Privacy Policy

1. Who we are

Hush Erotica ("we", "us") operates Hush, from Ontario, Canada. This policy explains what personal information we collect, why, who else sees it, and what control you have over it.

Privacy officer. Our privacy officer is accountable for how Hush handles personal information and answers every privacy question and request: [email protected].

• Email: [email protected]
• Post: see section 16 of the Terms.

2. What we collect

Account information. Your email address, a display name you choose, and a password. We never store your password itself — only a bcrypt hash of it, which cannot be reversed back into the original.

Age and terms confirmation. Your date of birth, which you enter when you create an account and which we check against our 18+ requirement. We keep it as the record that the check was made. It is shown to no one else, and it is deleted with the rest of your account. Also: that you confirmed you are 18 or older, that you accepted our terms, which version you accepted, and when.

Your story preferences. Character names you enter, point of view, tropes, genres, character archetype, spice level, anything you enter in the "never include" field, your chosen narration voice, speed, and preferred length.

Stories and audio. The full text of every story generated for you, the audio narration of it, and any per-story request you typed.

Activity. When you last signed in; which published stories you have liked; which of your stories you have published.

Reports you make. If you report a published story, we record which story, the reason you chose, any detail you write, and that it was you who reported it — so an operator can review it. If you delete your account, the report is kept but is no longer linked to you.

Reports and appeals sent from the Contact page. What you write, the story you name, the reason you chose, the email address you give (optional for a report), and your account if you were signed in, along with what we decided. Kept as the record of how the complaint or appeal was handled; if you delete your account, the case is kept but no longer linked to you.

Feedback you send. What you write on the Feedback page, the story it was about if you chose one, and when. If you delete your account, the feedback is kept but no longer linked to you.

Reported stories that are deleted. If a story you published was reported and you later delete it (or your account), we keep a copy of its title, text and the reports about it for two years, as evidence of what was published and reported, and then delete it. It is not linked to your account and is seen only by our operators.

Subscription. If you subscribe, we record an identifier issued by our payment processor, which payment processor it was, whether your subscription is active, when the current paid period ends, and how many of your free stories you have used — and, once your free story has finished, when your welcome offer opened, so it can end on time. We never receive or store your card number, expiry date, or security code — those are entered on the processor's own page and never reach our servers.

Technical logs. Our server logs record the time, HTTP method, path, response status, duration, and a random per-request identifier. They do not record request bodies, story text, or your password. Because the path is recorded, logs show that a particular story identifier was accessed, but never what the story says.

Error reports. If the Service hits an unexpected error, we may send a report to an error-tracking provider to diagnose it. These reports are deliberately stripped before sending: request bodies, cookies, headers, the values of local variables, and error messages are all removed, so your prompts and story text are not included.

IP address and location. Your IP address is held briefly in memory to enforce rate limits and detect repeated failed sign-in attempts. It is not written to our database and is discarded automatically as those time windows expire. Our network provider tells us the country and region each request comes from, which we use only to apply the regional restrictions in our Terms (section 2); it is not stored.

Content checks. To keep the Service within our Content Guidelines, we record whether a request or story was refused or stopped and which rule it broke. For a story you put forward for the Global list, we keep the result of its review — including any lines it quoted — with the story.

We do not use advertising trackers, analytics pixels, or third-party cookies. The only cookies we set are the one that keeps you signed in and, where the site asks you to confirm you're 18 before entering, one that remembers you did (section 6).

3. Why we collect it

• To provide the Service — your preferences are what stories are generated from; your stories and audio are the product itself.
• To operate your account — signing you in, resetting your password, keeping your library separate from everyone else's.
• To meet our legal obligations — recording that you confirmed you are an adult and accepted our terms.
• To keep the Service working and safe — rate limiting, preventing abuse, diagnosing errors, and reviewing reports about published stories.

We do not sell your personal information, and we do not use your stories to train AI models.

4. Who else sees your information

Hush depends on third-party providers to function. Using the Service necessarily involves sending some of your information to them:

These providers are outside Canada. Your information — including story content and preferences — is processed in other countries, and may be accessible to authorities there under their laws. Each provider handles it under its own privacy policy and terms.

