Apparition privacy policy

Effective 23 October 2026 · Published by Vagrant Digital LLC

Apparition: Ghost Compendium lets you write down encounters you can't explain, see them pictured by AI, and share them if you want to. This page sets out plainly what the app keeps, what other people can see, where data goes, and how to delete it. In short: your Journal is private, only what you choose to post is public, places are never more precise than a city, and there are no ads and no tracking.

Your account

• Anonymous at first. The first time you open Apparition it creates an anonymous account, so your Journal and pictures can be saved without asking who you are.
• Signing in. To post, comment or light candles you sign in with Apple or Google. That links to your existing anonymous account, so your Journal stays. We receive an account ID and, if the provider shares them, your name and email address. These are never shown to anyone. If you use Apple's "Hide My Email", we only get a relay address.
• Username and profile. You choose a username. It and your profile (username, when you joined, how many posts you have) are public.

What stays private

Your Journal: each encounter's title, text, date, category and place, and the pictures made for it. It is stored in Google Firebase in a space that only your account can read. Your app settings, your blocked list and your Activity (who commented on or lit a candle for your posts) are private to you too.

What is public

When you post an encounter to the Compendium, anyone using the app or viewing a shared post can see:

• the post: its title, text, category, date, place and pictures;
• your comments and replies;
• the candles (likes) you light, and how many candles and comments a post has;
• your username and public profile.

Posting is always a separate step you take, and you see a preview first. Nothing in your Journal becomes public unless you post it.

Location

Apparition only ever stores a city, or a named public place in a city (such as "Eastern State Penitentiary"). Never a street address, and never GPS coordinates.

• You can search for a city by name, which needs no location permission.
• If you tap "Use my location", your phone asks for permission once, then works out the nearest city itself, on the phone. The coordinates never leave your phone; only the city is saved.
• The "Near me" feed works from a city in the same way. Your coordinates are never sent to us.

Pictures

When you ask for a picture, the encounter's title and text (up to 2,500 characters) and the style you chose are sent to Google's Gemini API, which makes the picture. Nothing is sent until you tap the button. The picture is saved to your Journal. Pictures are imagined by AI from your words. They are not photographs and never evidence of anything. Apparition does not upload your own photos or audio.

Speaking instead of typing

If you tap the mic in an encounter, your phone's built-in speech recognition turns what you say into text. That service is provided by Apple on iPhone and usually by Google on Android, and depending on the phone it may send the audio to Apple or Google to be transcribed, under their privacy terms. The microphone is used only while the mic is on. Apparition never records, receives or stores your voice; it gets only the text, which goes into your private Journal like anything you type.

Checking posts before they appear

Every post, comment, username and place name is sent to Google's Gemini API to check it against the community rules before it is published. If the check can't run, the post waits; nothing is published unchecked. We use Google's paid API service, under whose terms Google does not use these requests to train its models. Google keeps them for a limited time to detect abuse.

Reports and blocks

• When you report a post, comment or profile, we store the report: what you reported, the reason you picked, any note you wrote, your account ID and the time. The person you report is not told who reported them.
• 3 reports hide an item until we review it. We review reports within 24 hours and may remove content and ban accounts that break the community rules.
• When you block someone, the blocked person's account ID is saved in your private blocked list. They are not told.

Notifications

If you allow notifications, we store your phone's Expo push token so we can tell you about comments, replies and candles on your posts. You can switch each kind off in the app, or turn notifications off in your phone's settings.

Purchases

If you buy Apparition Pro or a Day Pass, the App Store or Google Play takes the payment; we never see your card details. RevenueCat tells the app what you have bought, linked to your account ID.

Who processes data for us

• Google Firebase (Authentication, Firestore and Storage) holds your account, Journal, pictures and the public Compendium.
• Google Gemini API makes pictures and checks text before it's published, as described above.
• RevenueCat keeps track of purchases. It receives your account ID and purchase details, never your Journal. (RevenueCat's privacy policy)
• Upstash holds counters: how many pictures you've made this month, Day Pass credits, and short-lived rate limits that stop abuse. Rate limits use a one-way scrambled (hashed) form of your IP address, never the address itself, and expire quickly.
• Expo delivers push notifications and hosts this website and the app's server.
• Apple and Google handle sign-in, app downloads and payments.

Each of these services handles data only to do its job for Apparition.

What Apparition does not do

• No advertising, and no advertising IDs.
• No analytics or tracking of how you use the app.
• No selling or renting of your data to anyone, ever.
• No contacts or camera access. The microphone is used only while you dictate an encounter, and Photos access only to save a picture when you choose to.

Deleting your data

You can delete any encounter or picture in your Journal, and any post or comment you made, at any time.

To delete your account, open Me › Delete account in the app. It straight away:

• deletes your posts and their pictures;
• frees your username and deletes your profile;
• turns your comments into "[deleted]", so replies to them still make sense;
• deletes your private Journal, pictures, settings and Activity;
• deletes your account.

If you no longer have the app, email craig@vagrantdigital.com with your username (or the email you signed in with). We will delete your account in the same way within 30 days and confirm by email. Reports you made, and records of purchases, may be kept where we need them to keep the community safe or the law requires it.

Children

Apparition is for people aged 13 and over. It is not meant for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 is using the app, email us and we will delete their account and data.

Security

Data travels encrypted between the app and these services and is encrypted where it is stored. Your Journal can be read only by your own account. Only our server can write public posts, after the checks above.

Changes

If this policy changes, the new version will appear here with a new effective date.

Contact

Vagrant Digital LLC. Questions about privacy, or requests to see or delete your data: craig@vagrantdigital.com.