Privacy Policy

1. Project Status & Legal Framework

HushHush is currently an independent personal project, not a registered company. It is intended to be based in the EEA and operates internationally. We apply the principles of the EU General Data Protection Regulation (EU GDPR) as our baseline for data protection, and we comply with applicable laws in the jurisdictions where we operate.

Nature of the Application
HushHush is a local cryptographic utility, not a communication service. It does not operate servers, process your message content, or act as an intermediary between users.

• Encryption First: All message content is encrypted on-device before it leaves the app. HushHush never transmits, stores, or has access to unencrypted content.
• Third-Party Delivery: By default, users choose their own external channels (e.g., clipboard, share sheet) to move encrypted ciphertext. HushHush has no involvement in or visibility over that delivery.
• Optional Automation: Users may optionally link a third-party messaging service — Telegram, Matrix, or email (Gmail, Outlook, or any IMAP/SMTP mailbox) — as an automated delivery channel. HushHush routes already-encrypted ciphertext through the user's own account on that service and does not operate any relay servers, so none of that traffic reaches HushHush infrastructure. Each service's own privacy policy governs the transport layer.

2. Zero-Data Collection

In accordance with the principle of data minimisation, we do not act as a "Data Controller" for your message content:

• No Accounts: We do not require or store names, emails, phone numbers, or IP addresses.
• Local Storage: All messages and keys live exclusively on your device; there is no central server to subpoena or hack.
• No Metadata: We have no record of who you communicate with or when.

Third-party components on Android. The Android app uses Google's ML Kit to read pairing QR codes on-device. ML Kit brings Google Play Services and Google's logging transport into the app as dependencies of that decoder. HushHush does not call them and passes them no data, but we would rather name them than have you find them in the package. The iOS app uses Apple's own scanner and contains no Google components.

3. OS Interaction & Transparency

To ensure complete transparency regarding how HushHush interacts with your mobile or desktop operating system, please note the following mechanics:

A. Clipboard Access
Because HushHush relies on copying and pasting encrypted text (ciphertext) to communicate, it utilizes the native clipboard.

• Manual Only: Clipboard access is strictly manual. We only read your clipboard when you explicitly press the "Paste" button.
• No Monitoring: We do not monitor your clipboard in the background, nor do we store its contents outside your encrypted HushHush on your device.

B. OS Share Sheet Integration
When you use the "Share" button to export ciphertext to another app, HushHush hands fully encrypted data over to the native operating system.

• Encryption First: Data is encrypted through four independent layers before it leaves the app environment.
• No External Control: HushHush does not control or track the external applications you choose to share this ciphertext with.

C. Secure Storage & Hardware Protection
Critical key material is protected using your device’s native hardware-backed security.

• Hardware Keystore: Key material is held in the operating system’s own secure storage — the iOS Keychain, or the hardware-backed Keystore on Android — rather than alongside the app’s files, so a copy of the app’s data does not by itself yield the keys. We do not use the Secure Enclave. On iOS this material is stored with afterFirstUnlockThisDeviceOnly accessibility, which means it is not included in encrypted device backups: restoring a backup onto a different device will not unlock your HushHush. A device that has not yet run the app version introducing this change keeps the earlier, backup-included storage until its next launch.

D. Automation Channels (Optional)
Instead of copying and pasting ciphertext yourself, you may let HushHush carry it over an account you already have. Supported: Telegram, Matrix, and email (Gmail, Outlook, or any IMAP/SMTP mailbox). All are off until you connect them, and the app is fully usable without any of them. When any automation is active:

• Always Encrypted First: Messages are encrypted through all cryptographic layers on-device before being handed to the automation channel. The channel carries ciphertext only — it never has access to your plaintext.
• Your Account, Your Transport: HushHush uses your own account on the chosen service as the delivery channel. We do not operate relay servers. Your authentication credentials for that service are stored locally on your device using the same hardware-protected storage described above.
• Offline Queuing: If your device has no internet connection when you send a message, the encrypted ciphertext is queued locally and delivered automatically when connectivity is restored. No data is ever sent to HushHush’s infrastructure.
• Network Status: When automation is enabled, the app monitors your device’s network connectivity solely to show you accurate delivery status. This check is entirely local; no data is transmitted for this purpose.
• Third-Party Policy: The transport of your already-encrypted ciphertext via any linked service is subject to that service’s own privacy policy. HushHush has no visibility into or control over third-party infrastructure. Metadata — timing, account identity, message size, and for email the subject line and envelope — is visible to that service. Choose a transport you are comfortable being seen using.

