LimeGhost
Start free trial

Privacy Policy

LimeGhost ("we", "us") is a content workspace with an AI companion, built and operated from Switzerland. We comply with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). This page explains what we collect and why — in plain language, because there is nothing to hide. Questions any time: support@limeghost.com.

What we collect

  • Account data — your email address and optional name. Sign-in is passwordless: we email you a one-time code, so we never store a password.
  • Your content — everything you put into a workspace: ideas, drafts and posts, diary entries, tasks, uploaded and generated images, themes, style guides, channels, calendar entries and your projects' settings (including each project's time zone). Also your conversations with the companion — the messages, the tools it ran and what they returned.
  • Files you attach — files on an idea, a diary entry or a post (up to 100 MB each), plus the text we extract from PDFs and documents so the companion can read them.
  • Connected accounts — when you connect a channel to an external system (your blog's CMS, Bluesky, LinkedIn, X, Mastodon, Threads or YouTube), we store the credential that reaches it — an API key, or an OAuth access and refresh token — encrypted at rest. We also store the account's handle or id, so you can tell two connections apart. A connection belongs to the person who created it and to the one project they created it in.
  • Content we mirror back — if you point a channel at an account that already has posts, LimeGhost can import those posts and their images into the project calendar as a record of what went out.
  • Research you run — the topics you research, the URLs fetched, and the text extracted from those public pages.
  • Emails you send us — mail to an @limeghost.com address is stored, raw message included, as a thread together with our replies, so we can actually follow up.
  • Usage data — product analytics via PostHog (EU cloud), which we associate with your user id and email address once you're signed in; your sessions' IP address and browser user agent; and server logs (including IP addresses) to keep the service running and secure.
  • Billing data — when you buy a plan or credits, Stripe collects your name, email, billing address and card details; we never see or store the full card number. We keep the Stripe customer and subscription ids, your plan, the amounts and dates of invoices, and a ledger of the credits each workspace receives and uses.
  • Tester applications — if you apply on our testers page, the name, email, links and description you send us, and the platforms you post on.
  • Bot protection — the sign-in form runs Cloudflare Turnstile, which receives your IP address to tell a person from a script.

We do not buy data about you, and we never sell your data to anyone.

How we use it

We use your data to run LimeGhost: authenticate you, generate and store your drafts and images, run research, publish posts to the channels you connected, send transactional emails (sign-in codes, workspace invitations, notifications), answer your support mail, understand how the product is used, and prevent abuse. The legal bases are performance of our contract with you, our legitimate interest in operating and improving the service, and legal obligations.

AI processing

When the companion writes, revises, reads an image or researches something, the relevant content — your prompt, the draft, the strategy and diary context it needs, the images or pages it reads — is sent to the AI model provider behind that step: currently Google (Gemini models), OpenAI (GPT models and image generation) and Anthropic (Claude models) — which one depends on the model your project's writing settings or the companion use. We may add or change model providers as better models appear; the same rules apply to them. We never use your content to train AI models, and we use API terms under which providers process your inputs to serve your request, not to train their public models.

We keep an audit record of every AI call — the prompt that went out, the response that came back, the tokens used and what it cost us. It's how we debug a bad answer and keep spend under control; it is not used for training.

Web research

Research runs from our servers, not your browser. LimeGhost searches for and fetches public web pages, either through a direct request or through Jina's reader and search APIs when a page needs rendering. We only fetch what is publicly reachable, and we store the page text and its source URL with the research job so the report can cite it.

Connected accounts and publishing

A connection is a narrow grant, not a login. Your password for a social network is typed on that network's own site and never reaches us. We store the token it gives us encrypted at rest, and we ask for the smallest grant that does the job — we never request access to your direct messages on any network, and we never read anyone else's feed. Per network:

  • Bluesky — create and delete our own feed posts, and upload the images and videos attached to them. Disconnecting revokes the grant itself.
  • LinkedIn — post as you, and read your name and picture. LinkedIn offers us no revoke endpoint, so disconnecting deletes the token on our side; withdraw it in LinkedIn's own settings if you want it gone at their end too.
  • X — read your posts and their performance, read your profile, upload media, and create and delete posts. Disconnecting revokes the grant itself.
  • Mastodon — read your account and your statuses, upload media, and create and delete statuses on the one server you connect. Disconnecting revokes the grant on that server.
  • Threads — we ask Meta for six permissions: threads_basic (your profile name, username and picture), threads_content_publish (publish the posts you schedule), threads_manage_replies (a thread's later parts are replies to its first post), threads_read_replies (read those replies back, to import your own threads), threads_manage_insights (your posts' views, likes, replies, reposts and quotes, and your follower count) and threads_delete (take down a post LimeGhost published, when you ask). The token is refreshed automatically while the connection is in use. Disconnecting deletes it on our side; to withdraw it at Meta's end too, open Threads → Settings → Account → Website permissions and remove LimeGhost.
  • YouTube — see the YouTube API Services section below.

