Who is responsible
Wesley’s Ghost is independently operated by the creator known publicly as Stafari. The operator is responsible for the project data described here. Privacy questions and requests can be sent to stafari@proton.me. Because Stafari is a public creator name rather than a stated legal entity, any legally required controller or trader legal identity and address must be added here before international question processing or checkout is activated under this notice. Wesley’s Ghost is the seller; Clerk manages subscriptions and Stripe processes payments.
Information the service uses
| Category | What it includes | Why it is used |
|---|---|---|
| Device and account allowance | A random device identifier in a first-party wg_device cookie may be used for security and to help limit misuse. For signed-in use, the Site records the Clerk user ID or group ID, UTC calendar month, and message count. The device cookie is HTTP-only, SameSite=Lax, secure on HTTPS, and set for up to one year. | To provide and enforce Conversation Mode allowances, associate the subscription allowance with the correct account, and limit reset-based misuse. |
| Clerk account | A stable Clerk user ID, email address, and, when available, display name supplied through Clerk. Clerk also processes the credentials and session information needed to sign you in; Wesley’s Ghost does not receive your account password. | To authenticate you, show the correct account, connect an allowance and subscription to it, and protect account access. |
| Eligibility and consent | The current question or checkout request carries the applicable 18+/age-of-majority confirmation and, for questions, the separate sensitive-data consent. For a submitted question, a minimal permission receipt stores whether the subject is an account or device, a pseudonymous Site user or device ID, mode, the two notice versions, and first and last confirmation times. The receipt does not contain the question, answer, email, name, or IP address. | To limit question submission and paid subscriptions to adults, enforce the privacy gate, and retain proportionate evidence of the permission that applied to prior processing. |
| Questions | Your question and, in Conversation Mode, the recent messages sent with it. Questions may reveal religious beliefs or other sensitive matters, so share only what is necessary. | To search the approved library or generate the answer, apply safety and theological grounding, prevent abuse, and—when needed for an ordinary factual question—perform a cited web search. |
| Subscription and usage | Clerk subscription plan and billing-period information, user and group IDs, group membership, declared congregation size, and UTC calendar-month usage totals. Clerk stores subscription and billing records; the Site stores usage counts. Legacy Stripe billing records may remain where needed for prior transactions. Chat questions and card details are not stored with usage counts. | To check an active paid subscription, confirm group membership, and enforce one individual or shared group allowance. |
| Payment | Email, an internal account reference, plan details, payment method, transaction, tax, receipt, and billing details processed by Clerk and Stripe. | To offer checkout, recurring billing, receipts, payment support, fraud prevention, refunds when applicable, and tax compliance. Wesley’s Ghost does not receive or store your full card number or card security code. |
| Optional church finder | Only after browser permission, your location is rounded to an approximate area before your browser sends it directly to the official Global Methodist Church locator provider. That provider may receive normal connection data such as your IP address. | To find nearby churches for one search. Wesley’s Ghost servers do not receive or store your location. |
| Site operations | Hosting and security logs, request metadata, device/browser information, IP address, and aggregate Site analytics such as pageviews or unique visitors. When paid subscriptions are enabled, every question submission in Reference or Conversation Mode converts the connection address into a keyed one-way pseudonymous network hash and stores only that hash with short-window network and sitewide counters. Only a Conversation Mode request that is ready to call the model adds to a separate sitewide daily model-cost counter. The project database does not store the raw address in these counters. | To host, secure, troubleshoot, measure, enforce policy, limit automated or reset-based abuse in both question modes, and apply a hard daily cost circuit breaker only to Conversation Mode model calls. |
Separate consent for sensitive questions
Question submission is limited to people who separately confirm that they are at least 18 and at least the age of majority where they live. Static reading and public source links remain available without that confirmation. Before the first non-crisis question in either mode, the composer also requires a separate, unchecked sensitive-data consent. By checking it, you explicitly consent to the question—possibly including religious beliefs, health, sexuality, or other sensitive information—being processed by this Site, the creator known publicly as Stafari, OpenAI, and necessary providers only to provide and secure the response. Avoid names and other identifiers. Uncheck the consent or reload the page to withdraw it for future questions; withdrawal does not undo processing that already occurred.
