Privacy Policy

GhoSTR is a ghostwriting tool for short-term rental hosts. It connects to the Gmail inbox that receives your Airbnb and VRBO booking confirmations, reads those reservation emails, and uses the information to help draft personalized guest messages. GhoSTR never contacts your guests directly and never accesses your Airbnb or VRBO account.

We collect only what's necessary to deliver the service:

• Google account info — your email address and display name, provided when you sign in with Google.
• Gmail OAuth tokens — a read-only access token and refresh token, used to fetch Airbnb reservation emails on your behalf. We store these securely in your account record.
• Reservation data — guest first name, check-in and check-out dates, guest count, platform (Airbnb or VRBO), and listing name, parsed from your reservation confirmation emails. The raw email content is never stored — only these extracted fields plus the Gmail message ID (used to prevent duplicate imports) are saved. We do not read, store, or process any other emails in your inbox.
• Guest feedback card data — responses your guests write on the physical card or submit digitally: where they explored, where they ate, how accommodations made them feel, improvement suggestions, visit reason, and SMS opt-in status (including phone number if provided).
• Billing information — processed by Stripe. GhoSTR does not store credit card numbers. Stripe's privacy policy governs billing data.

GhoSTR requests the gmail.readonly scope. This grants read-only access to your inbox. We run exactly two searches:

• from:express@airbnb.com subject:Reservation
• from:no-reply@vrbo.com subject:Booking

Each search is scoped to a time window you control — by default the last 30 days, with options up to 12 months when you need to import older reservations. We do not scan your full inbox history, read older messages outside the selected window, index your inbox, or access emails from any other sender. Your personal emails, receipts, correspondence, and everything else in your Gmail account are never read or processed.

• To create reservation records in your GhoSTR dashboard.
• To generate draft guest messages using the Anthropic Claude AI API. Reservation and guest card data is sent to Anthropic solely to produce your drafts. Anthropic's usage policies govern how they handle API inputs.
• To deliver your completed drafts to your inbox via SendGrid.
• To process per-reservation billing via Stripe.

We do not sell your data. We do not use your data for advertising. We do not share it with third parties except the service providers listed above (Supabase, Anthropic, SendGrid, Stripe, Vercel), each of which processes data only as needed to run GhoSTR.

GhoSTR stores guest first names and stay dates as part of reservation records. Physical feedback card responses — including any phone number a guest writes for SMS opt-in — are stored to generate your drafts and power the remarketing flow. You are responsible for obtaining appropriate consent from guests before sending them any messages GhoSTR drafts on your behalf.

Your data is retained for as long as your GhoSTR account is active. To request deletion of your account and all associated data (reservations, guest cards, drafts, tokens), email support@ghostr.co. We will process deletion requests within 30 days.

Data is stored in Supabase with row-level security — each host can only access their own records. Gmail tokens are stored in your authenticated user record, not exposed to other users. All data is transmitted over HTTPS.

We may update this policy as GhoSTR evolves. Material changes will be noted on this page with an updated effective date. Continued use of GhoSTR after changes constitutes acceptance.

Questions about this policy? Email support@ghostr.co.