HushOS
Sign inStart freeStart free

Last updated 20 October 2026

Privacy Policy

HushOS is designed so the Service holds as little about you as it can. This page lists exactly what is stored, what is never stored, and how long it is kept.

On this page

1. Who is responsible

HushOS, Inc., a Delaware corporation (the “Operator”) is the data controller for the information described here. HushOS is open-source software; the HushOS project does not receive any data from instances it does not run.

2. What the Service stores

Account
Email address, display name, internal account ID
Authentication
An OPAQUE registration record; verifies a sign-in without learning the password
Key bundles
Your account key wrapped by your password and by your recovery phrase, plus wrapped identity keys
Workspace
Your workspace, its storage allowance, and usage counters
Drive
The shape of your folder tree (ids, parents, times, and which account wrote each change) and encrypted names and contents the Service cannot read; each upload’s encrypted chunks in object storage. Contents are padded before encryption, so the stored size tells the Service a file’s size only roughly: anything under 256 bytes is stored as 256, and otherwise at most 6.25% is added, which leaves a file’s size known to within about 2 KiB around 50 KB, 32 KiB around 1 MB, 2 MiB around 100 MB and 32 MiB around 1 GB
Sharing
Which accounts you have shared with and in what role; for links, a hash of the link, its expiry, and a count of uses; not the link secret or password
Invites
If you signed up through an invite or a creator’s code: which account or creator it was; for your own invites, how many people joined and the storage you earned
Reports
If someone with access reports an item you shared: a snapshot of that item and its encrypted bytes, keys sealed to the operators, the reporter’s account, and the operators’ decisions
Billing
If you buy a plan: your Polar customer ID, subscription ID, plan, status, and renewal date; a record of each billing notification received. For a family plan: the family’s Polar customer ID, who pays, its subscription, the places paid for and the family’s storage. If a plan of your own was ended because you joined a family: which family, when you were let in, when the plan ended, and each refund with its amount and state
Families
If you are in a family or were invited to one: the family’s name; your membership, roles, and when you accepted, were let in or left; who invited and let in whom; the email address an invitation went to; the family’s signed member lists, which name every member’s account ID, public keys and roles, people who have left included, and who signed each one; the family’s keys and its folders’ keys, sealed so that only members’ devices can open them; how many family folders there are and their sizes, padded as your own files are; for the family folders, what the Drive row lists for your own: the shape of their folder tree (ids, parents, times, and which member wrote each change), each file’s padded size, and encrypted names and contents the Service cannot read; each key change made in them and who started it; and, while someone who manages the family is removing you, a hold on your changes in its folders
Sign-up choices
The plan or referral you chose when creating the account, until it has been used
Sessions
Session identifiers with creation and expiry times
Server logs
Timestamps, request IDs and status codes, kept briefly

Your email is used to verify your identity, deliver recovery links, and send important notices about your account. The Service cannot unwrap your key bundles.

3. What the Service never sees

  • Your password, in any form. Sign-in uses OPAQUE, which keeps it on your device.
  • Your recovery phrase in plaintext. The server stores an encrypted backup; your unlocked browser can display it again or export a recovery kit.
  • Your unwrapped account key or identity keys.
  • The names or contents of your files or folders, or anything behind a link or share, unless someone you gave access to reports it (section 8).

4. Cookies and local storage

The Service sets a session cookie so you stay signed in, a preference cookie for your chosen appearance, and a cookie that remembers whether the sidebar is open. Your browser may also hold a device key that lets your account unlock on this device without re-entering your password, and a setting for interface sounds. None of these are used for tracking or advertising, and the Service does not use third-party analytics. On the public pages (the home page, pricing, the blog and the like) the Operator may run Umami, an open-source analytics tool, on their own server. It counts page views with the referring site, browser, device type and country, sets no cookie, and stores nothing that could name you. It is never loaded once you are signed in, on the sign-in, sign-up or recovery pages, or on a shared link.

The iPhone and Android apps

The apps keep on your phone what they need to work: your session, the key that unlocks your account on this phone (in the system keychain), a copy of your folder list as the Service sends it, which stays encrypted, files you opened recently, your recent searches, and any files or folders you choose to keep on the phone. Files you open or keep are stored decrypted in the app's private storage, so they open without a connection. All of it is removed when you sign out, delete your account, or another account signs in on the phone.

The apps contain no analytics, advertising, or third-party tracking. They use the camera only when you take a photo or scan your recovery kit, and your photo library only when you choose photos to upload or save one. Transfer notifications and the iPhone's Live Activity are made on the phone itself; nothing is sent through a push service. Saving to HushOS from another app's share sheet uploads the file the same way as in the app, locked on your phone first.

5. Email

Verification and recovery emails are sent through the email provider the Operator has configured. Those emails contain a one-time link that expires after 30 minutes. The provider may keep delivery logs according to its own policy.

6. Paid plans and Polar

If the Operator offers paid plans, purchases are made through Polar Software, Inc. (“Polar”), which sells the plan as merchant of record and is responsible for the payment itself. Polar collects what it needs to take payment and issue invoices: your name, email address, billing address, tax ID where you give one, and your payment method. Your card details go to Polar and its payment processor and never reach the Service. Polar processes this data under its own privacy policy, in the United States.

