Privacy Policy

COOKOO Technologies, based in Islamabad, Pakistan, operates Hush and is responsible for the personal information described in this policy. “Hush,” “we,” “us,” and “our” refer to COOKOO Technologies when it operates the Hush service.

Hush is intended only for people who are at least 18 years old. Do not use Hush if you are under 18.

Account information. Firebase Authentication receives an email address and authentication credentials when you use email sign-in. If you choose Google or Apple, that provider and Firebase provide identifiers and account details needed to authenticate you. Apple or Google may provide a name or email according to your provider settings.

Mask and profile information. We collect your pseudonymous display name and handle, aura, icon, mood, quote, privacy settings, age-confirmation timestamp, and account status. Your real name is not required for your public mask.

Content and activity. We collect confessions, comments, reactions, follows, saved posts, blocks, muted words, reports, report details, notification activity, and related timestamps. A confession or report may contain sensitive information if you choose to include it.

Operational information. We process account and mask identifiers, sign-in provider, session and security information, creation and last-active timestamps, function request information, and limited device, network, IP-address, and diagnostic metadata made available by Firebase and our hosting infrastructure.

Hush does not currently request your precise location, contacts, camera, microphone, or photo library. The current release does not include advertising, cross-app tracking, or an analytics SDK.

We use information to authenticate accounts; create and display masks and content; provide feeds, rankings, replies, reactions, follows, saves, notifications, search and privacy controls; prevent impersonation; investigate reports; enforce safety rules; secure and troubleshoot Hush; comply with law; and respond to privacy requests.

Depending on where you live, our legal basis is performance of our agreement with you, your consent where required, our legitimate interests in operating and protecting Hush, and compliance with legal obligations. You may withdraw consent where processing relies on consent, but this does not affect earlier lawful processing.

Hush automatically orders feeds and “Burning” rankings and may prioritize safety reports using activity and report signals. Material enforcement decisions are reviewed by authorized moderators or administrators rather than being based solely on automated processing.

Your active mask, profile information, confessions, comments, reactions, and follow relationships may be visible to other signed-in Hush users according to your settings. Hush is pseudonymous, not a guarantee of anonymity. Avoid posting information that identifies you or another person.

Authorized moderators and administrators can access reports, moderation records, and information needed to investigate abuse. We may disclose information when required by law, to protect a person’s safety or legal rights, or in connection with a corporate transaction subject to appropriate protections.

We use service providers including Google Firebase for authentication, database, cloud functions, storage infrastructure, and related security operations; Google for optional Google sign-in; and Apple for optional Sign in with Apple. They process only the information needed to provide their services under their own terms and contractual privacy obligations. We require providers receiving Hush data to protect it consistently with this policy and applicable law.

We do not sell personal information or share it for cross-context behavioral advertising.

Hush’s production Firebase database and cloud functions are hosted in the United States. Information may therefore be processed outside Pakistan and outside the country where you live. Where required, we use contractual safeguards, provider data-protection terms, consent, or another lawful transfer mechanism. Contact us if you want information about safeguards relevant to your location.

We use access controls, authenticated server operations, restricted administrative records, provider encryption in transit and at rest, session revocation, moderation controls, and audit logging designed to protect Hush information. No internet service can guarantee absolute security. Contact us immediately if you believe your account or information is at risk.

Hush provides controls for discoverability, replies, reactions, blocking, muting, signing out, panic wipe, and account deletion. Depending on applicable law, you may also request access, correction, deletion, restriction, portability, or a copy of your personal information; object to certain processing; withdraw consent; or appeal a privacy decision.

California residents may request the applicable access, correction, and deletion rights and will not be discriminated against for exercising them. Hush does not sell or share personal information for cross-context behavioral advertising. You may also complain to the privacy or data-protection regulator where you live.

We may ask for reasonable verification before acting on a request. We aim to complete verified requests within 30 days, or sooner where applicable law requires.

Hush is not directed to children and does not knowingly permit anyone under 18 to create a mask. If you believe a person under 18 has provided information to Hush, contact us so we can investigate and delete it.

We may update this policy when Hush, our providers, or legal requirements change. We will post the new effective date here and provide additional notice in Hush when a change materially affects your rights or how we use information.