Privacy Policy
Effective 16 October 2026 · Last updated 16 October 2026
These pages are the contract for phantomprofile.com and the Phantom Profile Windows app. They are not a substitute for advice from your own lawyer. Questions: [email protected].
1. Short version
The browsers you launch keep cookies, passwords, history, and cache on your PC. We do not receive that data. The cloud only stores what is needed to run your account.
2. What we store
- Email, password hash (not the password), plan, confirmation status, optional two-factor secret.
- Device identifiers (machine hash, label, last seen) so device limits can be enforced.
- Profile names and other metadata you choose to sync — not cookies, not site passwords, not browsing history, not cache.
- Login IP, security audit events, and API usage counters.
We do not store your card number or payment details. Stripe and Paddle take the payment. We only keep the result: the plan, the amount, and whether it went through.
We do not sell personal data. We send transactional mail (confirm, reset, invoices, security) to the address on the account. We do not build a marketing list unless you separately opt in later.
3. What we never collect from profiles
Cookies, sessions, saved passwords, autofill, history, cache, screenshots of sites, and the contents of pages you visit in a profile. If it lives under the profile’s user-data folder, it stays there.
4. Why we need the cloud fields
To create the account, enforce plan quotas, detect new devices, send security mail, show in-app notices, and keep the service working. Legal: contract and legitimate operation of the service.
5. Who else sees data
Infrastructure on our VPS (database, mail, API). Mail is sent through our mail stack. We do not hand profile cookies to anyone because we do not have them. We may disclose account records if required by U.S. law.
6. How long
Account rows last as long as the account exists, then a short period in backups. Audit and API logs are kept only as long as needed for security and abuse control. You can ask us to close the cloud account at [email protected].
7. Security
Passwords are hashed. API access uses short-lived tokens bound to a device. The public API is HTTPS. No method is perfect; protect your PC and your mailbox.
8. Children
The service is not for anyone under 18. Do not create an account for a minor.
9. Law and contact
U.S. law applies, same as the Terms. Privacy requests: [email protected].