Privacy policy

The short version: you can use Ghost Story Viewer without an account. We don’t keep a history of what you look up. If you sign in, we store only what’s needed for your watchlist and plan. Ads come from a third party, and where the law requires it, only after you agree.

Who is responsible

This policy covers ghoststoryviewer.com. The service is run by its operator (“we”, “us”). We decide how your personal data is used and are responsible for it (the “controller” under the GDPR). Questions or requests: nesparolini@gmail.com.

What we collect and why

When you look up an account

• The username you enter. We send it to our data provider to fetch that account’s current stories. We don’t save a record of which accounts you looked up.
• Your IP address, used briefly to stop abuse: we count lookups per address for 10 minutes. If our systems hit an error, our host’s logs may briefly contain your IP address and the username involved.
• Story results, meaning information about the account you looked up, not about you. We cache them for up to 5 minutes so repeat visits are fast, then delete them. We never store copies of stories.
• Popularity counts for verified accounts (public figures and brands) only, not linked to you, kept for about 3 weeks. We use them to decide which account pages to list for search engines.

If you sign in with Google (optional)

• Your Google account ID, name, email address and profile picture, which Google shares when you sign in. We never see your Google password.
• The public accounts you add to your watchlist, and your plan (Free or Pro).
• A sign-in session that lasts up to 30 days, or until you sign out.

If you subscribe to Pro

Payments are handled by Stripe. We never see or store your card details. From Stripe we receive a customer reference, a subscription reference and whether your subscription is active.

Ads

Free pages show ads from Adsterra, a third-party ad network. Adsterra may set cookies and receive your IP address and browser details to choose, show and count ads. Each ad runs in an isolated frame that can’t read this site, your account or what you look up. In the EU, EEA, UK and Switzerland, no ad code loads unless you accept. We also treat the browser Global Privacy Control signal as a rejection of ad cookies. Pro subscribers see no ads.

Visitor statistics

We count visits with Vercel Web Analytics to see which pages are used. It sets no cookies and doesn’t track you across other sites. For each page view it records the page address, the referring site, your country, and your browser, operating system and device type. Visits are told apart with a hash of your IP address and browser that changes every day, so they can’t be linked over time, and your IP address itself isn’t stored.

Photos and videos

Story photos and videos load directly from Instagram’s own servers (run by Meta), so your browser connects to them and they can see your IP address, as with any embedded image. Our pages tell your browser not to send them which page you were on. You don’t sign in to Instagram here, so no Instagram account of yours is involved.

Cookies and similar storage

Name	Purpose	Lasts	Type
sid	Keeps you signed in	30 days or until sign-out	Essential (only if you sign in)
oauth_state	Protects the Google sign-in step from forgery	10 minutes	Essential
ads_consent	Remembers your ad-cookie choice	6 months	Essential
Adsterra cookies	Choosing and counting ads	Set by Adsterra	Advertising (with consent where required)

If you install the site as an app, your browser also stores the site’s own files (styles, scripts, fonts) so it opens quickly. It never stores stories or anything about you. You can change your ad choice at any time with Ad cookie settings at the bottom of each page, where it applies to you.

Legal bases (EU, EEA and UK)

• Providing what you asked for (performing a contract): lookups, your account, watchlist and Pro plan.
• Legitimate interests: keeping the service secure and affordable (rate limits, abuse prevention, short-term caching) and understanding which verified accounts are popular.
• Consent: ad cookies in the EU, EEA, UK and Switzerland. You can withdraw it at any time.
• Legal obligations: for example, keeping payment records where the law requires it (held by Stripe).

Who else handles data for us

• Vercel hosts the site, processes requests (including IP addresses) to serve it, and provides our cookieless visitor statistics.
• Upstash stores accounts, sessions, watchlists, short-lived caches and rate-limit counters.
• Google provides sign-in if you use it.
• Stripe processes Pro payments.
• Adsterra serves ads on free pages.
• Our story data provider receives the usernames being looked up, but nothing that identifies you.

Some of these companies are based in, or process data in, the United States. Where the GDPR applies, transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, as offered by each provider.

How long we keep it

• Rate-limit counters: 10 minutes (per visitor) and 1 hour (site-wide).
• Story results: up to 5 minutes. Answers for missing or private accounts: 10 minutes.
• Sign-in sessions: up to 30 days.
• Account, watchlist and plan: until you ask us to delete your account.
• Popularity counts (verified accounts only): about 3 weeks.
• Host error logs: a short period set by our hosting provider.

Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, and object to or restrict how we use it. Email nesparolini@gmail.com and we’ll respond within 30 days. To delete your account, email us from the Google address you sign in with. If you have Pro, cancel it first under Manage subscription. If you’re in the EU, EEA or UK, you can also complain to your local data protection authority.

California: we don’t sell personal information for money. Ad cookies from our ad partner may count as “sharing” for advertising under California law. You can opt out by rejecting ad cookies or turning on Global Privacy Control in your browser, and we won’t treat you differently for doing so, apart from not showing those ads.

Children

Ghost Story Viewer isn’t meant for children under 13 (under 16 in the EU and EEA). We don’t knowingly collect their personal data. If you believe a child has signed in, contact us and we’ll delete the account.

If you own an account shown here

We show only public accounts and never store their stories. You can ask us to remove your account’s page and stop fetching it: see removing an account.

Changes to this policy

If we change how we use personal data, we’ll update this page and the date at the top. For significant changes, we’ll show a notice on the site first.