GhostGet keeps product state with the operator.

The CLI stores state on the operator's machine

New installations use ~/.local/share/ghostget as the default state home. Existing Wrench state is selected in place without moving or copying it. An operator can select a dedicated path with GHOSTGET_STATE_HOME; the earlier state-root environment aliases remain supported, and conflicting roots are rejected. GhostGet restricts its owned state directories to the current operating-system account and rejects shared, symbolic-link, or unexpectedly replaced state paths before trusted state is read.

State can include auth locators, managed OAuth credentials, encrypted exact-query snapshots, normalized read projections, provider and plugin state, plans, receipts, journals, recovery evidence, session material, locally installed tools, and capture working state. Durable page captures and media archives live in the vault or output path selected by the operator.

CLI update preferences use ~/.local/state/hraness-cli-update. Installation and package-manager coordination records use separate private local paths; verified release archives are retained beside the global package directory. These records contain package and installation details, not connected-account data or captured content. Retained archives let the global package manager reinstall its recorded dependencies.

GhostGet's local control service stores permissions and imported API definitions in private files and public web request metadata in SQLite. The control owner (ghostget control serve, or the TUI) owns this service's private channel while it runs and lists output files. Activity retains up to 10,000 completed entries for at most 30 days, with active requests retained until settled. Entries contain timing, method, origin, configured endpoint scope, decision, status, and byte count. They do not contain query strings, response bodies, credentials, or hashes of the requested URL. History stays on the operator's machine.

The Apple Photos contact-evidence workflow creates bounded, transient full copies of the private Photos and Contacts SQLite databases with VACUUM INTO under an operation-owned private temporary directory and queries them without network access or source mutation. Those copies can include unselected columns and raw blobs. The privacy exclusions apply only to the returned JSON. GhostGet does not open, copy, or ask Photos to materialize referenced photo or video asset files. Ordinary success and handled failure remove the captures; forced termination or a crash can leave an exact leased copy until a later export proves its owner is dead and reclaims it. Its stdout artifact contains exact Photos and Contacts identifiers and biometric-derived cluster counts, so the caller must keep that output on an appropriately private path.

Local custody does not mean that every stored byte is encrypted. Exact provider-read snapshots and normalized projections use authenticated local encryption. A GhostGet-managed Gmail OAuth JSON file, for example, is mode-restricted private state, but it is not an operating-system keychain and is not encrypted at rest. Protect the local account, disk, state home, selected output paths, and backups.

The owner messaging host retains conversation observations and historical baselines, enrollments, grants, plans, action claims, and run evidence in private SQLite state. This automation history and journal are plaintext protected by filesystem permissions, not encrypted snapshots. Selected linked-device stores can also contain plaintext history and session material outside GhostGet's encrypted projection store. Protocol streams can contain message bodies and assets; trusted callers must not record them in general logs.

Selected work determines which third parties receive data

A page read or capture contacts the requested source through its selected acquisition method. URL metadata work can perform read-only Archive.today discovery. A media command contacts the selected source and may run operator-selected local tools. An authenticated capability sends only the checked request and credential material required by its exact provider, origin, transport, account realm, and contract.

Those sites and providers can observe ordinary request information such as the source IP address, request timing, their own account identifier, and the bounded action or query. A signed-in browser page can also emit telemetry owned by that provider. GhostGet does not turn those interactions into a claim that third parties retain nothing.

The CLI and SDK do not send ghostget.com analytics. They do make the network requests required by the operation the caller selected. GhostGet does not include a hosted relay, model, planner, or tool loop. A calling agent, application, terminal, logging system, or model service can receive whatever output the operator gives it; that downstream handling is outside GhostGet.

The standalone CLI sends aggregate run telemetry to account.hraness.com: the CLI version, the top-level command name, and a local installation token used to count active installations. It excludes command arguments, paths, account data, and output. Set HRANESS_TELEMETRY=off or GHOSTGET_TELEMETRY=off to disable it. SDK calls do not send this CLI telemetry.

Supported global CLI installations also check GitHub for stable releases before ordinary commands, at most once a day, and download verified updates through the GitHub CLI. GitHub receives ordinary connection and release-request information; the updater does not send account state, captured content, or command arguments. Use ghostget update disable to turn automatic checks off or HRANESS_NO_UPDATE=1 for one command. SDK imports, help, CI, nested clients, and gateway-only mode do not trigger automatic checks.

WhatsApp automation starts linked-device synchronization only after an explicit owner start with the required managed permission. That sync maintains a provider connection until stopped; it is not a single local read. Initialization and the separate TextButler export do not start sync. Stopping the host or revoking its sync permission closes owned work, but does not remotely unlink the account or erase retained provider history.

