Privacy Policy

Effective: 2026-03-15

Data We Collect

Simply Put

Email, username, and encrypted messages. That’s it.

Account information: your email address and username, provided during registration.
Message content: stored as encrypted blobs that our servers cannot read. The encryption key is derived from your password, which never leaves your device.
Transient metadata: your IP address is used for rate limiting during requests but is not stored persistently.
We do not store your payment information. All payment processing is handled entirely by our third-party payment processor.

Data	Collected	Stored	Shared
Email	✓ Yes	✓ Yes	✗ No
Username	✓ Yes	✓ Yes	✗ No
Messages	✓ Yes	🔒 Encrypted	⚠ To AI*
IP Address	⌛ Transient	✗ No	✗ No
Payment Info	✗ No**	✗ No	✗ No

* Sent to AI providers pseudonymously

** Handled entirely by payment processor

How We Use Your Data

Simply Put

To run the service. Nothing else.

Providing and operating the HushBox service, including routing your messages to AI models.
Maintaining the security of your account and our infrastructure.
Processing billing and maintaining financial records.
Complying with applicable legal obligations.
We do not use your data for advertising, profiling, or any purpose other than operating the service. We do not sell your data.

Third-Party Services

Simply Put

AI providers see your messages but not your identity.

We route your messages through third-party AI providers to generate responses. Your messages are sent using HushBox’s credentials, not yours — providers cannot identify you personally.
Message content is visible to AI providers during processing. This is inherent to how AI models work. Avoid including sensitive personal information (names, addresses, financial details) in your messages.
We use OpenRouter as our AI gateway service. You can review their privacy practices at openrouter.ai/privacy.
Our payment processor handles all payment transactions. We never receive or store your credit card number or bank details.

Encryption & Security

Simply Put

Your messages are encrypted with a key only you hold.

Your password never leaves your device. We use OPAQUE, a zero-knowledge password protocol, so our servers never receive your password.
Messages are encrypted before storage using your conversation’s public key. Our servers can encrypt your data but cannot decrypt it — only you hold the private key.
The encryption key for your messages is derived from your password. Without your password or recovery phrase, your data is inaccessible to everyone, including us.
All data in transit is protected by HTTPS/TLS encryption.
If you lose both your password and your recovery phrase, your encrypted data cannot be recovered by anyone.

How your data flows through HushBox

You type a message

Your words, your keyboard, your device.

Sent securely over HTTPS

Standard TLS encryption in transit.

HushBox routes to AI model

Using our credentials, not yours. Pseudonymous.

AI responds

The model generates a response to your prompt.

Both messages encrypted

Encrypted with your conversation's public key.

Stored as encrypted blobs

Our servers CANNOT decrypt them — even if we wanted to.

You fetch the encrypted data

Downloaded to your browser over HTTPS.

Decrypted in your browser

Using your private key, derived from your password. Only you can read your messages.

See it for yourself

What you type:

This is private.

↑ This is all our servers see. Without your password, it's meaningless.

How we compare

	Your current AI chat app	HushBox
Messages stored encrypted	Plaintext	Encrypted
Provider can read your chats	Yes	No
Password sent to server	Yes	Never

Data Retention & Deletion

Simply Put

Messages are stored while your account is active. You can delete conversations at any time.

Your messages are stored in encrypted form for as long as your account is active.
You can delete individual conversations at any time. Deletion is permanent — deleted data cannot be recovered.
Anonymized billing records (transaction amounts, dates) are retained for financial and legal compliance.

Cookies & Storage

Simply Put

One encrypted session cookie. No trackers.

We use a single encrypted session cookie to keep you signed in. It contains no personal data.
Small amounts of data are stored in your browser’s local storage for UI preferences (such as sidebar state and panel width). This data never leaves your device.
We do not currently use any analytics or tracking tools. We do not use third-party cookies.
We do not track you regardless of your browser’s Do Not Track setting, because we do not track you at all.

Children’s Privacy

Simply Put

You must be 13 or older to use HushBox.

HushBox is not intended for use by anyone under the age of 13.
We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

Changes to This Policy

Simply Put

Changes are effective when posted.

We may update this Privacy Policy from time to time. Changes are effective when posted on this page.
Your continued use of HushBox after changes are posted constitutes your acceptance of the updated policy.
We encourage you to review this page periodically.

Contact

Simply Put

Reach out anytime.

For privacy-related inquiries, contact us at [email protected].
LOME-AI LLC, Indiana, United States.

Privacy Policy

Data We Collect

Privacy Nutrition Label

How We Use Your Data

Third-Party Services

Encryption & Security

How your data flows through HushBox

See it for yourself

How we compare

Data Retention & Deletion

Cookies & Storage

Children’s Privacy

Changes to This Policy

Contact