We may also disclose information where required by law, or where necessary to investigate a credible report of illegal content.

5. Published stories

Stories are private to your account by default. If you publish one to the Global list, the story, its audio, its title, and your display name become visible to every signed-in user — and they can download the audio. Your email address is never shown.

Before it appears, a story you publish is checked against our Content Guidelines, as the Terms (section 6) describe. Unpublishing removes it from the Global list, but we cannot recall copies other users already downloaded.

6. Cookies

We set one cookie: a signed session cookie that keeps you signed in. It is HttpOnly (unreadable by JavaScript), SameSite=Lax, and marked Secure when the Service is served over HTTPS. It contains no personal information beyond an internal account identifier.

Clearing it, or signing out, ends your session.

Where the site asks you to confirm you're 18 or older before entering, it also sets a cookie holding only that you did, for one year, so it doesn't ask on every visit.

7. How long we keep it

Your account, preferences, stories, and audio are kept until you delete them, or until the periods below apply. Individual stories can be deleted from your library at any time.

• Your account and library — while you use them. If you do not sign in for 24 months, we email you at the address on the account to say it is scheduled for deletion. If you still have not signed in 30 days after that email, the account and everything in it are permanently deleted. Signing in at any point cancels this completely and resets the 24 months — there is nothing else you need to do.
• Failed stories — 30 days. A story whose generation failed holds no text or audio; the record of the failure is deleted after 30 days.
• Lossless master audio — 30 days. Each narration is kept as a compressed file for as long as the story exists. The much larger uncompressed master is discarded after 30 days. You will not hear a difference; this is a storage measure.
• Password reset tokens — one hour, and destroyed as soon as they are used.
• Server logs — 30 days, then rotated out. Logs record request method, path, status, duration, and a request identifier.
• Copies of reported stories that were deleted — two years, then deleted (section 2).
• Backups — 30 daily and 12 monthly copies. Data you delete can persist in a backup until that copy ages out, after which it is gone from there too.

We do not delete accounts that hold an active or unpaid subscription on the inactivity schedule above, and we do not delete operator accounts that way.

8. Your rights and choices

Access and correction. Your preferences and library are visible and editable in the Service at any time.

Portability. "Download my data" on your Preferences page produces a single JSON file containing your profile, your preferences, the full text of every story you have written, the stories you have liked, and any reports you have filed. Audio is not embedded in that file — it would be hundreds of megabytes — but every narrated story in it links to its own recording, which you can save individually. Reports other people have filed about your stories are not included: those are someone else's submission, and releasing them would identify the reporter.

Deletion. You can permanently delete your account from your Preferences page. This removes your account, preferences, every story, every audio file, and your likes, and cancels any active subscription so you are not billed again. It cannot be undone. Published stories are removed from the Global list as part of this.

Two things deliberately survive deletion, both stripped of any link to you: reports you filed about other people's stories, and records of moderation decisions. These are kept because they are evidence about a story, and losing them because the person who reported it left would leave the Global list less safe. Neither is any longer connected to your account.

Some information may persist briefly in server logs and in backups until those are rotated out on their normal schedule.

Depending on where you live, you may have further rights — including data portability, objection to processing, or complaint to a regulator. In Canada, you may complain to the Office of the Privacy Commissioner. To exercise any right not available directly in the Service, contact [email protected].

9. Security

Passwords are hashed with bcrypt. Session cookies are cryptographically signed. Password reset links are single-use, time-limited, and stored only as a hash. Access to each account's stories is enforced server-side on every request. Traffic is encrypted in transit over HTTPS.

No system is perfectly secure, and we cannot guarantee absolute security.

10. Children

The Service is strictly for adults and is not directed to anyone under 18. We do not knowingly collect information from minors. If we learn that an account belongs to a minor, we will delete it. If you believe a minor has created an account, contact [email protected].

11. Changes

We may update this policy. The "last updated" date above reflects the current version, and material changes will be communicated through the Service.