Credentials stay bound to one declared use

An auth locator can point to an explicit cookie source or file, browser profile, OAuth token file, GhostGet-managed OAuth credential, or linked-device store. The caller selects the locator by name. GhostGet binds it to one provider account and transport, keeps credential values out of normal outputs and receipts, and does not silently fall back to another transport.

A successful subject-bound R1 read can store the validated input and bounded provider output as authenticated local ciphertext. A later --cache-only read can return that exact snapshot without a provider connection. Exact inputs, account subjects, cursors, private identifiers, and provider output remain inside the encrypted snapshot instead of entering its public diagnostic reason.

R2 and R3 mutations retain local plan, dispatch, receipt, and recovery evidence so GhostGet can avoid a blind retry. Some evidence must remain available while a dispatch is indeterminate. The remote provider controls any server-side records produced or retained by an accepted request under that provider's policy.

Captures and archives contain source material

A durable page capture stores the selected page content and source metadata in the operator's Markdown vault. A completed media archive can contain acquired encoded media, privacy-projected provider metadata, requested derivatives and transcripts, a versioned manifest, and SHA-256 records. Anyone with access to those output paths can read that retained material.

GhostGet does not persist media cookies, request headers, signed media URLs, raw yt-dlp metadata, or transport fragments in the completed archive. It cannot remove personal or confidential information already present in the source content. Use GhostGet only with material and accounts you are authorized to access, and choose output and backup locations that match the content's sensitivity.

Trusted plugins and native tools share the local account boundary

Bundled source plugins run as trusted in-process code. A portable plugin requires an explicit trust decision for one verified, content-addressed bundle and receives denied-by-default host capabilities. Its child process contains ordinary failures, but it is not a hostile native-code sandbox. Plugin code still runs with the ambient authority of the current operating-system account.

Operator-selected browser executables, media tools, transcription tools, models, linked-device clients, and other native dependencies have their own provenance and behavior. GhostGet checks the boundaries documented for each integration, but continuity and content hashes do not prove that third-party native code is safe.

The operator controls retention and provider revocation

GhostGet sets no hosted retention period because it does not receive CLI state through a GhostGet service. Captures and archives remain until the operator removes them from their selected output paths and any backups. Provider-side records remain until the provider removes them under its own controls and policy.

ghostget auth remove ID --yes removes the locator, any GhostGet-managed OAuth credential, session secrets, and auth-bound local read caches. It does not revoke a browser session, linked device, externally managed token, or provider-side grant. Revoke those separately with the provider. Do not discard run, receipt, journal, or recovery evidence for an unsettled mutation; inspect and reconcile it first.

ghostget.com measures pages, not people

ghostget.com is a static documentation site. On the canonical production host only, an optional PostHog bootstrap can record page view, page leave, Core Web Vitals, bounded browser errors, not-found pages, clicks on links to other sites, clicks on the home page install and getting-started links, and copies of the install commands. A click or copy event carries only a fixed name for the link, its destination host, or the install method, never the copied text. The analytics library is bundled with the site and loads no remote code. The runtime is cookieless, personless, memory-only, DNT-aware, and restricted to that host.

The shared footer asks Hraness Accounts whether a consent notice applies in your region. If consent is required or the region cannot be determined, analytics stays off until you accept. Your choice is saved in this browser’s local storage. Do Not Track keeps analytics off even after acceptance.

Campaign tags (utm_*) and ad click identifiers such as gclid are kept so campaigns can be measured. Every other URL query parameter and every fragment is stripped before an event can leave the browser, and error reports drop query strings, email addresses, and credentials. The site does not use replay, identity, feature flags, broad autocapture, console capture, or person profiles. It does not record form input, local file paths, CLI state, or provider account material. JavaScript is optional, and every public page remains readable without it.

GhostGet mailing-list subscriptions are separate

The optional footer form submits to Hraness Accounts, which processes the email address at https://account.hraness.com/api/mailing/subscribe. Each request uses the fixed wrench audience and source=hraness-site-footer. An eligible request records a pending GhostGet membership. Resend processes the email address to deliver a confirmation message from newsletter@news.hraness.com. The emailed link opens the Hraness Accounts confirmation page. Only the page's explicit Confirm subscription POST records consent and changes the membership to subscribed.

Subscribed members can receive later GhostGet mail through Resend from news.hraness.com. Unsubscribing retains the GhostGet membership and consent history, changes only that membership to unsubscribed, and leaves every other Hraness audience unchanged. The mailing list is optional: using the GhostGet CLI, SDK, or ghostget.com does not require a subscription, and a GhostGet subscription does not enroll the address in another Hraness audience.

The documentation works without JavaScript

Agents can request Accept: text/markdown on a public content URL and receive a Markdown body with Vary: Accept. A Do Not Track signal disables the optional analytics bootstrap. The site content, install commands, privacy information, and support links remain available when JavaScript does not run.