Privacy Policy

Overview

Ghost ("we," "us," or "our") operates the website ghostsearch.dev (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Service. Ghost is a product of morninglab.

By using Ghost, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access the Service.

Information We Collect

Information You Provide

Email address. If you sign up for price alerts, we collect your email address. This is the only personally identifiable information we request. No account, password, or username is required.

Contact form submissions. If you contact us through the contact form, we collect the name, email, subject, and message you provide.

Information Collected Automatically

Usage data. When you visit Ghost, our servers automatically log standard request information including your IP address, browser type, referring URL, pages visited, and timestamps. We use one-way cryptographic hashing (HMAC-SHA256) on IP addresses before storage -- we do not store raw IP addresses.

Click data.When you click through to a retailer from Ghost, we record the click event (product, caliber, retailer, timestamp, hashed IP) for analytics and to support our affiliate business model. We do not track your activity on the retailer's website.

Cookies. Ghost does not use tracking cookies, advertising cookies, or third-party analytics cookies. We may use essential cookies for basic site functionality (e.g., session management for alert preferences).

How We Use Your Information

We use the information we collect to:

• Send you price drop alerts for calibers you have subscribed to
• Respond to contact form inquiries
• Analyze aggregate usage patterns to improve the Service
• Enforce rate limits and prevent abuse
• Generate anonymized, aggregate analytics (e.g., popular calibers, search trends)

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Third-Party Services

Cloudflare. Our Service is hosted on Cloudflare Workers. Cloudflare may process requests through their global network. See Cloudflare's Privacy Policy.

Resend. We use Resend to deliver email alerts. Your email address is shared with Resend solely for delivery purposes. See Resend's Privacy Policy.

Retailer links.When you click through to a retailer, you leave Ghost and are subject to that retailer's privacy policy. We are not responsible for the privacy practices of third-party retailers.

Data Retention

Email addresses are retained as long as your price alert subscription is active. You can unsubscribe at any time using the link in any alert email, and your email will be removed.

Click analytics and usage logs are retained in aggregate form. Hashed IP data is retained for up to 90 days for rate limiting and abuse prevention, then purged.

Contact form messages are retained as long as needed to respond to your inquiry.

Data Security

We implement industry-standard security measures including HTTPS encryption, Content Security Policy headers, HMAC-hashed IP addresses, and rate limiting. Our database is hosted on Cloudflare D1 with encryption at rest. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Delete your personal data (email address and associated alert subscriptions)
• Opt out of email communications at any time via the unsubscribe link
• Request a copy of your data in a portable format

To exercise any of these rights, email us at hi@ghostsearch.dev. We will respond within 30 days.

California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Categories of Personal Information Collected

In the preceding 12 months, Ghost has collected the following categories of personal information:

• Identifiers: Email address (if you subscribe to alerts or submit a contact form)
• Internet or other electronic network activity: Browsing history on Ghost (pages visited, search queries, click-through events), browser type, and hashed IP address

Ghost does not collect Social Security numbers, financial account information, precise geolocation, biometric data, or any categories of sensitive personal information as defined under CPRA.

Sale and Sharing of Personal Information

Ghost does not sell your personal information. Ghost does not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

Your California Privacy Rights

As a California resident, you have the right to:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information that we maintain about you.
• Right to Opt Out of Sale or Sharing: Ghost does not sell or share personal information, so no opt-out is necessary. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link.
• Right to Limit Use of Sensitive Personal Information: Ghost does not collect sensitive personal information as defined under CPRA.
• Right to Non-Discrimination: We will not deny you services, charge different prices, provide a different quality of service, or retaliate against you for exercising any of your CCPA/CPRA rights.

How to Submit a Request

To exercise any of these rights, contact us at hi@ghostsearch.dev or through our contact form. You may also designate an authorized agent to submit a request on your behalf. If you use an authorized agent, we may require proof of written authorization and verification of your identity.

We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need additional time, we will notify you of the extension and the reason, up to a maximum total of 90 days.

Verification

To protect your privacy, we will verify your identity before fulfilling a request. For email-based requests, we will verify by sending a confirmation to the email address associated with your alert subscription. If we cannot verify your identity, we may deny the request and explain why.

Financial Incentives

Ghost offers free price alert emails in exchange for providing your email address. You may opt out at any time via the unsubscribe link in any email. We do not assign monetary value to your personal information. The price alerts service is provided at no cost regardless of whether you provide an email address — all price comparison, signal, and search features are available without subscribing.

Children's Privacy

Ghost is not directed to individuals under 18. We do not knowingly collect personal information from children. Ammunition purchasing is restricted to adults in all US jurisdictions. If we learn we have collected data from a minor, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

Contact

If you have questions about this Privacy Policy, contact us at hi@ghostsearch.dev or through our contact page.