GhostShield VPN Browser Extension Privacy Policy

Last updated: 2026-10-26

Scope and operator

Richdale Ventures LLC operates GhostShield VPN and the GhostShield VPN browser extension. Contact us at info@ghostshield.ai or https://www.ghostshield.ai/contact with privacy questions or data requests. This policy explains the browser extension and the services it uses. It supplements our general privacy policy; this extension-specific policy controls where descriptions differ for the browser extension. This is the Firefox version; the full policy is at https://www.ghostshield.ai/privacy#browser-extension.

The GhostShield VPN browser extension routes supported web traffic from your browser through an encrypted HTTPS proxy. You choose the connection location, DNS filters and WebRTC guard settings. An active GhostShield VPN subscription and an allowed device are required. It protects supported browser traffic; it does not protect other applications or provide an operating-system kill switch.

Account access and installation information

You sign in on the GhostShield VPN website and explicitly approve a device code. You do not enter your account password in the extension. The website processes the sign-in information you provide. The extension receives an account session token, your email address, subscription information and the device approval result. Our service uses internal account and device identifiers to enforce subscription and device limits. Upgraded proxy exits receive per-location pseudonyms instead of those identifiers. The pseudonyms use a random key that changes daily.

The extension creates a random identifier for this installation. During approval it sends that identifier, a device name identifying GhostShield VPN and your browser and operating system, and the extension version. This is not a hardware fingerprint or an advertising identifier. Our account service may retain device identifiers, sign-in/session status, last activity and source-IP metadata for account access and device security.

The browser also creates a non-extractable private device key. Pairing registers only its public-key thumbprint with your website device record. Signed requests let our control service verify that the browser holds the key. Each proxy lease uses a separate session key; exits receive that session's public key and proof, never the device key or its thumbprint. Private keys stay in the browser profile.

How your browser traffic is protected

Your browser connects to the selected GhostShield VPN proxy over HTTPS. The proxy forwards supported web connections to the destinations you request and applies your selected DNS filtering. Your chosen location and filter settings are sent to our control service to set up and maintain the connection. This routing does not create a browsing-history log.

Traffic between your browser and our proxy is encrypted using HTTPS. HTTPS websites and secure WebSocket connections retain their own encryption between your browser and the destination; we do not install a root certificate or decrypt that content. If a destination uses HTTP, the final connection from our proxy to that destination also uses HTTP, just as it would through a VPN. The extension does not turn an HTTP website into an HTTPS website.

The extension does not inject content scripts, read your browser history or cookie database, scrape pages, record keystrokes, or include an analytics or advertising SDK. Our proxy does not write per-request logs of browsing destinations, traffic content or authentication credentials. Temporary connection state and rate limits, plus aggregate connection/error/byte counters, support reliability and abuse prevention. These operational controls are separate from browsing-history and traffic-content logs.

Data on your device and retention

Local extension storage holds preferences, selected location, favorites, excluded domains, language, appearance, the random installation identifier, connection state and limited account display information. These records remain until replaced, cleared with the browser's extension-data controls, or removed when you uninstall the extension. Signing out clears account display information and the server catalog but keeps preferences and the installation identifier.

IndexedDB in the extension's browser profile stores the non-extractable device key and session keys. Signing out does not remove the device key; clearing extension data or uninstalling removes it. The extension removes a session key when it finishes closing that session. Interrupted cleanup can leave a session key until extension data is cleared. The website retains the registered device-key thumbprint as part of the device record.

Account tokens, proxy credentials and pending pairing secrets are held in browser session storage restricted to trusted extension contexts. They survive a normal background-worker suspension, but session storage is cleared when the extension is reloaded/disabled or the browser session ends. Signing out clears the account token and current proxy credential. Cancelling or completing pairing clears the pending pairing record. Pending local pairing records expire according to the displayed code deadline and are cleared when next handled.

A proxy authorization lasts no more than fifteen minutes and cannot outlive the account token or subscription used to issue it. While you stay connected, the extension renews it about every five minutes after our service rechecks your subscription and registered device. Active proxy tunnels close when authorization is not renewed, is denied or expires. Website pairing records expire after fifteen minutes while pending, two minutes after approval if not collected, or one minute after denial; successful collection removes the approved record.