A minimal permission receipt remains after withdrawal as evidence of the confirmation that applied to prior processing. It does not authorize another question: future non-crisis questions remain blocked until the separate confirmation and consent are affirmed again.
The Site checks locally for a possible immediate crisis before this consent gate so it can show urgent safety information without withholding it. That local crisis response does not send the question to Conversation Mode.
What happens to chat questions
Reference Mode searches the approved library in the Site. Conversation Mode sends the question and recent conversation context to the OpenAI Responses API. The request uses store: false, so OpenAI does not retain application state for the response. OpenAI may still keep abuse-monitoring logs containing prompts, responses, and related metadata for up to 30 days under its default API data controls. API data is not used to train OpenAI models unless the API customer has explicitly opted in.
For ordinary factual questions, Conversation Mode may use OpenAI’s web-search tool. The returned answer can contain links to public sources. Opening any external link gives that website the normal connection information your browser sends.
Service providers and international processing
The project relies on providers that process information for their own or the project’s operational purposes:
- Clerk provides account registration, sign-in, session management, group membership, invitations, and subscriptions. See Clerk’s Privacy Policy.
- OpenAI and ChatGPT Sites provide hosting, database/runtime services, safety, and the Conversation Mode API. See OpenAI’s Privacy Policy and API data controls.
- Stripe provide checkout, recurring billing, payment-method storage, transaction support, fraud prevention, receipts, subscription management, and payment support. See the Stripe Privacy Center.
- The official GMC locator and Storepoint receive the rounded approximate location only if you choose the nearby-church search.
- Public websites may receive a search query through the web-search provider or normal browser data if you open a citation or source link.
These providers may process information in the United States and other countries. ChatGPT Sites does not currently offer data or inference residency. Providers use their own contractual and legal transfer safeguards; their notices explain those practices. By using the service from another country, you understand that information may be processed outside your country, subject to applicable law.
Legal reasons for processing
Where a law requires a stated legal basis, processing is based as applicable on performing the service or subscription agreement, consent (including optional location permission), legitimate interests in operating and securing the service, and compliance with legal obligations. When a question includes special-category or similarly protected sensitive information, the project relies on the separate explicit consent at the composer where consent is a permitted basis. You may withdraw location consent through your browser and question-processing consent by unchecking or reloading; withdrawal applies to future processing and does not affect earlier lawful processing.
Family and Church privacy
Your administrator can see group membership, invitations, billing, and the shared allowance. This site does not give family or church administrators access to members’ chat text. Each person signs in separately. Select your personal account or the group whose allowance you want to use.
Retention and deletion
Wesley’s Ghost does not store the text of chat questions in its Site database. Account, subscription, usage, permission-receipt, checkout-consent, security, and billing-reference records are kept only as long as reasonably necessary to provide the service, demonstrate the permissions and recurring offer that applied to prior processing, resolve disputes, prevent fraud, and meet accounting, tax, consumer-protection, or other legal obligations. Providers keep their own records under their retention policies and legal duties.
To request access, correction, a portable copy where applicable, objection, restriction, or deletion of Site-held data, email stafari@proton.me, preferably from the address connected to the account. Identity verification may be required. Some transaction, security, or minimal permission-receipt records may need to be retained to meet legal obligations or establish, exercise, or defend claims. Deleting Site data does not itself cancel a subscription; cancel through Manage subscription or ask support to help before deletion.
Choices, children, and security
- You can use Reference Mode without signing in. Once Clerk account access is enabled, sign-in is required for a Conversation subscription.
- You can decline location permission and use the official church-finder link manually.
- The project does not sell personal information and does not use it for targeted advertising.
- Static pages and public source links may be read without age confirmation. Submitting a question or buying a subscription requires age 18 and the local age of majority. Do not submit a child’s personal information.
Reasonable technical and organizational safeguards are used, but no online service can promise absolute security. Do not include payment-card data, medical records, government identifiers, or more personal detail than the question requires.
Changes and contact
Material changes will be posted here with an updated date and, when required, additional notice or consent. Contact stafari@proton.me with a privacy question, complaint, or rights request. You may also complain to the data-protection authority available under your local law.