Legal

Privacy Policy

Last updated: April 28, 2026

Hush is built on one principle: your messages are yours. We cannot read them. We will never sell your data. This policy explains exactly what we collect, why, and how it's protected.

Who we are

Hush is a life continuity app that stores your messages, important information, and account access, delivering them to your chosen recipients only if you become unavailable. We operate at joinhush.app and can be reached at hello@joinhush.app.

What we collect

We collect only what's necessary to run the service:

Your name and email address when you create an account
Your phone number for inactivity verification SMS
Your recipients' names, email addresses, and phone numbers
Encrypted message content and important information entries — we store only the encrypted version and cannot read the contents
Check-in timestamps and activity logs
Device token for push notifications (when enabled)
Subscription status via RevenueCat

How your messages are protected

Every message and piece of important information you write in Hush is encrypted on your device before it reaches our servers using AES-256-GCM encryption. This means:

We store only encrypted data — never plain text
We cannot read your messages under any circumstances
No Hush employee can access your vault contents
Even in the event of a data breach, your message contents are protected

How we use your information

We use your information exclusively to operate the Hush service:

To send your monthly check-in notifications
To execute the graduated inactivity verification sequence
To deliver your messages to recipients when triggered
To manage your subscription
To send service-related emails from hello@joinhush.app

We do not use your information for advertising. We do not sell your data. We do not share your data with third parties except as described below.

Third parties we work with

To operate Hush, we use the following services:

Supabase — database and authentication infrastructure. Your encrypted data is stored on Supabase servers.
Resend — email delivery for check-in reminders and vault delivery emails.
Twilio — SMS delivery for inactivity verification messages.
RevenueCat — subscription management. They process your App Store purchase data.
Apple — push notification delivery via APNs.

Each of these providers operates under their own privacy policies and data agreements. We share only the minimum information required for each service to function.

Data retention

We retain your data for as long as your account is active. If you delete your account, all of your data — including encrypted messages, recipients, and check-in history — is permanently deleted within 30 days. Delivery logs may be retained for up to 90 days for operational purposes.

Your rights

You have the right to:

Access all data we hold about you
Request correction of inaccurate data
Request deletion of your account and all associated data
Export your vault contents at any time from within the app
Withdraw consent for communications at any time

To exercise any of these rights, contact us at hello@joinhush.app.

Children

Hush is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

Changes to this policy

If we make material changes to this policy, we will notify you by email and update the date at the top of this page. Continued use of Hush after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Email us at hello@joinhush.app. We'll respond within 48 hours.