Privacy Policy

Ghost Studio · WhatNot Connect browser extension · Last updated October 11, 2026

This policy covers the Ghost Studio · WhatNot Connect Chrome/Edge extension and how Ghost Studio (ghost-arb.vercel.app) handles data it receives from the extension.

Single purpose

The extension’s only purpose is to connect a seller’s existing WhatNot login to their Ghost Studio account so Ghost Studio can run seller tools (for example Print Labels) on their behalf. It does not browse the web, inject ads, or collect data for any other purpose.

What the extension reads

• whatnot.com session cookies — only when you click Connect, and only cookies for the whatnot.com domain (including login tokens such as __Secure-refresh-token).
• Your Ghost Studio session cookie (ga_session on ghost-arb.vercel.app) — so the server knows which Ghost Studio user is connecting. It does not read your Ghost Studio password.

The extension never reads your WhatNot password, payment details, or browsing history. It does not run in the background after you close the popup.

What is sent, and where

When you click Connect, the extension sends those cookies once over HTTPS to https://ghost-arb.vercel.app/api/whatnot-handoff. Nothing is sent to any other server.

How Ghost Studio stores it

• WhatNot cookies are stored encrypted at rest (AES-256-GCM) and used only to call WhatNot Seller Hub APIs for your connected shop.
• Cookie values are never logged and never sold or shared with advertisers or data brokers.
• Your Ghost Studio account email and the WhatNot username we detect are kept so we can show your shop as connected and operate the tools you request.

Retention and deletion

Cookies are kept while your shop stays connected. If they expire, Ghost Studio asks you to Reconnect. To delete your stored WhatNot cookies and disconnect the shop, email harwell8267@gmail.com from your Ghost Studio account email, or use Reconnect and stop using the extension. We will delete the encrypted cookie store for your account on request.

Permissions (Chrome)

• cookies — required to read the whatnot.com session and your Ghost Studio session when you click Connect.
• Host access to https://*.whatnot.com/* — required so the cookies API can read WhatNot cookies.
• Host access to https://ghost-arb.vercel.app/* — required to read your Ghost Studio session and to POST the handoff.

No other permissions are requested.

Contact

Questions or deletion requests: harwell8267@gmail.com.

Back to Ghost Studio