E. Google user data (Gmail transport)
If you connect a Gmail account, HushHush requests the gmail.modify scope so it can read the HushHush-generated messages addressed to you, send your own, and label and tidy them. HushHush’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: your mail is read on your device only; it is never transmitted to any HushHush server, because there is none; it is never used for advertising; it is never sold or transferred to third parties; and it is never read by a human. Revoking access in your Google account, or disconnecting the transport in Settings, ends it immediately.

4. Plausible Deniability (Duress Mode)

HushHush includes a sophisticated Duress Password system for users in high-risk environments.

• Decoy HushHush: If you configure a Duress Password, the app creates a decoy environment populated with synthetic conversations.
• Local Generation: These fake conversations are generated entirely locally on your device from a built-in static library. No network requests or external AI services are used to generate this decoy data.
• Wipe Mode: Alternatively, a Duress Password can be set to cryptographically destroy your real HushHush by overwriting the hardware pepper, making the data permanently irrecoverable.

5. Encryption Standards

We employ a "Defense in Depth" strategy using published, peer-reviewed algorithms:

• 4-Layer Chain: AES-256-GCM, XChaCha20-Poly1305, XSalsa20-Poly1305, and AES-256-CBC + HMAC-SHA-256.
• Ultra Mode: Adds post-quantum protection via ML-KEM-1024 (NIST FIPS 203).

6. No Backdoors

There is no "forgot password" or recovery feature. If you lose your master password, your data is permanently inaccessible. We architecturally cannot comply with data requests from any authority because we possess no user data.

7. This Website

Everything above describes the app. This website, thehushhush.com, is an ordinary website, and it is the one place where we count visits.

• Hosting: The website is hosted by Vercel Inc., a US company. Like any web host, Vercel processes your IP address and browser details in order to deliver the pages.
• Visit Counting: We count page views with Vercel Web Analytics, to see which pages are read and how people find us. For each page you open it can record the page's address, the address of the page that linked you here (if your browser shares it), your browser, operating system and device type with their versions, an approximate location (country, region and city) worked out from your IP address, and the time. Our pages cut the address down to its path before a visit is counted, so no query string or # fragment is recorded.
• No Cookies: The counting sets no cookies and stores nothing in your browser. Vercel says it tells visits apart with a hash created from each request, discards that after 24 hours, and records page views without tying them to any individual or IP address, or following anyone across other websites. We see only totals, and we never connect a visit to anything in the app.
• Store-Link Taps: When you tap one of our App Store or Google Play links, that tap is counted the same way, as a view of a made-up address that names only the store and the spot on the page, for example /out/app-store/home-hero. Nothing else is added to it.
• Labels on Our Store Links: Our App Store and Google Play links, and the /get address our QR code opens, may carry a short label saying which part of this website they came from (for example web-home, web-why or web-qr). When the store opens, Apple or Google reads the label and shows us totals for it, such as how many people viewed HushHush in the store and how many downloaded it, and only once a total passes the store's own minimum. Apple and Google can also show us which website a store visit came from. We never see who tapped. What Apple and Google record when their store opens is covered by their own privacy policies. The HushHush app never reads the label.
• Your Choice: If your browser sends a Global Privacy Control or Do Not Track signal, our pages do not load the analytics script at all, so neither visits nor taps are counted, and (with JavaScript on) they also take the label off our store links. The /get address is a plain redirect and always carries its label. Blocking /_vercel/insights/script.js with a content blocker stops the counting too. The website works exactly the same either way.
• Lawful Basis: We rely on our legitimate interest in understanding, in aggregate, how the website is used (Article 6(1)(f) GDPR).
• Sign-In Page: The page the Android app uses to finish an email sign-in (/oauth2redirect) loads no analytics.

For questions regarding this policy or your data protection rights, contact us at support@thehushhush.com. EU/EEA residents may also contact their national data protection authority.