The Zambo privacy update: private handovers, ghost mode, and your data on your terms

This update is about control, and it starts with the delivery. When you hand work to a client through Zambo, you pick who can see it. Every handover carries a visibility setting, including a private option for work that should stay between you and the person it is for. Alongside it: Ghost Mode, a way to chat and work without the request being stored at all. And underneath both, two lines that do not move: your data is never sold, and your inputs are never used to train models. Here is what you get, piece by piece.

Private handovers: the visibility is yours to pick

Visibility is a setting you pick when you create a handover: public, unlisted, or private. There is no separate page for private handovers, and no separate private area to go looking for. The choice lives on the handover itself, made once, at the moment you create it.

Public is for delivery proof you are happy to share widely. Unlisted keeps the page reachable by its link, without listing it. Private is the restricted choice, for client work that should stay between you and the person receiving it. Pick per handover, because not every delivery needs the same audience.

Your own list of handovers lives at zambo.dev/handover/mine/. It opens only with your owner link, the private link returned when you created a handover. Open that address without the owner link and you get no list at all, only a notice that the list is private to the owner link used to open the page. The owner link works like a key: whoever holds it can open your list, so keep it where you keep keys, and share individual handovers from their own pages instead.

Private does not weaken the record. What a handover page carries is the delivery copy: the redacted publication receipts, the workflow summary receipt, and the client responses (an Accept, a Flag, your replies), each with its own receipt. An optional client email is used only to send the client a copy and is never shown publicly. Pending handover drafts waiting on payment expire after 24 hours. Withdrawing a handover hides its page and stops new responses; it cannot recall copies someone already downloaded, and public source receipts and their publication copies remain checkable by ID.

Ghost Mode: work that is not stored

Some requests should not leave a stored record behind. Ghost Mode requests are not stored to the database at all; they are processed with a privacy attestation hash. Standard requests may be logged for debugging and rate-limit enforcement, and that is stated openly here rather than buried.

What your inputs are used for is a short list: producing the answer, running the tools you asked for, keeping the service secure, and carrying continuity between your AIs. Continuity is yours to control: cross-AI memory holds only facts you explicitly save, and it does not import every chat you have ever had.

Two lines that do not move

First line: your data is never sold. There are no third-party advertising trackers, and no behavioral data is sold to ad networks. Sharing runs only to the providers that operate the service: PayPal to process payments, Resend to deliver email, AI providers to generate the output you asked for, and Replit as the hosting provider, plus disclosure if the law requires it.

Second line: your inputs are never used to train AI models. The honest caveat stays in the open: prompts are processed by third-party AI providers to generate your results, under those providers' own policies, so do not submit sensitive personal data unless the feature requires it.

Payments stay with PayPal, deletion stays one email away

Payment information is processed by PayPal. Zambo never stores your card details. Wallet addresses come into play only when you use wallet features such as the Day Pass.

If you want out, email brennanzambo@zambo.dev and request deletion; backups may retain data for up to 30 days after the request. The same address handles access requests (a copy of the data held about you), corrections, and porting your data in a machine-readable format.

The short version

Pick who can see each handover: public, unlisted, or private, with your own list locked behind your owner link. Use Ghost Mode when a request should not be stored. Your inputs are never sold and never train models. Your card details never touch Zambo's storage. And if you want your data gone, one email deletes it.

The legal text behind all of this is the Zambo privacy policy, which sets out the full list of what is collected and shared. This page is the plain-words version of what the update puts in your hands.

Frequently asked questions

Can I make a handover private?

Yes. Visibility is a setting you pick when you create a handover: public, unlisted, or private. There is no separate page for private handovers; the setting lives on the handover itself. Your own list of handovers is at zambo.dev/handover/mine/ and opens only with your private owner link, so keep that link like a key.

Who can see my handover?

It depends on the visibility you pick when you create the handover: public, unlisted, or private. The published page carries the redacted delivery copies and the workflow summary. An optional client email is used only to send the client a copy and is never shown publicly. Withdrawing a handover hides its page and stops new responses. Your own list of handovers opens only with your private owner link.

What is Ghost Mode?

A way to use Zambo without the request being stored. Ghost Mode requests are not stored to the database; they are processed with a privacy attestation hash. Standard requests may be logged for debugging and rate-limit enforcement.

Does Zambo sell my data or train models on my prompts?

No on both counts. Your data is never sold, and your inputs are never used to train AI models. Prompts are processed by third-party AI providers to generate your results, under those providers' own policies.

What does a Zambo receipt show about my work?

A receipt records the saved result of a job so it can be checked later and shown to be unchanged since it was recorded (the AER-1 record format, draft-zambo-aer1-24). It shows the record has not changed since it was saved. It does not prove the answer was right, and it does not publish your workspace or your prompts.

How do I get my data deleted?

Email brennanzambo@zambo.dev and ask. Deletion is a standing right, with backups clearing within 30 days after the request. You can also ask for a copy of the data held about you, or a correction, at the same address.

Zambo is the verifiable work layer for AI: handover, verify a receipt, Day Pass.