Privacy Policy

Scope and operator

Richdale Ventures LLC operates GhostShield VPN and the GhostShield VPN browser extension. Contact us at info@ghostshield.ai or https://www.ghostshield.ai/contact with privacy questions or data requests. This policy explains the browser extension and the services it uses. It supplements our general privacy policy; this extension-specific policy controls where descriptions differ for the browser extension.

The extension routes supported web traffic from this browser through a GhostShield VPN HTTPS proxy and applies the DNS filter settings you select. It does not protect other applications or provide an operating-system kill switch. A GhostShield VPN account with an active subscription and an allowed device is required.

Account access and installation information

You sign in on the GhostShield VPN website and explicitly approve a device code. You do not enter your account password in the extension. The website processes the sign-in information you provide. The extension receives an account session token, your email address, subscription information and the device approval result. Our service uses internal account and device identifiers to enforce subscription and device limits. Upgraded proxy exits receive per-location pseudonyms instead of those identifiers. The pseudonyms use a random key that changes daily.

The extension creates a random identifier for this installation. During approval it sends that identifier, a device name identifying GhostShield VPN and your browser and operating system, and the extension version. This is not a hardware fingerprint or an advertising identifier. Our account service may retain device identifiers, sign-in/session status, last activity and source-IP metadata for account access and device security.

The browser also creates a non-extractable private device key. Pairing registers only its public-key thumbprint with your website device record. Signed requests let our control service verify that the browser holds the key. Each proxy lease uses a separate session key; exits receive that session's public key and proof, never the device key or its thumbprint. Private keys stay in the browser profile.

Traffic and destination processing

While connected, the chosen proxy processes your source IP address, destination hostnames or IP addresses, destination ports, DNS requests, short-lived authorization credentials and traffic bytes to establish and forward your connections. Selected location and DNS filter mode are sent to the GhostShield VPN control service. This processing is necessary for the extension's browser-protection features, even though the extension does not maintain a browsing-history database.

For HTTPS and secure WebSocket connections, the website's TLS encryption remains between your browser and that website inside the proxy tunnel. We do not install a root certificate or decrypt those website connections. The proxy can see the destination needed to forward a connection and its traffic volume. Plain HTTP traffic is not end-to-end encrypted: its URLs, headers and content can be visible to the forwarding proxy and the destination. Prefer HTTPS for sensitive information.

The extension does not inject content scripts, read your browser history or cookie database, scrape pages, record keystrokes, or embed an analytics or advertising SDK. The proxy implementation does not write per-request destination, traffic-content or credential logs. Aggregate connection/error/byte counters and in-memory source-IP/account rate and concurrency controls support reliability and abuse prevention. Do not interpret this as a promise that all internet intermediaries or hosting providers have no security or operational records.

Data on your device and retention

Local extension storage holds preferences, selected location, favorites, excluded domains, language, appearance, the random installation identifier, connection state and limited account display information. These records remain until replaced, cleared with the browser's extension-data controls, or removed when you uninstall the extension. Signing out clears account display information and the server catalog but keeps preferences and the installation identifier.

IndexedDB in the extension's browser profile stores the non-extractable device key and session keys. Signing out does not remove the device key; clearing extension data or uninstalling removes it. The extension removes a session key when it finishes closing that session. Interrupted cleanup can leave a session key until extension data is cleared. The website retains the registered device-key thumbprint as part of the device record.

Account tokens, proxy credentials and pending pairing secrets are held in browser session storage restricted to trusted extension contexts. They survive a normal background-worker suspension, but session storage is cleared when the extension is reloaded/disabled or the browser session ends. Signing out clears the account token and current proxy credential. Cancelling or completing pairing clears the pending pairing record. Pending local pairing records expire according to the displayed code deadline and are cleared when next handled.

A proxy authorization lasts no more than fifteen minutes and cannot outlive the account token or subscription used to issue it. While you stay connected, the extension renews it about every five minutes after our service rechecks your subscription and registered device. Active proxy tunnels close when authorization is not renewed, is denied or expires. Website pairing records expire after fifteen minutes while pending, two minutes after approval if not collected, or one minute after denial; successful collection removes the approved record.

