Privacy Policy

1. Who we are

[LEGAL ENTITY NAME] ("we", "us") operates Hush. This policy explains what personal information we collect, why, who else sees it, and what control you have over it.

Privacy questions: [CONTACT EMAIL]

2. What we collect

Account information. Your email address, a display name you choose, and a password. We never store your password itself — only a bcrypt hash of it, which cannot be reversed back into the original.

Age and terms confirmation. That you confirmed you are 18 or older, that you accepted our terms, which version you accepted, and when.

Your story preferences. Character names you enter, point of view, tropes, genres, character archetype, explicitness level, anything you enter in the "never include" field, your chosen narration voice, speed, and preferred length.

Stories and audio. The full text of every story generated for you, the audio narration of it, and any per-story request you typed.

Activity. When you last signed in; which published stories you have liked; which of your stories you have published.

Reports you make. If you report a published story, we record which story, the reason you chose, any detail you write, and that it was you who reported it — so an operator can review it. If you delete your account, the report is kept but is no longer linked to you.

Subscription. If you subscribe, we record an identifier issued by our payment processor, which payment processor it was, whether your subscription is active, when the current paid period ends, and how many of your free stories you have used. We never receive or store your card number, expiry date, or security code — those are entered on the processor's own page and never reach our servers.

Technical logs. Our server logs record the time, HTTP method, path, response status, duration, and a random per-request identifier. They do not record request bodies, story text, or your password. Because the path is recorded, logs show that a particular story identifier was accessed, but never what the story says.

Error reports. If the Service hits an unexpected error, we may send a report to an error-tracking provider to diagnose it. These reports are deliberately stripped before sending: request bodies, cookies, headers, the values of local variables, and error messages are all removed, so your prompts and story text are not included.

IP address. Your IP address is held briefly in memory to enforce rate limits and detect repeated failed sign-in attempts. It is not written to our database and is discarded automatically as those time windows expire.

We do not use advertising trackers, analytics pixels, or third-party cookies. The only cookie we set is the one that keeps you signed in.

3. Why we collect it

• To provide the Service — your preferences are what stories are generated from; your stories and audio are the product itself.
• To operate your account — signing you in, resetting your password, keeping your library separate from everyone else's.
• To meet our legal obligations — recording that you confirmed you are an adult and accepted our terms.
• To keep the Service working and safe — rate limiting, preventing abuse, diagnosing errors, and reviewing reports about published stories.

We do not sell your personal information, and we do not use your stories to train AI models.

4. Who else sees your information

Hush depends on third-party providers to function. Using the Service necessarily involves sending some of your information to them:

These providers are outside Canada. Your information — including story content and preferences — is processed in other countries, and may be accessible to authorities there under their laws. Each provider handles it under its own privacy policy and terms.

We may also disclose information where required by law, or where necessary to investigate a credible report of illegal content.

5. Published stories

Stories are private to your account by default. If you publish one to the Global list, the story, its audio, its title, and your display name become visible to every signed-in user — and they can download the audio. Your email address is never shown.

Unpublishing removes it from the Global list, but we cannot recall copies other users already downloaded.

6. Cookies

We set one cookie: a signed session cookie that keeps you signed in. It is HttpOnly (unreadable by JavaScript), SameSite=Lax, and marked Secure when the Service is served over HTTPS. It contains no personal information beyond an internal account identifier.

Clearing it, or signing out, ends your session.

7. How long we keep it

Your account, preferences, stories, and audio are kept until you delete them, or until the periods below apply. Individual stories can be deleted from your library at any time.

• Your account and library — while you use them. If you do not sign in for 24 months, we email you at the address on the account to say it is scheduled for deletion. If you still have not signed in 30 days after that email, the account and everything in it are permanently deleted. Signing in at any point cancels this completely and resets the 24 months — there is nothing else you need to do.
• Failed stories — 30 days. A story whose generation failed holds no text or audio; the record of the failure is deleted after 30 days.
• Lossless master audio — 30 days. Each narration is kept as a compressed file for as long as the story exists. The much larger uncompressed master is discarded after 30 days. You will not hear a difference; this is a storage measure.
• Password reset tokens — one hour, and destroyed as soon as they are used.
• Server logs — 30 days, then rotated out. Logs record request method, path, status, duration, and a request identifier.
• Backups — 30 daily and 12 monthly copies. Data you delete can persist in a backup until that copy ages out, after which it is gone from there too.

We do not delete accounts that hold an active or unpaid subscription on the inactivity schedule above, and we do not delete operator accounts that way.

8. Your rights and choices

Access and correction. Your preferences and library are visible and editable in the Service at any time.

Portability. "Download my data" on your Preferences page produces a single JSON file containing your profile, your preferences, the full text of every story you have written, the stories you have liked, and any reports you have filed. Audio is not embedded in that file — it would be hundreds of megabytes — but every narrated story in it links to its own recording, which you can save individually. Reports other people have filed about your stories are not included: those are someone else's submission, and releasing them would identify the reporter.

Deletion. You can permanently delete your account from your Preferences page. This removes your account, preferences, every story, every audio file, and your likes, and cancels any active subscription so you are not billed again. It cannot be undone. Published stories are removed from the Global list as part of this.

Two things deliberately survive deletion, both stripped of any link to you: reports you filed about other people's stories, and records of moderation decisions. These are kept because they are evidence about a story, and losing them because the person who reported it left would leave the Global list less safe. Neither is any longer connected to your account.

Some information may persist briefly in server logs and in backups until those are rotated out on their normal schedule.

Depending on where you live, you may have further rights — including data portability, objection to processing, or complaint to a regulator. In Canada, you may complain to the Office of the Privacy Commissioner. To exercise any right not available directly in the Service, contact [CONTACT EMAIL].

9. Security

Passwords are hashed with bcrypt. Session cookies are cryptographically signed. Password reset links are single-use, time-limited, and stored only as a hash. Access to each account's stories is enforced server-side on every request. Traffic is encrypted in transit over HTTPS.

No system is perfectly secure, and we cannot guarantee absolute security.

10. Children

The Service is strictly for adults and is not directed to anyone under 18. We do not knowingly collect information from minors. If we learn that an account belongs to a minor, we will delete it. If you believe a minor has created an account, contact [CONTACT EMAIL].

11. Changes

We may update this policy. The "last updated" date above reflects the current version, and material changes will be communicated through the Service.