Privacy Policy

Hylaq Hush (“Hush”, “we”) is built to collect as little as possible. This policy covers the Hush iPhone and Android apps and hylaqhush.com. Hush is operated by Hylaq.

The short version

• No ads, no analytics, no trackers, no third-party SDKs that profile you.
• Spam Shield runs on your phone. We never receive your calls, texts, call history, or contacts.
• Hush Rooms and Hush Pages are encrypted on your device. We store ciphertext we can’t read.
• We don’t sell or share personal information.

What we collect, and why

Spam Shield

The app downloads a public spam list from /api/spam-list. That request carries no phone numbers or message content. On iPhone, matching happens inside Apple’s Call Directory and Message Filter extensions on your device. iOS only passes texts from unknown senders to the filter, never iMessages from your contacts, and the filter doesn’t send them anywhere. On Android, call screening also runs on the device.

Hush Rooms and Hush Pages

Your device encrypts content before upload. We store the encrypted data, plus the metadata needed to deliver and delete it: a random ID, creation and expiry times, size, and a hash of the owner’s management token. The decryption key is part of the link you share, after the #, and browsers don’t send that part to servers. Content is deleted when it expires or when you delete or revoke it. A sweep runs hourly, and storage also has an automatic time-to-live backstop.

@handles

When you check a handle, we send that handle to Hylaq’s registry to see if it’s available. Handles are registered and managed by Hylaq under Hylaq’s own terms.

Reports

If you report a room, page, or number, we store what you type in the report, the item ID, and the time. Reports are deleted after 90 days.

Server logs

Our hosting provider (Vercel) briefly processes standard request data such as IP address, user agent, and request time to deliver the service and prevent abuse. We use IP addresses in memory for rate limiting. We don’t build profiles from them.

What we don’t collect

• Your contacts or address book (we don’t upload it, hashed or otherwise).
• Call logs, text content, or iMessages.
• Precise location, advertising identifiers, or cross-app tracking data.

On your device

Keys for rooms and pages you create are stored on your device: in the iOS Keychain in the app, or in browser storage on the web. If you delete the app or clear browser data, you lose access to content only that device could manage. App lock with Face ID or Touch ID is handled by your device’s operating system. We never see biometric data.

Hush Pay (coming soon)

Hush Pay isn’t available yet. When it launches, payments on public blockchains, such as USDC, will be publicly visible and traceable on that blockchain. Hush encryption doesn’t make on-chain payments private.

Children

Hush isn’t directed to children under 13, and we don’t knowingly collect their data.

Your choices and rights

You can delete any room or page you own at any time. That deletes the ciphertext from our servers. You can uninstall the app to remove all local data. To ask about your data or exercise privacy rights you have under laws like the CCPA/CPRA or GDPR, email privacy@hylaqhush.com. Because we hold so little, the answer is usually short.

Security

See our security model, including what metadata we can still see and the limits of the current design.

Changes

If this policy changes, we’ll update this page and the date above. If a change is material, we’ll also tell you in the app.