Desktop software has no distribution layer.
No store that matters. No organic discovery surface. No shelf. So every founder shipping a DMG or an EXE ends up bidding for the same clicks as companies with ten times their lifetime value per customer.
Affordable cost per click at a 30% margin, converting at 3%.
Same keyword. Same landing page. Twelve times the budget.
Of your users have installed desktop software recently. Roughly nobody else has.
The auction is not unfair. It is working — it discovered who values the click most, and it is not you. The arithmetic in full.
Inside your app. Never inside an installer.
A templated card at a moment your own code chose. Partner icon, partner name, one line. The person can ignore it, and nothing installs unless they complete the other app's own installer themselves.
Exported interview-final.mp4 in 41s.
via GHAN · first_success slot · dismissible
Pay for users who stay.
Impressions are free. Clicks are free. You are charged when a referred install is still in use 48 hours later, and for nothing else.
| One campaign week, creator tool at €24 | Count | Billed |
|---|---|---|
| Impressions | 40,000 | €0 — never billed |
| Clicks | 1,200 | €0 — never billed |
| Install claims | 260 | €6,240 into escrow, not charged |
| Rejected by a fraud rule | 18 | refunded |
| Did not survive 48 hours | 61 | refunded |
| Cleared installs | 181 | €4,344 |
A network billing on the install event charges for all 260 and still calls it a €24 CPI. Your real cost per retained user was €34.47 — 44% above the headline. Every definition, and the methodology.
A floor that never rises. A market above it.
The rate card is a floor, not a ceiling. Anyone can always buy at it. Above it, bidding allocates priority when a category is contested — second price, so you pay one cent over the next bid, never your maximum.
Menu-bar tools, cleaners, converters, window managers. Per cleared install, macOS and Windows alike.
Screen recorders, editors, design tools, capture apps.
Developer tools, database clients, API clients, team software.
We watched them burn it all down.
OpenCandy, dead 2016. ironSource installcore, flagged by antivirus engines worldwide. AdDuplex, shut down quietly in 2023. Three mechanisms killed them, and every one of the three is optional.
What they did
- Offers placed inside the installer
- Paid on the install event
- Partners supplied their own creative
- Pre-checked boxes and silent installs
- Detection attached to the SDK, so careful integrators were flagged too
What GHAN does
- No installer-time slot exists at all
- Clears on 48 hours of real retention
- Templated cards from a payload with no markup field
- No checkbox — a card you can ignore
- Every claim checkable from the SDK source
Eight Commandments.
Written before the network had a single member, so they can be held against it afterwards. Each one costs GHAN something to keep.
Know thy buyer
They get the click. They keep the person.
The install comes from your download URL, activates your licence, appears in your billing system. GHAN never sees your users.
Never be priced out
In a search auction the clearing price is the only price.
A published floor that never rises, plus 30% of every category reserved at it. The market sets what contention is worth, on top of a guarantee rather than instead of one.
Pay only for the real
They charge on tap. The user vanishes, that is your problem.
Escrow at claim, released only if the install is still in use 48 hours later. No real usage, full refund, automatically.
Face no rival
You pay a platform to show your competitor to your own users.
Category and named-app exclusions, enforced in the SDK inside the build you signed. There is no server field that overrides them.
Earn while thou spends
Spend on Google and the money flows one way, out.
Serve placements, earn 70% of what cleared — 84% of it in value as credits. An app that serves as much as it buys never touches a card.
Appear at the perfect moment
A rectangle between baby photos and political rants.
Or: inside a relevant desktop app, right after the person finished a task successfully. Five lifecycle slots, none of them an installer.
Own what thou builds
Stop spending and you lose everything you built there.
Stop calling ghan.slot, request a payout, ship the next build without the dependency. Nothing here is load-bearing in your product.
Never punish the small
€100k/month gets premium. €500 gets scraps.
Same floor for everyone. No enterprise tier, no volume discount, no negotiated rate. The reserved 30% exists so scale cannot buy out a category.
One dependency. Two calls.
The SDK generates its own ed25519 keypair on first run, renders slots when your code asks, and emits nothing at all before your app reports consent.
import { ghan } from '@ghan/sdk'
await ghan.init({
appId: process.env.GHAN_APP_ID,
consent: settings.analyticsConsent, // nothing emitted while false
exclude: ['com.competitor.app'], // never show these
maxPerWeek: 1, // your cap, not ours
})
// You choose the moment. Nothing renders unless you call this.
await ghan.slot('first_success')Nine layers between a member app and a bad install.