Live proxy connections, rate/concurrency bookkeeping and aggregate counters reside in service memory. Connection bookkeeping is released as connections close; rate entries can remain until pruned or the service restarts. The proxy does not archive traffic payloads or browsing destinations. DNS resolver and hosting infrastructure process requests to operate the service; their operational handling also falls under the general service policy and applicable provider terms.

The control service stores random daily pseudonym keys in Cloudflare D1 with a two-day expiry. When it creates a new daily key, it removes expired keys from the live table. Cloudflare D1 Time Travel backups can retain deleted keys for up to thirty days. Key expiry and deletion do not establish deletion of all account, website, hosting or backup records.

Website account, subscription and device records remain while needed to operate your account and can be removed through account deletion. Deleting the extension alone does not delete your website account. The website retains a keyed hash of a deleted account's email address, without an automatic expiry, to prevent repeated free-trial abuse; device trial-eligibility records can also survive account deletion. Payment providers may retain their own transaction records under their policies and applicable law.

Why Chrome permissions are needed

Proxy permission sets and verifies the browser route. Privacy permission controls WebRTC non-proxied UDP and network prediction while protection is active. Storage keeps settings and session secrets. Alarms schedules credential renewal and connection checks. WebRequest and webRequestAuthProvider answer proxy authentication challenges and discard transient authentication retry identifiers after completion or failure.

Host access to all URLs is required because proxy authentication challenges relate to the websites you visit, not just GhostShield VPN domains. It also allows the extension to reach account and control services. This access is not used to scrape page content or build an advertising or browsing profile.

Service providers and international processing

We use the GhostShield VPN website and account infrastructure, Cloudflare for the browser control service, hosting providers for proxy servers, and DNS infrastructure to provide the selected filtering mode. These providers necessarily handle the data required for their part of the service. Your selected exit and its DNS providers can be in a different country from you. Account, hosting and network infrastructure may process data internationally.

The extension does not itself take payments or receive card details. Website sign-in, billing and support use the website's service providers and policies. We may disclose information as required by law or as necessary to prevent abuse or investigate security incidents. We do not sell or rent extension user data, transfer it to data brokers, or use it for personalized advertising.

Limited Use of Chrome user data

GhostShield VPN's use of information received through the browser extension conforms to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use this information only to provide, maintain and secure the extension's disclosed browser-protection, account-access and diagnostic features. We do not use it for unrelated analytics, generalized market research, advertising, creditworthiness or lending decisions.

We transfer extension user data only as necessary to provide or secure these features, comply with applicable law, or complete a merger, acquisition or asset transfer subject to these protections. Humans do not read extension user data except with your explicit consent for specific data, when necessary for security or legal obligations, or for internal operations using aggregated and anonymized data.

Your controls and protection limits

You choose the location, DNS filters, WebRTC guard, excluded domains and optional auto-reconnect setting. Excluded domains, the GhostShield VPN website and its control API intentionally use direct connections. Disabling the WebRTC guard permits WebRTC networking according to the browser's normal settings. Disconnecting releases this extension's proxy and privacy controls; disabling or uninstalling the extension also stops its protection.

Browser-internal traffic, other applications, enterprise policy and the interval before extension startup are outside this extension's control. Private/incognito browsing is not supported. An unavailable proxy can block supported browsing while protection is requested; explicit disconnect restores your previous browser routing. No extension can guarantee anonymity or prevent every browser, operating-system or network leak.

Website visits, support and your rights

Opening the GhostShield VPN website for approval, billing, support or this policy is a website visit. Its privacy and cookie policies explain website analytics and other website processing. Those website systems are separate from the extension, which embeds no analytics SDK.

You can sign out in the extension, manage devices and delete your account in the GhostShield VPN account dashboard, or request access, correction or deletion by contacting info@ghostshield.ai. We verify requests before acting. Rights and any legally required exceptions depend on your location. You may also contact your local data-protection authority where applicable. Support information you choose to send is used to answer your request; do not include passwords, pairing secrets, tokens or browsing content in diagnostic reports.

We will update this page when the extension's data practices change and revise the last-updated date. Material changes will be disclosed through the website, extension update or other appropriate notice.