GhostSoap at no Price.

GhostSoap is a free, local-first tool that helps people in Australia reclaim their privacy. It prepares Privacy Act requests to data brokers, recruiters and other businesses for you to send from your own mailbox. Planned milestones add tracking of every deadline and reply, an escalation file when a business does not respond, and a guide to the data hygiene steps email cannot fix.

Status: milestone M2. GhostSoap has a sourced register of Australian entities and prepares request letters for you to send yourself. It does not yet track what you sent or the replies (milestone M3). The plan sets out what comes next.

Using it

ghostsoap init                                   # your details, encrypted under a passphrase
ghostsoap plan --pack start-here                 # what would be sent, to whom and why
ghostsoap draft --pack start-here                # write the letters to the drafts folder
ghostsoap clean                                  # delete the drafts once sent
ghostsoap law                                    # each request's legal basis and deadline

plan and draft take --pack or --entry (repeatable). Without --lever, they ask each business to stop direct marketing, to stop passing your details to other marketers and to say where it got them (APP 7). Other requests are named with --lever. Requests that return your details or need your own words go to one business at a time, and those that need your own words take --detail, for example ghostsoap draft --entry equifax-au --lever s20t-correction --detail "The default listed for 2024 is not mine.". Each letter includes only the details that business needs. Overseas people-search sites, and services whose privacy policy names an overseas company with no ABN (Indeed, LinkedIn), get no letter: GhostSoap has not established that Australian privacy law reaches them (it can reach an overseas business that carries on business in Australia, under section 5B), so it shows their own search page and opt-out form instead.

Packs: start-here, marketing, people-search, property, credit, loyalty, recruitment, data-breaches, telecommunications, banks-and-lenders, insurers and retail. To ask a business you no longer deal with to destroy or de-identify your details (APP 11.2), name that request, for example ghostsoap draft --entry hays-au --lever app11-destroy (add the APP 7 levers too if you want both). With --pack, the request goes to every business in the pack that accepts it, including any you still deal with or work through, so use a pack only if you have left them all. Only you know whether you still deal with a business, so for consumer firms choose the ones you have left with --entry, for example --entry optus-au --lever app11-destroy. SEEK is in no pack. --entry seek-au alone asks SEEK for the APP 7 requests; add --lever app11-destroy to ask it to destroy what it no longer needs. Neither closes your SEEK account. Records of your employment through an agency, for example as a labour-hire worker, may be exempt from the Privacy Act (section 7B(3)); your records as a candidate are not.

Drafts are .eml files your mail program opens ready to send, or text files to post or paste into a web form; draft --copy prints them for webmail instead. They are written to a drafts folder beside your profile (or the folder --out names) and stay plaintext until you run ghostsoap clean, and your mailbox's Sent folder keeps copies. draft warns, without stopping, when it finds the drafts folder inside a Git working tree, where the letters could be committed, or inside a OneDrive, Dropbox or iCloud Drive folder, where they could be uploaded. It looks only in the usual places, so a folder it does not warn about may still be committed, synced or shared. Each draft is dated the day you made it, so check the date if you send it later, and text you give with --detail goes into the letter as you wrote it. draft --mailto also prints a ready-to-send link for a letter short enough for one; the link holds the whole letter, so it stays in your terminal's history.

With an AI agent

skills/ghostsoap/SKILL.md lets an AI agent help you choose requests and explain them, using ghostsoap plan --json and ghostsoap law --json, which need no profile. You still run init and draft and send every letter yourself.

Agent	How to add it	What it can do
Agent on your computer that reads skills, such as Muse Code	Copy skills/ghostsoap into its skills folder	Run plan and law
Grok Bot	Ask the bot to add the skill from this repository	Depends on where it runs commands: on your computer, plan and law; otherwise as a hosted agent
ChatGPT Dot and other hosted agents	Point the agent at this repository	Runs on its own computer, not yours: it reads the register or builds GhostSoap there. Never put your profile there

These routes come from third-party guides and press coverage and have not yet been tested in any of these products.

The skill is guidance, not a lock. It does not stop an agent that can read your files from reading plaintext drafts, so keep agents away from GhostSoap's data folder or use ghostsoap draft --copy, which writes no draft files. What an agent reads may reach its provider, including which businesses and requests you choose.

Safety

• Your profile is encrypted with age under your passphrase and kept in your user data folder (%LOCALAPPDATA%\GhostSoap on Windows). A lost passphrase cannot be recovered.
• Requests for access return personal information. Make them only about yourself: requesting someone else's information may be an offence. GhostSoap never puts them in a pack.
• If someone with access to your device may be watching what you do, read eSafety's guidance on device safety before you start.

What leaves your machine

Nothing from GhostSoap itself: it makes no network connections, and you send each letter yourself. An AI agent you use is separate: what it reads may reach its provider.

What it will do

• Send requests under the Australian Privacy Principles and the credit reporting rules in Part IIIA of the Privacy Act: stop direct marketing, tell me where you got my information, destroy what you no longer need, give me access, correct it.
• Keep a register of Australian data brokers, recruiters and large consumer businesses, each entry sourced and dated.
• Track deadlines and replies in an encrypted file on your computer, and export an escalation pack.
• Guide wider data hygiene: breach checks, credit bans, the Do Not Call Register, silent numbers and more.

What it will not do

• Act for you. You review and send every request yourself.
• Collect anything. There is no server, account, telemetry or analytics.
• Scrape people-search sites, solve CAPTCHAs or fill in web forms automatically.
• Promise deletion. Australian law has no general right to erasure; GhostSoap tells you what each request can and cannot achieve.

GhostSoap provides information and templates, not legal advice. For advice, contact a community legal centre or the Office of the Australian Information Commissioner.

Building

GhostSoap is written in Rust; rust-toolchain.toml pins the compiler.

cargo build --release

Licences

• Code: licensed under the Functional Source License, Version 1.1, ALv2 Future License (FSL-1.1-ALv2). You may use, modify and redistribute it for any purpose except a Competing Use as defined in LICENSE (making it available to others in a competing commercial product or service), and each version becomes available under Apache-2.0 two years after it is made available. See LICENSE and NOTICE.
• Register and checklist data (registry/ and, from milestone M4, checklist/): CC0-1.0, so other privacy projects can reuse it.

GhostSoap is not affiliated with, endorsed by or connected to Activision or the Call of Duty franchise. The name is a nod to it, nothing more.

---

_{Your details, your mailbox, your call.
Made by EquityBot. Ad gloriam eius, non meam.}