Any one of them failing does not open the network, because they defend different things.
1 · Gate
Notarisation or Authenticode, clean malware scan, domain age over six months, verified contact, matching bundle id. Re-run weekly.
2 · Placement
Templated cards only. No installer slot. No remote markup — the payload has no field for it.
3 · Attribution
Single-use signed tokens, 15-minute expiry, two independent signatures required.
4 · Device
VM indicators, OS install age, salted hardware hash, clock skew, datacenter ASN resolved offline.
5 · Economics
48-hour clearing, escrow, pair caps. Cost to fake must exceed the payout.
6 · Behaviour
Cohort retention shape, signed canary probes, complaint rate.
7 · Enforcement
Flag, hold clearing, throttle, suspend and freeze escrow. Plus an instant kill switch.
8 · Data
Append-only ledger proven on a real database, row-level security, pinned TLS, no PII.
9 · Disclosure
All fourteen rejection conditions published with stable reason codes, and a monthly fraud report.
Can an AI agent onboard my app automatically?
Yes, every step except two. A coding agent can evaluate GHAN's pricing without an account, register your app, act on machine-readable gate failures, wire the SDK, run campaigns and audit every charge. Shipping the release and setting the spending ceiling stay human, deliberately.
What the agent does
Reads the public rate card with no key · registers the app · resolves gate failures from stable reason codes with eligibility dates · fetches the integration guide from a tool call · runs npx @ghan/sdk init and opens a reviewable PR · creates, pauses and resumes campaigns · reconciles get_ledger against signatures your own build produced.
What you do
Ship the release. Third-party code entering a binary you sign is a statement about what your signature means, and it should cost you ten seconds. Set the spending ceiling once. Not each payment — a cap, inside which the agent spends freely, including machine-to-machine over x402.
It needs six fields from you: app name, platform, bundle id, domain, download URL, contact email. The full walkthrough.
get_rate_card {} # public — is this worth doing
register_app { ... } # -> app_id, api_key
get_score { app_id } # -> reason codes, act on them
get_integration_guide {} # -> wire the SDK, open a PR
── human ships the release ──
top_up { app_id, amount_cents } # -> 402, or a checkout URL
create_campaign { ... } # max_bid_cents optional
get_stats / get_ledger # -> verify all of the aboveNo network statistics on this page.
GHAN is pre-launch and in its founding-partner phase. Nothing has traded, so there are no install counts to publish and this site invents none. The referee core — signing, tokens, the event-chain state machine, the append-only ledger — is built and tested against a real Postgres database.
Questions people ask about this
What is GHAN?
GHAN is a cross-promotion and paid-install network for macOS and Windows desktop applications. Member apps render each other's install cards inside their own in-app lifecycle moments, and settle through a single append-only credit ledger in which both the serving app and the receiving app have cryptographically signed every line.
Is GHAN bundleware?
No. Bundleware means extra software installed alongside the software a person asked for, usually through a pre-checked box in an installer. GHAN never places anything inside an installer. Placements appear after installation, inside the running application, as a card the person can ignore, and nothing installs unless the person clicks through and completes the other app's own installer themselves.
Which platforms does GHAN support?
Desktop only - macOS (DMG) and Windows (EXE). The version 1 SDK targets Electron, Tauri and Node desktop applications. There is no mobile product and no plan for one.
How much does GHAN cost?
There is no subscription and no minimum spend. Advertisers pay a fixed price per cleared install from a published rate card - EUR 12-18 for utilities and consumer apps, EUR 20-30 for creator tools, EUR 35-50 for prosumer and B2B. GHAN keeps 30 percent and the serving app earns the remaining 70 percent, multiplied by 1.2 when taken as network credits.
How does GHAN prove its numbers are real?
Every claim is reproducible from data the partner already holds. The ledger is append-only at the database level, every monetised event carries an independent signature from both apps involved, and the get_ledger MCP tool returns the raw signed lines with their event-chain references. A partner's agent can recompute any published number without asking GHAN to be trusted.
Machine-readable versions of this page: markdown · llms.txt · llms-full.txt · OpenAPI · AI catalog