This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
The story
It starts with a small moment.
You open an app you have not touched in a year. Maybe it is a food delivery app, an old shopping site, a course platform you signed up for in a burst of motivation. The screen asks for an email. You type the one you always use.
No account found with this email.
You pause. You try your other Gmail. The one you made in college. The one you made for "serious things." The one you made because you forgot the password to the first one.
No account found with this email.
Now you are not sure there is an account at all. Maybe you signed up with Facebook. Maybe you used a username instead of an email, and you have no idea what you typed that day. You sit there with the cursor blinking, and you feel something odd for such a small problem: a tiny sting of embarrassment. You are locked out of something you made yourself.
So you do what everyone does. You click Forgot password? Reset here.
And the reset email goes to an inbox you stopped checking two years ago, or it never comes, or it says "if an account exists, we have sent a link," which tells you nothing. You close the app. Whatever you came here to do, you do not do it.
I have lived this loop more times than I can count, and I started to notice something. The problem was never the password. Password managers are good at that. The problem was three questions I could no longer answer:
- Which email did I use?
- What was my username?
- How do I get back in?
Every account you create quietly produces those three facts, and then your brain throws them away. Multiply that by a few hundred apps and websites, and you are carrying a hidden pile of lost context.
Then the theme of this challenge arrived: Ghost in the Machine. And it clicked. Every forgotten account is a ghost. It is something you made, abandoned, and lost track of. It still holds your name, your email, and maybe your address or your orders, sitting in a database you have not thought about in years. It is haunting your inbox, and you cannot even find it.
What I Built
So I built Ghostbook is a map of your online accounts, not a vault of passwords. It remembers which email you signed up with, which username you picked, and how to reset access, so the next time you forget, "Forgot password" works on the first click. Gemma, an open-weight model, turns messy notes into structured entries, answers questions about your accounts in plain language, and writes a haunting report about the forgotten accounts lurking in your life.
Built for the Hacktoberfest Open-Source AI Challenge, Week 4: Ghost in the Machine.
The problem
You signed up for hundreds of apps. For most of them you can no longer answer three questions:
Which email did I use?
What was my username?
How do I get back in?
So you click "Forgot password", guess an email, get a "no account found" message, and repeat. Every forgotten account is also a ghost: an old login that still holds your data and still sits in someone's database.
What it does
- Account map. Store site, email, username, login method, reset route, last used date, and notes.
- Paste to account. Paste a signup email or a rough note and Gemma extracts a structured entry for you to review and save.
- Ask your graveyard. Ask "which email did I use for my bank?" and get an answer grounded in your own entries.
- Haunting report. Plain-code checks find stale accounts, one email tied to too many accounts, and entries with no recovery route. Gemma then writes a short, spooky summary.
- Hybrid AI. Run Gemma locally with Ollama, through a cloud API (Groq or Google AI Studio), or local-first with a cloud fallback.
How It Fits "Ghost in the Machine"
The theme asks for something spooky, or something that honors the past. Ghostbook does both, and the ghost in the title is meant literally.
1. The ghosts are real. Every account you made and forgot is a ghost in someone else's machine. It still holds your name, your email, maybe your address and order history, in a database you have not thought about in years. It is not dead, it is just unattended. That is the spooky part: your past self is still out there, keeping a little of you alive without your knowing.
2. The machine is the haunted house. Hundreds of apps and websites, each holding a piece of you, each with its own login rules. You cannot walk through them all and check. Ghostbook gives you a map of the house, so you can see where the ghosts are.
3. Gemma is how the ghosts are found. The model reads the messy traces you leave behind (a signup email, a half-remembered note) and turns them into entries. It answers "which email did I use for my bank?" from your own records. Then the haunting report scores your book from Quiet to Poltergeist and writes a short, slightly spooky summary of what to deal with first. [Keep the score band names only if they are in your final UI.]
4. It honors the past. In the spirit of DÃa de los Muertos, the point is remembering what you left behind instead of letting it fade unseen. The older an account's last-used date, the more its card fades in the ledger, until it becomes a dashed-border ghost. You watch your digital past dim, and then you choose what to keep, secure, or finally let go. [Keep this only if the fading cards are built.]
5. It looks ahead to the afterlife. Your accounts outlive your attention, and sometimes they outlive you. A "digital ofrenda" mode, a list of accounts a trusted person would need to find, is on the roadmap. That one is not built yet. I am saying so plainly because honoring the past should not start with overclaiming.
Gemma powers three features:
- Paste to account. Paste a signup email or a messy note like "zomato, second gmail, username anmol_k", and Gemma extracts a structured entry. You review it, and nothing is saved until you say so.
- Ask your graveyard. Ask "which email did I use for my bank?" and get an answer grounded only in your own entries. If the answer is not there, it says so instead of guessing.
- Haunting report. Plain code finds stale accounts, one email tied to too many accounts, duplicate sites, and entries with no recovery route. Gemma then writes a short, slightly spooky summary of what to clean up first.
The interface leans into the theme quietly. The older an account's last-used date, the more its card fades, until it becomes a dashed-border ghost. You can literally watch your digital past dim. [Keep this paragraph only if the fading cards are built in your final version.]
Demo
will uplaod soon
Code
Ghostbook
Find the ghosts haunting your inbox.
Ghostbook is a map of your online accounts, not a vault of passwords. It remembers which email you signed up with, which username you picked, and how to reset access, so the next time you forget, "Forgot password" works on the first click. Gemma, an open-weight model, turns messy notes into structured entries, answers questions about your accounts in plain language, and writes a haunting report about the forgotten accounts lurking in your life.
