Privacy

Who runs this

The site is operated as Hush. For privacy questions, data corrections, or removal requests, email hello@hush.ltd.

Look up a number or email

You type a contact into the search box. Our servers look up aggregated community data for that contact and return a score and tags. We do not require a login, and we do not build a personal profile of everything you have searched.

Like any website, our hosting layer may create short-lived technical logs (for example which URL was requested and which IP made the request) so the service stays secure and reliable. We use those logs for operations and abuse prevention — not for marketing lists.

Check an SMS or email message

When you use the message checker, the text you paste is sent to our server, analysed in memory using our own rules and pattern lists, and returned to your browser as a result. We do not add that pasted message to the public report database from the checker alone, and we do not use it to train third-party AI models.

Submit a report

If you report a number or email, we store the contact you reported, the category you chose, an optional short note you write, and a timestamp. That information is shown in aggregate on lookup pages so other people can decide whether to trust the contact.

To reduce drive-by abuse without running accounts, we also store a short reporter code alongside the report. That code is derived on the server from the IP address we see for the request (usually the first address in X-Forwarded-For when present). We do not store the raw IP in the report row. The code is intentionally coarse — it is only meant to spot repeated submissions from roughly the same connection, not to identify you personally.

Where data lives

In production we aim to keep report data in a managed database (currently Supabase when configured). The public website is served over HTTPS from Vercel. Those providers process data on their infrastructure under their own privacy terms.

In local demos or sandboxes without a database configured, reports may exist only in volatile memory for that session.

Analytics

If the operator enables Google Analytics 4, Google may set cookies or similar storage and receive page-view style events. We configure IP anonymisation in the snippet we ship. You can block analytics with a normal ad blocker or browser controls, or use Google's opt-out extension. When the measurement ID is not set, that code does not load at all.

Cookies

The core site works without non-essential cookies. If analytics is off, you should not see tracking cookies from us. If analytics is on, Google's tags may set cookies under Google's policies.

Why we can process this (UK GDPR)

We process report and lookup traffic to run a crowdsourced anti-spam tool — a legitimate interest in operating the service and keeping it useful. When you submit a report, processing the fields you send is necessary to perform the service you asked us to perform (publishing your report in the database). Where notes contain opinions about nuisance calls, that is part of the same community reporting purpose.

How long we keep things

Reports are kept so lookups stay meaningful over time. We may delete, archive, or aggregate older rows where storage or data quality makes that sensible. Technical logs on the host are rotated on the provider's schedule. If you need a specific correction or want to talk about removal, email us and we will respond in plain language.

Your rights

UK data protection law gives you rights such as access, correction, erasure, restriction, and objection in certain situations. The ICO explains them clearly for the public: ico.org.uk/for-the-public. To exercise a right about data Hush holds, contact hello@hush.ltd. If you believe we have handled data badly, you may also complain to the ICO.

Changes

When we change how the service works or who processes data, we will update this page and bump the date at the top. Significant changes to tracking will be reflected here before or as they go live.