Security & privacy

Only what a request needs, and only when you make one. Ask a question and your transcript context plus your question go to Ghostbar's API, which forwards them to the model provider and streams the answer back. Trigger Analyze Screen and one screenshot goes with that single request.

Nothing is uploaded in the background. With the overlay open and idle, nothing leaves your computer at all.

Your email, your password hash, your billing status, and counters — tokens used, requests made, which model. That is what the service needs to bill correctly and stop runaway spend.

We do not store your transcripts, your screenshots, or the text of your questions and answers. They pass through to serve the request and are not written to our database.

The overlay asks the operating system to exclude its window from capture, the same mechanism password managers use to keep vaults out of screenshots. Apps that capture through the standard macOS APIs — Zoom, Google Meet, Microsoft Teams, and most recorders — do not see it.

It is best-effort, and honest about it. A phone camera pointed at your screen sees it. A hardware capture card sees it. Some remote-desktop and kernel-level monitoring tools can see it. If your situation makes being seen genuinely costly, assume it is possible and decide accordingly.

Downloads require a verified email address. That is partly so builds are tied to real accounts rather than scraped links, and partly because the desktop app needs a signed-in account anyway.

Installer links are signed and short-lived rather than permanent public URLs. Passwords are hashed; sessions use short-lived access tokens with rotating refresh tokens per device.

Current macOS builds are not yet Apple-notarized, which is why macOS warns on first install. That is being fixed; until then, the install guide shows exactly which prompts to expect, so a real warning would stand out from an expected one.