The Service sends Polar your account ID, name, and email address, so that a purchase can be matched to your account; at checkout, your network address, which Polar uses to work out tax; which discount applies, if you signed up with a creator’s code; and, if you cancel a plan and give one, your reason and comment. For a family plan, the Service makes a separate Polar customer, named “HushOS family” and identified by the family’s ID, whose owner is the member who pays: that member’s account ID, name, and email address go to Polar, with the number of places paid for. Polar is not told the family’s name or who else is in it. If a plan of your own is ended because you joined a family, each refund carries a note saying so (“Moved to a HushOS family plan”, or, on an earlier payment, that it returns credit from a plan ended when its owner joined a family) and a reference made of your account ID, the family’s ID, when you were let in, and the order’s ID. The Service never sends file names, content, or any encryption key. Polar sends the Service notifications about your subscription, which the Service uses to set your storage allowance. Your invoices and payment method are managed in Polar’s customer portal, reached from Billing.

7. Families

If the Operator offers families, the Service stores what section 2 lists under Families. It cannot open the family folders. A family’s member lists are signed history: every member’s device checks the family against all of them, so the entries of people who have left stay on them.

Where the Operator sells family plans, a family’s storage covers everyone’s own files and the family folders. The people who manage a family you are in see how much space your own files take, rounded up to the whole gigabyte. They never see your files’ names, how many there are, or what is in them. Everyone in the family sees how much the family stores in all, counted the same way, so nobody sees exactly how much another person stores.

8. Reports

Anyone who can see an item through a share or a link can report it. When they do, their browser seals that item's key to the operators of this instance, so that the operators can look at what was reported and nothing else. The Service keeps a snapshot of the reported item and holds its stored bytes, even if the owner deletes it, until the report is closed; the Operator may also keep a copy in a separate evidence store. Depending on the outcome, the Operator may remove the content, suspend the uploader's account, or pass the material to a relevant authority where the law requires or permits it. The Service does not record the network addresses of people who upload, share, or report.

9. How long data is kept

  • Account data is kept until you delete your account.
  • Pending email verifications expire after 30 minutes and are then removed.
  • Sessions are removed when they expire or when you sign out. Password changes, password recovery, and key rotation revoke all existing sessions.
  • Server logs are rotated on a short schedule set by the Operator.
  • Files you delete go to the trash and are purged after 30 days, or at once if you delete them forever; a replaced version is kept for 30 days. Encrypted bytes named by an open report are kept until it is closed.
  • Stopped shares and links are removed at once; link use counts go with them.
  • Report records are kept while the report is open or on hold, and after that for as long as the Operator's obligations require; evidence copies follow the retention set on the evidence store.
  • A family invitation’s email address is forgotten 30 days after the invitation stops being open (accepted, cancelled, or expired).
  • A family’s signed member lists and key changes are kept with the family, because they are the history every member’s device checks the family against. A family is dissolved when its last member leaves it or deletes their account. 30 days later its folders and everything in them are deleted, and then its member lists, key changes, memberships and invitations. A folder a report still holds waits until the report releases it, and the family’s records wait with it; if the family’s plan is still running, the Service cancels it so that it ends with the period already paid for, without a refund, and the records wait until it has ended. The family’s billing records are kept for accounting.
  • Billing records are kept while you have an account, except the record of a plan ended because you joined a family and its refunds, which are kept after your account is deleted so that a refund still owed can be finished. Polar keeps invoices and payment records for as long as tax and accounting law requires.

Deleting your account from Account settings cancels any paid plan, asks Polar to delete your customer record, and removes your profile, workspace, storage and billing records, key bundles, and sessions immediately. Backups taken before deletion are overwritten on the Operator’s normal backup rotation.

If you are in a family, deleting your account takes you out of it, and some records keep your account ID afterwards, without your name or email address, because the family’s trust depends on them: the signed member lists and key changes that name you or that you signed, with your public keys and roles; the family’s keys and folder keys you sealed for other members; the record that you have gone, until someone who manages the family marks you as left; and, if you created the family, its creator’s ID. Files you added to the family folders stay with the family, and where a key change has re-sealed one, the record of who first wrote it keeps your account ID. So do the key changes you started in the family folders and, where a key change dropped the record of who first wrote a file or folder, the evidence of that drop: whose signature was dropped and who dropped it. These stay with the family folder they belong to. A family folder that someone who manages the family deletes is purged, with them, normally 30 days later. When the family is dissolved, its folders go with them 30 days later, and then its member lists and key changes, with the account IDs they keep (section 9). If you pay for a family’s live plan, you must cancel it before deleting your account. The family’s customer at Polar, which names whoever paid as its owner, is not deleted with your account.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can view your account details and delete your account yourself at any time. For anything else, contact the Operator of this instance at [email protected].

11. Changes

When this policy changes in a meaningful way, the date above is updated and, where practical, you are notified by email. The Terms of Service describe the agreement that this policy sits alongside.