English · Türkçe

Hush · Privacy Policy

Privacy Policy

Last updated: September 15, 2026

1. Summary

A Hush account is anonymous. We do not ask for a phone number, email address, or name. Messages are end-to-end encrypted; the server cannot read their contents. We do not sell your data. There is no advertising or tracking.

2. Data we collect and process

We process the following to operate the service:

• An anonymous identity generated on your device, and device public keys.
• Room and group membership, with timestamps.
• Encrypted messages: kept only until delivery. As soon as a message reaches all your devices it is deleted from the server; disappearing messages are deleted when their period ends.
• Encrypted media (photos, audio, files): deleted as soon as every recipient has downloaded it. If someone never downloads it, it is deleted after 7 days at the latest.
• A device notification key (push token) so we can send notifications.
• Device integrity results (Apple App Attest / Google Play Integrity).
• Short-lived IP-based request counters to limit abuse. These counters are not a lasting address record.
• Report records (complaint metadata, not message contents).

3. Retention

Encrypted messages do not wait on the server: they are deleted the moment they are delivered to all your devices. Disappearing messages are deleted when their period ends. Encrypted media is deleted as soon as every expected recipient has downloaded it; if someone never downloads it, it is deleted after 7 days at the latest. Incomplete uploads are deleted within 24 hours. Content of spaces that stay frozen for 12 months is deleted. When you delete your account, devices and sessions are closed immediately; personal records are deleted within 30 days. If the law requires us to retain data, we keep only encrypted content, which cannot be read.

4. Service providers

We use these providers to run the service:

• Cloudflare — infrastructure.
• Apple — notifications, App Attest, and the App Store.
• Google — Firebase Cloud Messaging notifications, Play Integrity, and Google Play.

5. Encryption

Messages are end-to-end encrypted. Your recovery key stays with you; the server does not store it. If you lose that key, the account cannot be recovered.

6. Your rights (KVKK / GDPR)

Under applicable data-protection law you have rights of access, erasure, and objection. You can exercise them in the app — deleting your account deletes your data; for questions and requests, use Support and Report in the app.

7. Children

Hush is not directed at children under 13, and we do not knowingly collect data from that age group.

8. Changes

Changes to this policy are published on this page, and the update date is refreshed.

9. Contact

Use Report and Support inside the app.