Built for the Hacktoberfest Open-Source AI Challenge, Week 4: Ghost in the Machine.
The problem
You signed up for hundreds of apps. For most of them you can no longer answer three questions:
- Which email did I use?
- What was my username?
- How do I get back in?
So you click "Forgot password", guess an email, get a "no account found" message, and repeat. Every forgotten account is…
How I Built It
Stack: React and Vite on the frontend, FastAPI and SQLAlchemy on the backend, SQLite for storage, and Gemma as the model.
+----------------------------+
| React + Vite frontend |
| list / add / ask / report |
+-------------+--------------+
| /api (Bearer session token, held in memory only)
+-------------v--------------+
| FastAPI backend |
| |
| routers: auth, accounts, |
| ai, haunting |
| |
| security.py scrypt + Fernet
| redaction.py strip secrets before any cloud call
| llm.py provider-agnostic client
+------+---------------+-----+
| |
+----------v---+ +-----v------------------------+
| SQLite | | LLM provider (by LLM_MODE) |
| encrypted | | local : Ollama |
| fields only | | cloud : Groq / Google AI |
+--------------+ | hybrid: local, then cloud |
+------------------------------+
One client, any Gemma
LLM_MODE=local | cloud | hybrid | off
This design came from a real constraint. My laptop cannot run Gemma locally. If I had hard-wired one hosted API, that would have been the end of any privacy story. Because the client is provider-agnostic, I built against hosted Gemma while the exact same code runs against a local model on better hardware.
Being honest about what leaves your machine
That constraint made me think hard about one question: in cloud mode, what actually gets sent? I did not want to hand-wave it, so each feature sends the minimum it needs:
| Feature | Sent to the cloud provider |
|---|---|
| Paste to account | The pasted text, after passwords, OTPs, card numbers and ID-style numbers are masked |
| Ask your graveyard | Your question plus a few candidate entries picked by a local keyword filter (site, email, username, login method). Notes stay local by default |
| Haunting report | Aggregate counts only, like "14 stale accounts". No account details |
In hybrid mode, the messages are rebuilt for each provider attempt. If a request falls back from local to cloud, the redaction and minimization are applied at that moment, instead of reusing a payload that was built for the local model.
Security design
- A master passphrase is set on first run and never stored.
- scrypt turns it into a key, and every account field is encrypted with Fernet. The database holds ciphertext only.
- The key lives in server memory for the session and is dropped when the vault locks. Sessions expire after idle time, and repeated wrong passphrases trigger a lockout.
- The frontend keeps its token in memory, not in localStorage. Refreshing the page means unlocking again, by design.
- The UI always shows an AI badge (
AI: local,AI: cloud, and so on), so you can see where your data goes instead of trusting a settings page.
Things that were harder than they looked
- Getting reliable structured output from Gemma. I could not rely on JSON mode being supported everywhere, so the prompts put all instructions in a single user message, the parser strips code fences and extracts the JSON object, and it retries once with a repair instruction before giving up cleanly.
- Treating pasted text as hostile. A signup email can contain anything, including instructions aimed at the model. The prompt marks pasted text as untrusted data, and the model's output is rendered as plain text only.
- Never failing because the AI failed. The haunting report falls back to a deterministic template summary if the model is off or unreachable. The ledger itself works with no AI at all.
Why Does Open Innovation Matter?
Where you have accounts is one of the most personal things about you. It reveals your banks, your health apps, your late-night shopping, and the sites you would rather forget. That is exactly the kind of data I do not want locked inside one company's API.
Open weights gave me three things a closed API would not:
A privacy choice instead of a privacy policy. With a closed model, "where does my data go?" is answered by a vendor's terms. With Gemma, it is a setting. In local mode with Ollama, nothing leaves your machine and the app works with the internet off. In off mode, search still works with no AI at all. The AI badge in the UI is the app's answer to the question every user should ask.
No lock-in. Ollama, Google AI Studio, and Groq all run through the same client. If a provider changes its pricing, retires a model, or disappears, I change one line of config. A tool whose whole purpose is helping you remember things should not die the day someone else's service does.
A path from "my laptop can't" to "yours can." I built on hosted Gemma because my hardware could not run it. Someone with a stronger machine runs the identical code fully offline. A closed model offers no equivalent of that second option.
The Spirit of It
There is an idea in DÃa de los Muertos that people stay alive as long as someone remembers them. I think accounts work the other way around. They stay alive because nobody remembers them. Years later they are still there, quiet and forgotten, holding a little piece of who you were when you signed up.
I play games like PUBG, Valorant, and chess, but there's one frustrating thing that always catches me off guard: after taking a break or reinstalling a game, I can never remember which Gmail I used, what username I had, or whether I signed up with Google or Facebook. I've wasted time trying to recover accounts I already owned. That's where Ghostbook came from, a personal ledger that remembers the accounts I tend to forget, so the next time I return, I don't have to start guessing all over again.
Ghostbook will not bring anyone back. But it does something small and kind: it helps you remember what you left behind, and decide what to keep and what to finally let go. On my roadmap is a "digital ofrenda" mode, a list of accounts a trusted person would need to know about. Your accounts outlive your attention, and sometimes they outlive you. Someone should be able to find them.
Prize Categories
Best Use of Gemma: Gemma is the core of the project. It extracts account entries from messy text, answers questions grounded in the user's own entries, and writes the haunting report summary. It runs locally through Ollama or hosted through Google AI Studio, with the same code.
Best Use of GitHub Copilot: I leveraged GitHub Copilot to streamline architectural planning and accelerate code development. However, all core decisions regarding the product roadmap, workflow execution, feature set, and end-to-end project delivery were entirely my own.
Top comments (0)