Data, privacy, and security
Ghast is a desktop AI workspace. One task can involve local files, conversations, model requests, Tools, extensions, Channels, Voice, Memory, and activity records. Evaluate each separately: what is provided, who receives it, where it is stored, how it is deleted, and whether an external action already happened.
Main data flows
| Capability | Local processing or storage | What may leave the device |
|---|---|---|
| Chat / Coding / Team | Conversations, task state, Workspace records, Tool results | Prompts, selected context, Tool schemas, and attachments may go to the model Provider. |
| Local files and terminal | File contents, paths, commands, and output | They leave only when a request, Tool, or extension sends them. |
| MCP | Server configuration, OAuth/credential state, Tool/Resource results | Remote MCP receives call arguments. Local MCP can access the network itself. |
| Plugin / Skill / Hook | Installed files, instructions, and execution configuration | Depends on their commands, MCP servers, and external APIs. |
| Memory | Local to the current device/Profile by default; recalled facts can enter requests | Recalled facts go to the model Provider. Enabling 0G sync can upload an encrypted snapshot. |
| Activity Recorder | Screen OCR, segments, summaries, indexes, and optional visual history | Background analysis can send redacted OCR and app/window/browser metadata to the Memory Background Model's Provider, falling back to General's Background Model when no Memory override is set. It can run without a Chat request; Chat can also include activity context automatically. See capture and privacy boundaries. |
| Channel | Local connection configuration and routing | Telegram, Discord, Feishu, Slack, Weixin, and similar platforms send and receive messages. |
| Voice | Local faster-whisper transcribes the desktop recording entry point | Transcribed text may go to a model Provider. When Weixin supplies no platform transcript, Ghast downloads the raw audio and sends the audio file to the selected model. Spoken replies send text to Microsoft Edge online voices. See Voice. |
| Web Search | Queries and results enter the current task | Default search services, Tavily, Brave, Exa, Firecrawl, Google, X, or Rednote may receive queries. |
| Computer Use | Local permissions, approved apps, and action logs | The model may receive screen or accessibility context needed to operate the UI. |
| 0G Storage | Packages data locally and encrypts it with a Wallet-derived key | Encrypted snapshots go to 0G; pointer updates create public on-chain transactions. |
Credentials
Before sending sensitive work, inspect more than the attachment list:
- Read the message and every attachment or captured app-context card.
- Check the selected workspace and what local material the task may read.
- Review Memory and Activity Recorder settings. An empty attachment list does not mean no background context enters the request.
- Identify the model provider and any connected service that may receive the task data.
- Remove unnecessary material before sending. Do not rely on deleting the conversation afterward to retract a request.
An instruction such as “use only this attachment” expresses intent, not enforced isolation. Do not submit information whose required handling restrictions the current setup cannot satisfy.
- Never place API keys, OAuth tokens, cookies, seed phrases, or private keys in prompts, Skills, Plugin files, Git, screenshots, or feedback.
- Custom MCP environment-variable and Header editors display values in plain text. Prefer OAuth or a Plugin credential vault and avoid long-lived master credentials.
- Use minimum OAuth scopes and dedicated accounts. Revoke MCP authorization before changing its URL or name; a disconnected UI state does not prove the remote grant was revoked.
- Configure user, server, channel, or chat allowlists when a Channel supports them. An empty allowlist can mean everyone is allowed.
- After rotation, verify service-side that the old credential no longer works.
High-privilege local capabilities
Bash, file writes, local MCP, Hooks, Plugin Hooks, and Computer Use can act with the current operating-system account. Before approval, inspect:
- the exact command or action target;
- working directory and file scope;
- network, browser, credential, or Wallet access;
- reversibility;
- whether it writes to contacts or production systems.
The current composer has no individual Bash switch. Coding, code assistance, Skills, or other task paths can provide command capabilities. Limit access with task permission, a controlled Workspace, operating-system permissions and minimal credentials; a prompt alone is not an operating-system Shell prohibition.
Deletion and revocation differ
- Turning off automatic Memory retrieval does not delete Memory.
- Memory Clear all removes personal Main Memory and durable-fact records across all Team teammates and groups—not just the visible list. Other Team records, topic indexes, core profiles and knowledge remain and may still be retrieved. It does not make Ghast forget all Team content. Read the full deletion scope and backup limits before confirming.
- Activity Recorder Clear all processes at most 1,000 segments per pass; failed items, standalone summaries, image files and derived memories can remain. Stopping recording or disabling visual history is not deletion. See cleanup limits.
- Deleting a local conversation cannot retract requests already received by a Provider.
- Removing MCP, Channel, or OAuth configuration from Ghast does not automatically delete external logs or revoke remote grants.
- Disabling 0G sync cannot delete uploaded encrypted data or reverse on-chain transactions.
For full incident handling, separately clear local data, revoke service-side credentials and grants, inspect external-platform content, and record third-party or on-chain history that cannot be retracted.
Telemetry and crash reports
Usage telemetry is on by default. It sends product usage, sanitized errors, and performance signals to PostHog associated with the login email, and sends Expert names and run outcomes to Ghast. It excludes conversation text, API credentials, raw errors, terminal output, file paths, and session recordings.
Crash log upload is a separate setting and is off by default. Manage both under Settings → About. Turning either off affects future uploads only.