HushLog in

Legal

Privacy Policy

Last updated 10 September 2026

The short version. We collect your email address, an age-verification flag, the conversations you have, and the notes your companion uses to remember you. We use that to run the service and nothing else. We do not sell your data. We never store identity documents or selfies.

1. Who is responsible

Hush is operated by a sole proprietor based in South Africa, trading as Hush. We are the “responsible party” for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Privacy contact: hello@hushcompanion.com.

2. What we collect

  • Account data: your email address, a hashed password, and account created date.
  • Age verification: only a flag recording that you confirmed you are 18 or older, plus a timestamp. If we ever run a stronger check, we store the outcome and a reference from the verification provider — never the document, image or selfie itself.
  • Conversations: the messages you send to a companion and its replies.
  • Memory notes: the short facts your companion keeps so it can remember you (for example a name, a goal, something you told it once). This is the product working as intended.
  • Technical data: IP address and request metadata, used for rate limiting, abuse prevention and keeping the service up.
  • Payment data: which pack you bought, the amount, the order reference, the payment status, and the cryptocurrency or transfer reference. We do not receive or store your card details, wallet private keys, or seed phrase — payments are handled by our payment providers.

3. Why we use it

  • to provide the service — deliver replies, keep your memory, unlock credits;
  • to enforce the 18+ requirement and keep the service clean and lawful;
  • to prevent abuse, fraud and attacks, and to apply rate limits;
  • to process payments and meet our accounting and tax obligations;
  • to answer you when you contact us.

4. Who processes it for us

We use carefully selected service providers (“operators” under POPIA) who process data on our instructions:

  • Supabase — database and authentication (account and conversation storage);
  • Vercel — application hosting;
  • AI model providers — your messages are sent to a language-model provider to generate a reply;
  • Voice provider — the text of a voice message is sent to a text-to-speech provider to produce audio;
  • Crypto payment gateway and a licensed South African exchange — to receive payment and convert it;
  • Bank — for bank-transfer payments.

Some of these providers operate outside South Africa. Where personal information crosses a border we rely on POPIA section 72 — the provider is bound by contract or by law to a comparable level of protection.

5. What we never do

  • We do not sell your personal information.
  • We do not store identity documents, selfies or biometric data.
  • We do not publish or share your conversations with other users.
  • We do not use your conversations to advertise to you.

6. How long we keep it

Your account and conversations are kept while your account is open. If you ask us to delete your account, we delete your personal information and conversations. Records we must keep for tax or accounting purposes — payment records — are kept for the period the law requires (currently five years). Technical logs are kept for a short period for security purposes.

7. Your rights

Under POPIA you may ask us to:

  • confirm what personal information we hold about you, and give you a copy;
  • correct information that is wrong or out of date;
  • delete information we no longer need, or that we hold without a good reason;
  • object to processing, or withdraw a consent you gave us.

Email hello@hushcompanion.com and we will respond. If you are not satisfied, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

8. Cookies and sessions

We use the cookies strictly necessary to keep you signed in and to remember that you have passed the age gate. No advertising or third-party tracking cookies are set.

9. Adults only

Hush is not intended for anyone under 18 and we do not knowingly collect information from minors. If you believe a minor has created an account, contact us and we will remove it.

10. Security

Data is transmitted over HTTPS. Access to production data is restricted, and our database enforces row-level access rules so a user can only read their own records. No system is perfect; if we ever suffer a breach that affects you, we will notify you and the Information Regulator as POPIA requires.

11. Changes

If we change this policy materially we will update the date above and, where the change matters, tell you by email.