Privacy Policy

Hush. — PRIVACY POLICY

v1.2 · Effective: August 24, 2026 · Operated by: Hush. LLC

The honest version first: we built Hush. so that the most private thing you do here — what you share with another person — is also the thing we keep least. Below is exactly what we collect, why, and when it dies.

1. WHAT WE COLLECT

· Account: phone number (login + one-account-per-human), chosen display name, birthday (to verify age — never shown to anyone as a date).

· Verification: our independent verification partner processes a liveness selfie and, if needed, a government ID. WE NEVER RECEIVE OR STORE YOUR FACE SCAN OR ID — we receive only a signed confirmation ("verified adult, date"). See Section 3 (Biometric Data).

· Profile: what you choose to share — photos, bio, preferences, filters.

· Location: your device's location is converted ON YOUR DEVICE into an approximate zone (about a 3-mile cell). Your precise coordinates are never transmitted or stored. Other users see distance bands only.

· Messages and media: content you send, and metadata (who, when, what type). Media is fingerprinted and checked against banned content before delivery; we do not otherwise scan it (Section 4).

· Purchases: handled by Apple/Google; we receive entitlement status, never card numbers.

· Device and usage data: crash reports and product analytics.

2. THE BURN SCHEDULE — WHAT "DELETED" MEANS

Chats expire and media burns as shown in the app; burned content is immediately unavailable to all users. Server-side, media enters an encrypted SAFETY HOLD FOR 30 DAYS (so recipients can report abuse even after burning, and so illegal content can be preserved for authorities), then is permanently destroyed. What outlives the pixels: content fingerprints (hashes), the result of the ban-list check, and sender/recipient/time records — kept to stop banned content and banned people from returning.

3. BIOMETRIC DATA AND IDENTITY DOCUMENTS

(Illinois BIPA, Texas CUBI, and similar laws) Age assurance happens in up to two steps, and each asks separately for your consent before anything is captured:

· A liveness selfie, processed by our independent verification partner to confirm you are a live adult human.

· If needed — because the estimate was near the age line, or because you are posting a card or sending media — one photograph of a government ID, processed by the same partner to confirm your date of birth. Both are optional in the sense that you may decline; you simply cannot use the parts of Hush. they protect. Before either check runs we name the partner and link their retention policy.

Hush. NEVER RECEIVES OR STORES YOUR FACE SCAN, YOUR ID, OR ANY IMAGE OF

EITHER. From the ID we receive one field — your date of birth — and a signed confirmation. Your name, address, document number and the portrait on the document are never sent to us.

4. SAFETY ACCESS — WHO CAN SEE YOUR CONTENT

We do not run automated scanning of the content of your private messages. We deliberately do not, because reading everyone's private pictures to find rare abuse is the opposite of what this app is for. What we do instead:

· Every image is fingerprinted (a one-way hash) on upload. If it matches an image we have already banned, it is refused before delivery.

· We act on reports. When someone reports content, authorized safety personnel review it, and may review related account activity.

· When we find apparent child sexual abuse material — by any route — we preserve it, ban the account, and report to NCMEC as federal law requires. EVERY HUMAN ACCESS IS RECORDED, including access by company leadership, in a log that staff and users cannot alter or delete through the app. The other person in your chat cannot save, forward, or export your content inside Hush., and screen capture is blocked or logged — but no app can stop someone photographing a screen with a second device. Send accordingly.

5. WHO ELSE TOUCHES DATA (processors)

· Supabase and AWS — hosting and database, us-east-1.

· Didit — age and identity verification. They see the selfie and the ID; we do not (Section 3).

· Apple and Google — purchases. They see payment details; we receive only whether an entitlement is active.

· Brevo — support email, if you write to us. Each is bound by contract to use your data only to provide that service. We use no analytics, crash-reporting or advertising services at all. If that ever changes, this section changes in the same release — not afterwards. WE DO NOT SELL OR SHARE YOUR PERSONAL DATA. No ad networks.

6. LEGAL DISCLOSURES

We disclose data when legally required (subpoena, warrant, court order) and report apparent child sexual abuse material to NCMEC as federal law requires. Law-enforcement guidelines: hushdate.app/legal/law-enforcement.

7. YOUR RIGHTS (California CCPA/CPRA and similar state laws)

Access, correction, deletion, and portability — deletion is built into the app (Settings → Delete account) and is immediate. What survives deletion, under legal obligation, disclosed here: content fingerprints, safety and access logs, your consent/acceptance records, and any content under an active legal preservation. We honor these rights for everyone, not just Californians. Requests: privacy@hushdate.app.

8. RETENTION SUMMARY

Burned media: 30 days (encrypted hold), then destroyed. Chats: deleted at expiry/unmatch. Account data: deleted on account deletion. Hashes, audit logs, acceptance records: retained. Verification confirmation: retained while your account exists.

9. SECURITY

Encryption in transit and at rest; row-level access controls; media deliverable only through short-lived signed links; no public content anywhere in the service. No system is perfect — our breach response plan commits to notifying affected users per state law timelines.

10. CHILDREN

Hush. is 18+ only, enforced by verification. We do not knowingly collect data from minors; suspected minor accounts are terminated and reported where required.

11. CHANGES

Material changes require renewed in-app acceptance.

Contact: privacy@hushdate.app