Hush privacy policy
Hush is an Android app by Arithmetic Code AB (c/o Charma, Drottninggatan 43G, 582 27 Linköping, Sweden; org. nr 559492-5660) that filters your notifications. This policy describes what Hush does with your data.
Last updated: 13 October 2026
In short: Arithmetic Code AB does not receive any data from the app. Hush works on your phone. If you turn on optional features, your phone talks directly to the service you chose (an AI provider you have your own account with, or a weather service). Details and legal basis are in sections 3 and 6.
1. What Hush processes
Notification content. Hush uses Android's notification listener to read the notifications your phone receives. For each notification it processes the app name, the title, the text, the conversation name, the sender, and recent messages in the same conversation (when the app provides them). It uses these to decide whether a notification is NOW, LATER or IGNORE.
Calendar (optional). If you turn on meeting mode, Hush reads your calendar's busy and free times, including meeting titles, so it can stay quiet during meetings and send a short summary afterwards. Hush asks for calendar permission only when you enable this. The in-app calendar rationale says the same. Meeting titles are never sent to AI services.
Contacts (optional). If you tap "Search all contacts" in the people picker, Hush asks for contacts permission and searches your contacts by display name, so you can pick VIPs and senders. Only names (and the small contact photo shown next to a name) are read, on your device. Nothing from your contacts is uploaded or stored, except the names you choose to add, which are kept like your other settings. Without the permission the picker still works from the senders Hush has seen and typed names.
Wi-Fi network name (optional). If you set up places, Hush reads the name (SSID) of the Wi-Fi network you are connected to, to recognise places such as home or office. Android only reveals the Wi-Fi name to apps that have precise location permission, so Hush asks for that permission. Hush does not use this permission to read your location or store coordinates. (The separate weather feature uses approximate location; see section 3.)
Other settings you enter. Your names (for mention detection), VIP names you pick (from the people picker or typed), rules you write, quiet hours, and the apps you choose as work apps.
AI provider key (optional). If you choose the cloud option, you pick one provider (Anthropic, OpenAI, OpenRouter or Google Gemini) and either paste your own API key or, for OpenRouter, tap "Connect", which signs you in at openrouter.ai and creates a key for Hush. The key is stored only on your phone, encrypted with a key in the Android Keystore, and is sent only to the provider you chose. Arithmetic Code AB has no server for the app and receives none of this.
2. Where your data is stored
Everything Hush stores is stored on your device. The app's database holds the event log, rules, your feedback, simple behaviour signals (whether and how fast you opened, dismissed or replied to something, used to suggest rules and, with Pro autopilot, to apply safe ones) and conversation state. Behaviour signals stay on the device and are deleted after 30 days; "Delete all history" clears them too. Settings are stored in app-private preferences. The API key is encrypted with a key kept in the Android Keystore. Android's automatic backup is turned off for Hush.
Retention. The event log keeps notification text for 7, 14 or 30 days, as you choose in Settings (default: 14 days). Hush deletes entries older than that automatically, once a day. Done waiting items older than that and usage counters older than 60 days are deleted too.
You can delete the log, conversations, waiting items and past usage counts in Settings > System > Delete all history. Your rules and settings stay until you change them, clear the app's storage or uninstall the app.
3. What leaves your device
Only if you turn on the cloud option and add a key for your chosen provider (Anthropic api.anthropic.com, OpenAI api.openai.com, OpenRouter openrouter.ai, or Google Gemini generativelanguage.googleapis.com; one at a time, you choose):
For notifications that are not handled by rules, Hush sends the following to the provider you chose (directly from your phone, over HTTPS; with OpenRouter, OpenRouter may pass it on to the underlying model provider you selected): the app name, the notification title and text, the conversation name, the sender names and recent messages in that conversation, your names and VIP names, your free-text rules, a few of your past corrections (app, title, text, and the verdict you chose), and a short hint from Hush's keyword rules. This can include other people's names and messages (senders, group members, what they wrote to you). Put an app on the keep-local list to stop that for that app.
- Notifications from apps you put on the keep-local list (Signal is on it by default) are never sent.
- A daily cap (default 1000 calls) limits how many calls are made. Over the cap, Hush uses the on-device model.
- Reply suggestions and "Tell Hush" commands go to the same provider when the cloud option is on. For reply suggestions, Hush sends the app name, the conversation name and the recent messages in that conversation. For a "Tell Hush" command, Hush sends the text you typed, the current date, time and time zone, the names and package names of your installed apps, your recent conversation names and your mode names.
- Summaries follow the same rule. Catch-up summaries send only a count for keep-local apps.
- Work-app review (only when you tap "Ask AI to review the rest" in Rules > Never buzz > Work apps). Hush sends the names and package names of your installed apps (not apps on the keep-local list, and no notification content) to the provider you chose so it can suggest which look like work apps. This happens only when you tap the button, only with the cloud option on, a key set and the daily cap not reached. Suggestions are not applied until you confirm them.
