Privacy policy
Last updated 14 October 2026
hushy is built so that we can't read your messages. This page explains what that means in practice, including the few things we do handle.
What we can't see
- Message content. Chats are end-to-end encrypted on your phone, with a post-quantum layer on top. Our relay only ever holds sealed ciphertext.
- Who you talk to. Messages are sealed so the relay can't see the sender. Mailboxes are random numbers, not accounts.
- Your phone number, email or contacts. hushy never asks for them and never uploads your address book.
- Your IP address, in the app. The apps connect through Tor, so our relay sees a Tor exit, not you.
- Who sent an anonymous message. Messages sent through a hushy.id link are encrypted in the sender's browser. Neither we nor the person receiving it learn who sent it.
What our relay stores, and for how long
- Encrypted messages until they're delivered, and at most 30 days.
- Encrypted photos, videos and voice notes until the recipient downloads them, and at most 30 days.
- Single-use invite bundles (public keys only) until they're used, and at most 7 days.
- Public handles you choose (for example hushy.id/yourname): the handle, its prompt text, and its public key, until you turn your link off.
- A push token, if you allow notifications on iPhone, so Apple can wake the app. The notification itself says only "New message".
The website
hushy.id runs on Cloudflare. Like any website, Cloudflare receives your IP address when you visit. We turned request logging off and keep no IP logs. To stop abuse, the relay counts requests per hashed IP in memory for an hour; nothing is written to disk. For stronger anonymity on the web, open hushy.id in Tor Browser.
Anonymous conversations you start on the website are saved only in your browser. If you clear it, they're gone unless you kept your private link.
On your phone
Your keys and messages are stored only on your device. Disappearing and view-once messages are deleted from both phones as described in the app. Screenshots of hushy are blocked where the system allows it.
Sharing with others
We don't sell data, show ads, or use analytics or tracking SDKs in the apps. We don't share anything with third parties except the infrastructure that runs hushy: Cloudflare (relay and website), Apple (iPhone push notifications) and the Tor network.
Requests from authorities
We can only hand over what we have: encrypted blobs we can't decrypt, random mailbox ids, and public handle details. We don't have names, phone numbers, message content or contact lists.
Children
hushy is not for children under 13.
Contact
Questions or requests: support@hushy.id.