Hush privacy policy

Hush is a local-first text-encryption utility. The app does not require an account, does not use advertising SDKs, does not use analytics SDKs, and does not track users across apps or websites. Hush collects nothing.

What the app processes

When you encrypt or decrypt, Hush processes your message text and your secret phrase on your device to perform the cryptography. This processing happens entirely on device using Apple system frameworks (CryptoKit and CommonCrypto). Your message text and secret are not sent to any server.

How encryption works

Hush uses AES-256-GCM authenticated encryption. Your secret is converted into a key using PBKDF2-HMAC-SHA256 with 600,000 iterations. The salt and nonce used for each message are generated on device with the system secure random source. Everything needed to decrypt, except your secret, travels inside the encrypted text you choose to share.

Saved secrets and authentication

If you save a named secret, it is stored in the iOS Keychain on your device only. Saved secrets are not synced to iCloud and are protected by Face ID, Touch ID, or your device passcode through Apple's LocalAuthentication framework. The app uses authentication only to gate access to your saved secrets; it does not collect or transmit biometric data, which never leaves Apple's secure system.

Clipboard

When you copy encrypted or decrypted text, it goes to the system clipboard so you can paste it elsewhere. If you enable auto-clear, Hush clears the clipboard a short time after you copy, and only if it still holds that exact text. When you open the app, Hush may check whether a HUSH message is already on the clipboard to offer a quick decrypt. The clipboard is never transmitted off the device.

Where data is stored

Message text exists only in the active session and is discarded when you start over or leave the app. Hush keeps no message history and operates no customer database. The only data Hush stores between sessions is any named secret you explicitly save, which stays in the device Keychain.

Tracking, analytics, and advertising

Hush does not use third-party analytics, advertising SDKs, fingerprinting, cross-app tracking, or data brokers. The app does not collect data for tracking.

Data sharing

Hush does not sell, rent, disclose, or share personal data, message text, or secrets with third parties. If you share encrypted text, sharing is performed only through the Apple system share sheet to the destination you choose.

Children's privacy

Hush is a utility app and is not directed to children under 13.

Contact

For support or privacy questions, email RobertCorbin84@gmail.com.