- The chosen provider's own terms, data retention and processing rules apply to what it receives. You have your own contract with that provider through your own key or account. Terms can differ between free and paid tiers (for example, Google's Gemini API terms treat unpaid use differently from paid use), so read your provider's terms. Providers are listed with links below.
- To show a model picker, Hush asks the provider for its list of models using your key; no notification content is sent for that.
On-device models. By default, the classifier (the "Light" model, or the optional "Full" Gemma model) runs entirely on your phone and nothing is sent. The Light model compares each notification with example notifications that ship inside the app and with your own corrections, on the device only.
Weather on the cover widget (optional, off by default). If you turn on "Weather on cover widget" in Settings, Hush reads the last known approximate location from Android, rounds it to about 1 km (two decimals), and sends only those coordinates to Open-Meteo (api.open-meteo.com, no account or key) about once an hour, to show today's temperature and high/low. The result is cached on the device. Nothing else is sent, and turning the setting off deletes the cached forecast. Hush asks for the approximate location permission (ACCESS_COARSE_LOCATION) for this, and only when you turn weather on. Open-Meteo says it may log IP addresses for technical reasons and that its web server logs, which may contain coordinates, are deleted after 90 days.
Model download. The optional Full on-device model (a Gemma model, about 2.0 GB) is downloaded from Hugging Face (huggingface.co). This is a plain download request. Hush sends no notification or personal data in it. Like any web request, Hugging Face receives standard request metadata such as your IP address. The Light model file is a Hugging Face file that requires accepting Google's Gemma terms, so you add it yourself in Settings (import from storage); Hush does not download it.
Export (optional). In Settings you can export your rules and settings to a JSON file. The file goes to the location you choose, outside Hush, and is not encrypted. It can contain names (for example VIP names and your own names) and rules you wrote. It does not contain your API key, your event log or your conversations. What happens to the file afterwards is up to you.
Hush Pro purchase. Hush Pro is bought through Google Play Billing. Google handles payment and the purchase record under Google's own terms. Arithmetic Code AB does not see your payment details. Hush only keeps whether Pro is unlocked.
Third parties. These services can receive data only in the situations described above. Each handles data under its own policy:
- OpenAI (cloud option): https://openai.com/policies/privacy-policy/
- Anthropic (cloud option): https://www.anthropic.com/legal/privacy
- OpenRouter (cloud option, and sign-in with "Connect"): https://openrouter.ai/privacy
- Google Gemini API (cloud option): https://ai.google.dev/gemini-api/terms
- Open-Meteo (weather): https://open-meteo.com/en/terms
- Hugging Face (model download): https://huggingface.co/privacy
- Gemma Terms of Use (on-device models): https://ai.google.dev/gemma/terms
- Google Play (installation and Hush Pro purchase): https://policies.google.com/privacy
4. What Hush does not do
- No analytics, no advertising SDKs, no crash-reporting SDKs and no third-party tracking libraries. The Google Play Billing Library is included for the Hush Pro purchase and communicates with Google under Google’s privacy policy.
- No sale or sharing of data with third parties, other than the request to your chosen AI provider above when you turn it on, and the weather request if you turn weather on.
5. Permissions
| Permission | Why |
|---|---|
| Notification access (listener) | To read incoming notifications and decide how to handle them. |
| Do Not Disturb access | To create Hush's own Do Not Disturb rule, so other apps are silenced. |
| Notifications | To show Hush's own notifications. |
| Calendar (read) | Optional: meeting mode. |
| Precise location | Optional: only so Android lets Hush read the Wi-Fi network name for places. |
| Approximate location | Optional: only if you turn on weather. Hush reads the last known approximate location and rounds it before sending it to Open-Meteo. |
| Internet | To download the Full on-device model, to call your chosen AI provider when you turn on the cloud option (including model lists and OpenRouter sign-in), and to fetch weather if you turn it on. |
| Battery "Unrestricted" | So Android does not stop the listener in the background. |
6. Legal basis
Arithmetic Code AB does not receive any data from the app. Processing happens on your phone. When you turn on the cloud option, data goes directly between you and the AI provider you chose, with your own key or account, under your own contract with that provider. The weather lookup sends a rounded coordinate to Open-Meteo only if you turn weather on. Emails you send to hej@aricode.se are handled on the basis of legitimate interest (answering you) and kept only as long as needed.
7. Your rights
Depending on where you live, you may have rights under the GDPR, including access, correction, deletion, restriction, objection and data portability. Because Hush keeps its data on your device and you control it there, most requests can be handled by you directly in the app or by clearing its storage. For anything else, write to hej@aricode.se.
8. Children
Hush is for people aged 13 and older. It is not directed at children under 13, and we do not knowingly process data from them.
9. Changes
We will update this policy when Hush changes what it processes, and we will update the date above.
10. Contact
Questions about your data: hej@aricode.se
Data controller: Arithmetic Code AB, org. nr 559492-5660, c/o Charma, Drottninggatan 43G, 582 27 Linköping, Sweden.