Live proxy connections, rate/concurrency bookkeeping and aggregate counters reside in service memory. Connection bookkeeping is released as connections close; rate entries can remain until pruned or the service restarts. The proxy does not archive traffic payloads or browsing destinations. DNS resolver and hosting infrastructure process requests to operate the service; their operational handling also falls under the general service policy and applicable provider terms.

The control service stores random daily pseudonym keys in Cloudflare D1 with a two-day expiry. When it creates a new daily key, it removes expired keys from the live table. Cloudflare D1 Time Travel backups can retain deleted keys for up to thirty days. Key expiry and deletion do not establish deletion of all account, website, hosting or backup records.

Website account, subscription and device records remain while needed to operate your account and can be removed through account deletion. Deleting the extension alone does not delete your website account. The website retains a keyed hash of a deleted account's email address, without an automatic expiry, to prevent repeated free-trial abuse; device trial-eligibility records can also survive account deletion. Payment providers may retain their own transaction records under their policies and applicable law.

Browser permissions

Proxy access selects and checks the browser route. Privacy controls restrict direct WebRTC UDP and network prediction while protection is active. Storage keeps settings and session secrets, and alarms schedule credential renewal and connection checks. In Firefox, webRequest and webRequestBlocking answer proxy authentication challenges, remove temporary retry identifiers when requests finish or fail, and cancel a protected request if Firefox selects an unexpected route.

Host access to all URLs is required because proxy authentication challenges relate to the websites you visit, not just GhostShield VPN domains. It also allows the extension to reach account and control services. This access is not used to scrape page content or build an advertising or browsing profile.

Service providers and international processing

We use the GhostShield VPN website and account infrastructure, Cloudflare for the browser control service, hosting providers for proxy servers, and DNS infrastructure to provide the selected filtering mode. These providers necessarily handle the data required for their part of the service. Your selected exit and its DNS providers can be in a different country from you. Account, hosting and network infrastructure may process data internationally.

The extension does not itself take payments or receive card details. Website sign-in, billing and support use the website's service providers and policies. We may disclose information as required by law or as necessary to prevent abuse or investigate security incidents. We do not sell or rent extension user data, transfer it to data brokers, or use it for personalized advertising.

How we use extension data

We use extension data only to provide, maintain and secure its disclosed browser-protection, account-access and diagnostic features. We do not use it for unrelated analytics, generalized market research, advertising, creditworthiness or lending decisions.

We transfer extension user data only as necessary to provide or secure these features, comply with applicable law, or complete a merger, acquisition or asset transfer subject to these protections. Humans do not read extension user data except with your explicit consent for specific data, when necessary for security or legal obligations, or for internal operations using aggregated and anonymized data.

Your controls and protection limits

You choose the location, DNS filters, WebRTC guard, excluded domains and optional auto-reconnect setting. Excluded domains, the GhostShield VPN website and its control API intentionally use direct connections. Disabling the WebRTC guard permits WebRTC networking according to the browser's normal settings. Disconnecting releases this extension's proxy and privacy controls; disabling or uninstalling the extension also stops its protection.

Browser-internal traffic, other applications, enterprise policy and the interval before extension startup are outside the extension's control. An unavailable proxy can block supported browsing while protection is requested; explicit disconnect releases the extension's proxy setting. No extension can guarantee anonymity or prevent every browser, operating-system or network leak.

Website visits, support and your rights

Opening the GhostShield VPN website for approval, billing, support or this policy is a website visit. Its privacy and cookie policies explain website analytics and other website processing. Those website systems are separate from the extension, which embeds no analytics SDK.

You can sign out in the extension, manage devices and delete your account in the GhostShield VPN account dashboard, or request access, correction or deletion by contacting info@ghostshield.ai. We verify requests before acting. Rights and any legally required exceptions depend on your location. You may also contact your local data-protection authority where applicable. Support information you choose to send is used to answer your request; do not include passwords, pairing secrets, tokens or browsing content in diagnostic reports.

We will update this page when the extension's data practices change and revise the last-updated date. Material changes will be disclosed through the website, extension update or other appropriate notice.