Business systems · Privacy product
GhostIDPersonal privacy control layer: browser extension and account app, in development
A browser extension that shows what a site really asks for. The paid layer never sees what you decided.
The account app on a home desk, in developmentVerified system facts
Counted in the repository, September 2026
GhostID is not public yet; nothing here is a user number. The backend is provisioned in the EU and the checkout journey is verified locally, but live sign-in, the live account purge and payments are still to be wired. The working name is pending trademark clearance.
The problem
Every sign-up asks for more than it needs, and the person clicking has no idea what is normal.
- Forms request more data categories than the service needs
- Consent decisions leave no receipt the user can point to later
- Privacy tools that store everything centrally become the honeypot
- A subscription must never become a way to hold someone's data hostage
The system
A local-first product, and a commercial layer kept strictly apart from it.
The extension analyses the structure of a form, never the values typed into it, recommends the minimum safe choice and keeps an encrypted receipt on the device. The commercial layer is a separate account app with a Supabase backend in the EU and Mollie for payments: the server computes the price, a browser return is never proof of payment, and the webhook re-fetches the state before anything changes. Access is granted by a server-verified subscription plus a signed, device-bound entitlement that the extension verifies locally, with a grace period when offline. The commercial servers hold account, subscription, device and billing basics only, and export, decrypt and delete of local data is never gated by a plan. The account app runs locally today: live sign-in and the live account purge are the next things to build.
- PageThe extension reads the structure of a request, not the values.
- RecommendA deterministic policy engine scores it and proposes the minimum safe choice.
- ReceiptAn encrypted receipt of the decision is stored on the device only.
- DecideThe user chooses; a subscription only unlocks Plus features, never the data.Human handoff
The result
A paid product whose servers know who pays,
and nothing about what you did.
- The commercial servers are designed to receive no scans, receipts, decisions or page URLs: only account, subscription, device and billing basics
- Row-level security forced on every table of the EU database, checked by hand against the live schema
- Account deletion removes the account data and keeps only the detached financial records tax rules require: verified in the demo store, the live purge still to be built
- Two adversarial reviews, findings fixed and regression-tested
From the Lab
“GhostID is the Lab's own test of a rule we hold ourselves to: the part that takes your money should never be the part that knows what you did. Two layers, kept apart on purpose, and provable in the code.”
More cases
View more cases
CalcAIAI quote software for Dutch trades
The AI drafts the quote, a deterministic engine does the arithmetic, the owner sends.
19 trades, each with its own calculation rulesAI drafts, the engine calculatesThe owner sends every quote
Kassabon.aiReceipt, warranty and claim assistant
A receipt photo becomes a warranty record with reminders and a claim letter you send.
Deterministic parsing before the modelReminders at 30, 14 and 3 daysFree and premium tier, live
Yourworkflow,oursystem
We build systems that quietly take over work. One conversation is enough to see where it starts for you.