We publish only what you ask us to — by pressing publish, or by scheduling a post, which arms it for the hourly publish tick. When a network's account is connected, we also read back your own posts on it (to show what went out in your calendar) and their public counters (for analytics).

Google API Services

When you connect Google Search Console, LimeGhost reads your Search Console data (search performance, index status) with the read-only permission you grant and stores it to show you how your content performs — including beyond the 16 months Google keeps it. LimeGhost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never use this data for advertising, never sell it, and never use it to train generalised AI models. You can disconnect at any time from Settings → Integrations; disconnecting revokes LimeGhost's access in Google and deletes the stored grant.

YouTube API Services

LimeGhost uses YouTube API Services. When you connect a YouTube channel, Google asks you for two permissions: youtube.force-ssl (upload the videos you schedule, set their custom thumbnail and playlist, list your channel and its playlists, and delete a video LimeGhost published when you ask) and yt-analytics.readonly (your videos' views, watch time, likes, comments and shares, and your subscriber count). We read your channel's name, handle and picture to show which channel is connected, and — if you sync past posts — the titles, descriptions and length of your public and unlisted uploads.

By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

  • Refreshing and deleting YouTube data. We re-check every stored video at least every 30 days: data about a video that no longer exists is deleted, and imported titles and descriptions are refreshed. Disconnecting the channel in LimeGhost (Settings → Channels) revokes our access at Google and deletes the YouTube data we stored — analytics, subscriber history and imported posts — within 7 days (usually within minutes). Posts you wrote in LimeGhost stay in your calendar.
  • Revoking access at Google. You can also remove LimeGhost at security.google.com/settings/security/permissions (shown here as text so you can check the address: https://security.google.com/settings/security/permissions). When we notice the access is gone, we delete the stored YouTube data within 30 days.
  • Questions about how we handle YouTube data: support@limeghost.com.

Where your data lives

Your database, uploads and generated images live on Neon and AWS in Frankfurt, Germany (eu-central-1). The web app is served by Fly.io from Frankfurt. Some providers (the AI model providers, Jina, Cloudflare) process data outside the EU and Switzerland, including in the United States; these transfers are covered by the EU Standard Contractual Clauses and the EU–US / Swiss–US Data Privacy Framework where applicable.

Who we share it with

Only the processors we need to run the service: AWS (hosting, storage, email), Fly.io (web hosting), Neon (database), Stripe (payments, the billing portal and invoices — Stripe Payments Europe, Ltd.), Google, OpenAI and Anthropic (AI models), Jina (page fetching and search), PostHog (analytics, EU), Cloudflare (bot protection on the sign-in form), and Slack (internal alerts, which is where your support mail reaches a human). Each processes data only on our instructions. Beyond that we disclose data only when the law requires it.

Publishing is different: when you publish a post to a connected channel, its content goes to that platform, under that platform's own terms and privacy policy, and becomes as public as that platform makes it.

Workspaces and projects

Content in a workspace is visible to the members of that workspace — that is the point of a shared calendar held in review. Invite people accordingly. Nothing you create in LimeGhost is published on limeghost.com, and there is no public gallery: content leaves the workspace only through a channel you connected.

Retention

We keep your data for as long as your account exists. Email support@limeghost.com to delete your account, and your personal data and content are deleted within 30 days (backups roll off shortly after). Posts already published to an external platform are not ours to remove — delete them there, or use LimeGhost's takedown on the post while the connection still exists. Records we must keep by Swiss law are kept for as long as it requires, then deleted — in particular, billing records (invoices, payments and the credit ledger) are kept for 10 years, as Swiss accounting law requires (Art. 958f CO), even after the account is deleted. Workspaces that stay without a plan for 6 months are deleted, with their content, after email warnings 30 and 7 days before. Tester applications are deleted 12 months after our last contact with you. YouTube data follows the YouTube API Services rules above. If you remove LimeGhost from your Threads account, Meta tells us and we delete that connection — see Data deletion for exactly what that removes.

Cookies

We use only essential cookies and analytics: the sign-in session cookie, your language, and small preferences the app remembers for you (selected workspace, whether the sidebar is collapsed, 12- or 24-hour clock). If you sign up from the pricing page, a short-lived cookie (lg_trial_tier) remembers the plan you picked until your account is created; it expires after 30 minutes. No advertising trackers, no third-party ad cookies.

Email you get from us

Sign-in codes, workspace invitations and other mail that is part of using the product are transactional — you can't turn them off while you have an account. That includes account and billing notices: a trial or plan about to end or ended, a workspace over its plan's limits, deletion warnings, and the payment receipts and invoices Stripe sends. They are part of the service, not marketing. Product news and tips are optional: switch them off under Settings → Notifications.

Your rights

Under the GDPR and FADP you can access, correct, export or delete your data, object to processing, and withdraw consent at any time. Email support@limeghost.com and we'll respond within 30 days. You can also complain to your local data protection authority or the Swiss FDPIC.

Changes

If we make material changes to this policy, we'll update the date above and notify you by email or in the app before the changes take effect.