Privacy & safety
Privacy model
Ghostdesk is built with privacy as a core architectural principle, not an afterthought. This document explains exactly what data we collect, store, and how we protect your privacy.
Core principles
- Minimal data collection: We store only what is necessary for the service to function.
- Wallet-only identity: Your Solana wallet address is your only identifier.
- Throwaway desktops: Screenshots and files die with the sandbox. Chat and memory stay with your wallet.
- No third-party analytics: We don’t use Google Analytics or any tracking services.
- Transparent logs: Application logs never contain chat contents or sensitive data.
What we store
Persistent data (database)
| Data | Purpose | Retention |
|---|---|---|
| Wallet address | Account identifier | Until account deletion |
| Internal balance | Track prepaid credits | Until account deletion |
| Transaction signatures | Payment verification | Until account deletion |
| Usage records | Billing and metering | Until account deletion |
| Chat transcripts | Resume after sign-in | Until you clear or delete the account |
| Per-agent memory | Notes the agent saved | Until you clear them |
| Agent name, model, first task | Restore the workspace | Until the account is deleted |
| Scheduled tasks and run history | Run your schedules | Until you delete the schedule |
| Spending limits | Enforce your caps | Until account deletion |
| Vault ciphertext + padded size | Sealed vault storage (we can’t read it) | Until you delete the item |
| API key hashes | IDE / MCP auth. The secret is shown once | Until you revoke the key |
Desktop data (temporary)
| Data | Purpose | Retention |
|---|---|---|
| Screenshots | Agent vision | Desktop only |
| Files created | User work | Desktop only |
| Container state | Desktop environment | Desktop only |
What we don’t store
- Email addresses
- Passwords
- Phone numbers
- Names or personal identifiers
- IP addresses (not logged)
- Browser fingerprints
- Screenshots after the desktop ends
- API key plaintext after the one-time reveal
- Files you create after the desktop ends
- Browsing history within the sandbox
What our server can see
Being precise matters more than sounding private. While an agent runs, the following are visible to the Ghostdesk server and to the model provider handling the call:
- Your prompts, the agent’s replies, tool calls and desktop screenshots
- Files on the agent desktop, including anything you upload or send from the vault
- Agent memory and chat transcripts (stored in plaintext so you can resume)
- Your wallet address, balance, deposits, usage records, limits and schedules
Sealed vault
The vault is end-to-end encrypted storage for files and notes. Your wallet signs a fixed message (nothing goes on-chain). The browser turns that signature into an AES-256-GCM key with HKDF-SHA256, salted with your wallet address. The key stays in the tab’s memory and is never sent to us.
What it protects
- File names, types and contents are encrypted before upload. We store ciphertext only
- A database leak or a curious operator gets nothing readable
- Each item is authenticated and bound to its ID, so tampering is detected
- Stored sizes are padded to buckets
What it does not protect
- That you use the vault, when, how many items, and their approximate size
- Anything you send to an agent. It is decrypted and copied to the desktop as a normal file
- Chats, memory, screenshots and desktops, which are not end-to-end encrypted
- A compromised browser or device while the vault is unlocked
- Phishing. Any site that gets your wallet to sign the same unlock message can derive the key. Only sign it on this site
Not built yet
These are on the roadmap and are not part of the service today:
- Anonymous credits: blind-signed or nullifier-based vouchers that separate payment from usage
- Private inference on providers running in attested enclaves
Until they ship, deposits are public on Solana and usage is tied to your wallet. We won’t describe the service as anonymous or untraceable.
Third-party services
LLM provider
Chat messages and screenshots are sent to the model provider that serves each call: by default the Surplus Intelligence market and the seller it routes to, or OpenRouter on fallback. Their terms apply to data they process. Self-hosters can point the app at their own models to avoid third-party processing.
Solana RPC
We query Solana RPC endpoints to verify transactions. Only public blockchain data is accessed.
Sandbox isolation
- Each session runs in an isolated Docker container
- No access to host system or other users’ containers
- Resource limits prevent abuse
- Network isolated from internal services
- Metadata endpoints blocked
Data deletion
Automatic
- Desktop data: Deleted when the agent ends
- Idle sessions: Auto-destroyed after 15 minutes if no task is running
Manual
- End session: Click
End Session - Delete account: Contact support with a wallet signature