Ghost Setter ← Back to site

Privacy Policy

Last updated 9 September 2026

Ghost Setter is operated by The Nickl, LLC ("we", "us"). This policy explains what data the service handles, why, who else touches it, and how to get it deleted.

Two different groups of people appear in this policy, and they are treated differently:

Coaches — our customers, who connect their own accounts to the service.
Leads — people who message a coach on Instagram. They are not our customers. They are the coach's contacts, and we process their messages on the coach's behalf.

What we collect

Data	Why
Coach account Name and email address from Google Sign-In	To sign the coach in and to know whose dashboard is whose. We do not receive or store a Google password.
Google Calendar Free/busy times, event details on the connected calendar, and events we create	So the service only offers times the coach is genuinely free, and can put a booked call on their calendar. See the section below.
Instagram conversations Message text, Instagram username, first name, subscriber tags, and follower count where the coach has mapped it — received via ManyChat	To generate a reply in the coach's voice, decide whether a conversation is a lead, and keep the conversation's history so it does not repeat itself.
Phone numbers Where a lead gives one in the conversation	Passed to the coach so they can text the lead about the call. We do not send text messages ourselves.
Historic DM exports A coach's own past Instagram conversations, provided by them during setup	Read once to build that coach's writing style. See "Voice packs" below.
Stripe Aggregate payment totals and subscription counts, read-only	To show revenue figures on the coach's own dashboard. We never receive card numbers or full payment details, and we cannot move money.
Operational records Timestamps, error logs, model usage counts	To keep the service running and to show the coach what it cost.

Google user data

Ghost Setter's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we request, and why

Sign-in only (openid, email, profile) — to authenticate the coach. Nothing else.
Calendar — to read free/busy so the service never offers a time the coach is busy, to read events so the coach can see their own schedule inside our dashboard, and to create and update the calls it books.

How it is used, stored and shared

Used only to provide the scheduling features described above, and only for the coach whose account it came from.
Stored for as long as the coach keeps Calendar connected. The Google refresh token is encrypted at rest and never leaves our servers.
Shared with nobody. Google Calendar data is not sold, not transferred, not used for advertising, and not used to train any AI or machine-learning model — including ours and anyone else's.
Not read by humans, except where a coach explicitly asks us to look at something to fix a problem, or where the law requires it.

Turning it off

A coach can disconnect Google Calendar at any time from the Connections page in their dashboard, which deletes the stored token immediately. They can also revoke our access directly at myaccount.google.com/permissions. Either stops all calendar access at once.

Voice packs

During setup a coach may give us an export of their own past Instagram conversations. We read it once to build a "voice pack" — a set of phrasings and patterns describing how that coach writes.

The export itself is not published, not committed to any code repository, and not shared with other coaches.
The voice pack holds writing style. It is not a copy of the coach's conversations and does not carry their clients' names or messages.
A coach's voice pack is used only for that coach's own account.
On request, or on termination, the export and the voice pack are deleted.

Who else touches this data

We use a small number of providers to run the service. Each receives only what it needs:

Provider	What it receives
Anthropic	Conversation text, to generate replies. Sent through their business API, which does not use the content to train their models.
ManyChat	Delivers the messages to and from Instagram. The coach holds their own ManyChat account and their own agreement with them.
Google	Sign-in and Calendar, as described above.
Stripe	We read from the coach's own Stripe account. We send it nothing.
Discord	Receives the notifications a coach asks for, which include a lead's Instagram handle and message text.
Supabase, Railway, Vercel	Database and hosting.

We do not sell personal data. We do not use it for advertising, we do not share it between coaches, and we do not use coach or lead data to train AI models.

How long we keep it

Conversations and bookings — for as long as the coach's account is active, because the service needs the history to avoid repeating itself.
Google tokens — until Calendar is disconnected, then deleted.
Connected credentials (Stripe, Discord and similar) — until disconnected, then deleted.
After an account closes — coach and lead data is deleted within 30 days, other than anything we must keep for tax or legal reasons.

Security

All traffic is encrypted in transit (HTTPS).
Third-party tokens and API keys are encrypted at rest and are never returned to a browser — a coach only ever sees the last four characters of their own key.
Dashboard access requires Google Sign-In against an address we have added by hand. It is an invitation list, not an open sign-up.
Sessions are stored as one-way hashes, so read access to our database is not the same as being able to sign in.

No system is perfectly secure, and we will not pretend otherwise. If something goes wrong, we will tell affected coaches promptly and plainly.

Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, or object to how it is used. Email privacy@ghostsetter.app and we will action it.

If you are a lead — someone who messaged a coach — and you want your conversation deleted, you can email us directly and we will remove it, or ask the coach and they can do the same.

Children

Ghost Setter is a business tool for coaches and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and it will be deleted.

Changes

If we change this policy in a way that materially affects how data is handled, we will update the date at the top and tell active coaches by email.

Contact

The Nickl, LLC
privacy@ghostsetter.app

Note for review: this document describes the system accurately as built, but it has not been reviewed by a lawyer. Have one read it before relying on it commercially.