-handling terms apply to that processing. Where possible, Ghostli is designed to avoid sending account identity, token, device ID, IP address, fingerprint, payment email, or payment details to AI providers as part of ordinary model requests.

8. Data Processing and Retention

We process operational data based on necessity for contract performance, payment delivery, fraud prevention, abuse prevention, service stability, and legitimate security interests. Retention is limited to what is operationally needed for access, billing, usage limits, troubleshooting, security, legal compliance, and dispute handling. Older usage, session, and device records may be deleted, deactivated, aggregated, or anonymized according to operational needs.

Ghostli is designed not to keep sensitive User data long-term unless there is a specific operational, security, payment, legal, or abuse-prevention reason to do so. IP addresses, fingerprints, device identifiers, session identifiers, and similar technical metadata are anonymized, minimized, rotated, or deleted where technically feasible and consistent with Service security.

Email addresses provided during paid checkout may be processed by payment providers and may be used for token delivery, payment confirmation, dispute handling, and support. Users are encouraged to use safe, privacy-conscious, reachable email addresses. For free-token or free-subscription access, the submitted email address must be retained for as long as reasonably necessary to enforce the one-free-token-per-User rule and prevent repeated claims.

9. Security and Encryption

The desktop app encrypts saved Ghostli app data locally using a password-derived key. Communications with the Service and payment providers use transport encryption where supported. AI requests and selected workspace content must still be processed by Ghostli and/or upstream AI providers to generate responses. No system guarantees 100% security or anonymity. Users must follow best practices: secure environments, up-to-date software, careful workspace selection, and token protection.

10. License and Intellectual Property

We grant a non-exclusive, non-transferable license to use the Service under these Terms. User Content remains the User's property; the User warrants they have rights to it. Ghostli receives a limited right to technically process User Content solely to provide the Service. All Ghostli software, UI, and trademarks remain exclusive property of the Operator.

11. Service Continuity

Ghostli is operated as an ongoing service. The Operator intends to maintain service continuity and will provide reasonable advance notice (minimum 14 days where possible) via the Discord server and/or email to affected token holders if the Service is to be discontinued or substantially changed in a way that affects purchased plans.

In the event of a planned discontinuation, active token holders with remaining subscription time will be notified and given the opportunity to use their remaining tokens during a wind-down period. The Operator will make reasonable efforts to honor this commitment, but cannot guarantee continuity in cases of force majeure, legal compulsion, or unforeseen technical failure.

The Service may be updated, modified, or temporarily suspended for technical, operational, or security reasons at any time. Planned maintenance will be communicated through available channels where feasible.

12. Liability and Disclaimers

The User is fully responsible for their actions and User Content. Ghostli is not liable for indirect, special, or consequential damages, lost profits, downtime, data loss, reputational harm, or substitute costs. The Service is provided "AS IS" and "AS AVAILABLE," without warranties of any kind. Ghostli's aggregate liability is limited to fees paid in the last three (3) months, to the maximum extent permitted by law.

13. Termination

Access may be terminated immediately for ToS violations, security risks, or upon lawful request by authorities, without refund. Users may cease use at any time by discontinuing token usage. There is no cancellation mechanism for prepaid plans; unused token allocations are not refunded.

14. Immediate Suspension Rights

Ghostli reserves the right to immediately and irrevocably block or suspend any access token and/or associated cryptocurrency payment address without prior notice and without refund in case of: actual or suspected breach of these Terms; actual or suspected abuse; actual or suspected illegal activity or activity contrary to public policy; or actual or suspected suspicious payment activity.

15. Changes to Terms

We may update these Terms at any time. Changes take effect upon publication to this page. Continued use of the Service after changes constitutes acceptance. Significant changes will be announced on the Discord server where feasible.

16. Operator Anonymity

The Operator of Ghostli maintains organizational privacy for security and personal safety reasons. The identity of the Operator is not publicly disclosed. This does not affect the enforceability of these Terms or the Operator's obligations under them.

This arrangement does not limit any mandatory disclosures required by applicable law, payment providers, hosting providers, courts, or regulators. Where legally required to disclose, the Operator will comply with such obligations.

Users who require a fully identified legal counterparty for their purposes should consider whether this Service is appropriate for them.

17. Indemnification

The User shall indemnify and hold harmless Ghostli and its Operator from third-party claims arising from the User's breach of these Terms or applicable law, including reasonable legal fees.

18. Governing Law and Jurisdiction

These Terms are governed by the laws of the Operator's principal place of business, excluding conflict-of-law rules. Courts at that location shall have exclusive jurisdiction unless mandatory law provides otherwise.

19. Force Majeure

The Operator is not liable for failures caused by force majeure, including infrastructure outages, natural disasters, war, government actions, or third-party service failures beyond the Operator's reasonable control.

20. Fair Use and Limits

Usage limits (tokens, requests, bandwidth, compute) are applied per plan as described on the pricing page. Abuse or circumvention of limits may result in restriction or termination. Limits are per-user and may not be pooled or transferred.

21. Beta Features and Model Changes

Beta features may be unstable and may change or be discontinued at any time. AI models may be modified to improve quality, performance, or safety. Model availability is not guaranteed for any specific model or version.

22. AI Output Limitations

AI-generated outputs may be incomplete, inaccurate, offensive, or harmful and do not constitute professional advice of any kind. Users must independently verify outputs before relying on them.

23. Export Controls and Sanctions

Users must comply with all applicable export control laws, sanctions, and trade restrictions in their jurisdiction.

24. Vulnerability and Abuse Reporting

Responsible disclosure of security vulnerabilities is encouraged. Report issues through the channels in Section 26. Unauthorized penetration testing or attacks against Ghostli infrastructure are prohibited and may result in immediate termination and legal action.

25. Severability and Entire Agreement

If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions remain in full force and effect. These Terms constitute the entire agreement between the User and the Operator regarding the Service and supersede all prior communications or representations.

26. Contact and Support

For questions regarding these Terms, payment issues, token delivery problems, security concerns, abuse reports, or vulnerability disclosures, contact us through:

• Discord server: ghostli (preferred fastest response)
• Email: hello@ghostli.eu

No other contact methods (phone, social media DMs, traditional mail) are monitored. For payment delivery issues, always include your transaction hash or payment confirmation reference.