What this website, the setup mirror and the LocalGhost software do with information about you. The website and the mirror keep no record of your visit, and the software keeps your data on your own box and asks the internet only for public things.
LocalGhost.ai Ltd (company number 17213100, registered in England and Wales) runs this website and the mirror and is responsible for them under UK data protection law. The software runs on your hardware, so for what it holds you're the one in charge, and the company never receives it.
> 1. THIS WEBSITE
- The site is served by nginx from a server I run, with access logging switched off for every page and every file, the mirror included. Nothing records your IP address, the pages you read or when you read them. The error log is kept at the critical level only, for faults in the server itself.
- There are no cookies, no analytics, no tracking pixels and no third-party scripts or fonts on the site. The one exception is a small dice game under
/random, which loads its fonts from Google Fonts, so Google sees that one request if you open it. - Two games keep a high score and a player name in your browser's local storage, and the playlist can keep tracks in your browser's cache so they play offline. All of it stays in your browser, and clearing the site's data there removes it.
- If you email info@localghost.ai, I read it and keep it in my mailbox to reply, and it isn't used for anything else or shared with anyone.
- The links to GitHub, X and LinkedIn are ordinary links. Once you follow one, that service's own policy applies.
> 2. THE SETUP MIRROR
The setup mirror runs on the same server with the same logging switched off, so a box that downloads its maps, models or a release leaves no record here. Every file on it is a public copy of something published elsewhere, and a box sends nothing but the request for the file.
> 3. THE SOFTWARE
Nothing of yours leaves the box. Your photos, videos, location trail, notes, voice notes, health data, chats and memories live on the box's encrypted volume and nowhere else, and I never receive any of it, since there's no server of mine for it to go to. There's no account, no telemetry, and no analytics or crash-reporting library in the server or the app. When the app records a crash, it writes it to the phone's own log, and it goes nowhere from there.
The box asks the internet for public things only, and nothing of yours is in the request.
- Prices from the exchanges and the ECB's exchange rates, fetched by the box.
- News feeds, fetched by the phone while it's on Wi-Fi and by the box when the phone is away.
- Maps, models and releases from the setup mirror, checked against its signed manifest.
- A coin's own website for its page, and Wikipedia's API only on a box without its own copy of Wikipedia.
It never asks for a map tile, and it never sends a location, a photo or a note. The phone talks to your box and nothing else, except when a question needs the web. Then the phone runs the search itself (DuckDuckGo, or Brave with your own key) and reads the pages, so the search engine sees the query and never your archive. The phone also reads the mirror's manifest once a day on Wi-Fi to see whether there's a new release.
The box keeps what you keep. Every memory can be edited or deleted from the phone, and the box never writes over your version. A wipe PIN destroys the volume's key, after which nothing on the disk can be read. The full list is in the wisp 0.0.1 release notes under "What leaves the box", and Set Up a Box says the same from the operator's side.
> 4. CHANGES
When any of this changes, this page changes with a new date at the top, and the change goes in the changelog. Questions go to info@localghost.ai.