Hush - Privacy Policy

Application ID org.mstamp.hush · Effective 25 September 2026

The short version. Hush is an SSH and mosh terminal client. It sends nothing to its developer and to no third party. Everything it stores - your hosts, your keys, your transcripts - stays in the app's private storage on your device, and the only servers it talks to are the ones you type in yourself. There is no account, no sign-up, no analytics, no advertising and no tracking of any kind.

1. Who is responsible

Hush is developed and published by Matt Stamp ("the developer", "we"). Questions about this policy or about the data Hush holds can be sent to hello@hushssh.app.

2. What Hush does

Hush opens interactive terminal sessions to servers you configure: SSH over TCP, or mosh over UDP where you turn it on. It can transfer files to and from those servers over SFTP, forward local and remote ports, attach tmux or screen sessions, and expose your hosts to other apps as storage through Android's Storage Access Framework. Every one of those connections goes to a host you entered; Hush has no server, no backend and no cloud component of its own.

3. Data the developer collects

None. Hush contains no analytics SDK, no crash-reporting SDK, no advertising library and no tracking library. It performs no update checks, sends no usage statistics, no device identifiers and no diagnostic reports, and it never contacts a server operated by the developer, because none exists. The developer therefore holds no personal data about you, and has nothing to sell, share or hand over.

4. Data Hush stores on your device

All of the following is kept in Hush's private application storage, readable only by Hush (and by you, on a device you have rooted):

Hosts - nickname, hostname or address, port, username, group, colour, and the per-host options you set (multiplexer behaviour, terminal type, keep-alive interval, jump host, post-login command, agent forwarding, tunnels-only, compression, and the rest).
Identities - SSH private keys you generate or import, their passphrases, account passwords, and any OpenSSH certificate you attach. Secrets are stored encrypted with AES-256-GCM under a non-exportable key held in the Android Keystore; the encryption key cannot be extracted from the device, and with the app lock enabled it additionally requires your biometric or device credential to unwrap.
Known host keys - the public host keys of servers you have accepted, used to detect a changed or spoofed server on the next connection.
Snippets, port forwards and groups you define.
Session transcripts - see section 6.
App settings - appearance, key bars, terminal behaviour and the toggles described below. An imported font file, if you add one, is copied into private storage.
Connection history - the time a host was last connected to and how often, so the host list can sort by recency and the home-screen widget can list recent hosts.

Hush declares itself out of Android's cloud backup and device-to-device transfer, so none of this is copied to Google Drive or onto a new phone by the system. Your data moves only by an export you make yourself.

5. Data Hush sends over the network

Only to the hosts you configure, and only what a terminal session consists of:

Your username, and the credential the server asks for - a password, a public-key signature, or a certificate - during authentication.
Keystrokes you type, and the output the server sends back.
Files you transfer over SFTP, including files you send to Hush from another app's share sheet, and files other apps read or write through Hush's storage provider.
Traffic through any port forward or tunnel you open, which Hush relays without inspecting.
With agent forwarding enabled for a host, signature requests from that host. The private key itself is never transmitted: Hush signs on the device and returns only the signature.

SSH traffic is encrypted and integrity-protected by the SSH transport; mosh sessions are encrypted with AES-128-OCB. Hush does not decrypt, log or forward this traffic anywhere else. What the operator of a server you connect to records about your session is governed by that operator's own policies, not by this one.

6. Session transcripts

Hush can keep a transcript of a session - everything the terminal displayed, which may include command output, file contents you viewed and anything a program printed. This is on by default and can be turned off at any time in Settings → Session logs.

Transcripts are plain files in Hush's private storage. They are never uploaded anywhere.
Old transcripts are pruned automatically: the most recent sessions are kept, within the size limit you choose in Settings.
You can read, delete individually, or delete all transcripts from the Session logs screen.
Sharing a transcript writes one temporary copy to Hush's cache and hands it to the app you pick in the Android share sheet. What happens to it after that is that app's business - if the transcript holds something sensitive, that choice is where it leaves Hush.

7. Permissions, and why each one is needed

INTERNET - to reach the servers you configure. Nothing else is contacted.
ACCESS_NETWORK_STATE - to notice when the network changes, so a session can be probed and reconnected instead of hanging.
FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC, FOREGROUND_SERVICE_SPECIAL_USE - to hold your open sessions and port forwards while the app is in the background, with the ongoing notification Android requires.
POST_NOTIFICATIONS - for that session notification, and for the optional alert when a long-running command finishes. Declining it does not stop Hush working.
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - offered once, optional, and only so that aggressive power management does not kill a session you left running. Declining it is fine.
Biometric / device credential - used only to unlock the app when you enable the app lock. Matching is performed by Android; Hush never sees your fingerprint, face or PIN, and stores nothing derived from them.

Hush requests no location, contacts, microphone, camera, SMS or external-storage permission, and reads no device or advertising identifier.

8. Security measures

Stored secrets are sealed with AES-256-GCM under Android Keystore keys that cannot leave the device.
The optional app lock re-wraps every stored secret under an authentication-bound key, so the secrets cannot be unsealed without your biometric or device credential.
Block screen capture (Settings) marks Hush's windows secure, hiding them from screenshots, screen recording and the recent-apps thumbnail.
Server host keys are verified against the stored known-host entry, and a mismatch is refused rather than silently accepted.
A host may place text on your device's clipboard while you are connected (what tmux copy and vim yank do over a terminal). It cannot read your clipboard. Turn this off in Settings if you would rather no host could touch it.
Exports can be encrypted with a passphrase you choose - PBKDF2-HMAC-SHA256 key derivation with AES-256-GCM. An export made without a passphrase contains your private keys and passwords in the clear; Hush warns you before writing one, and where that file then goes is your responsibility.

9. Third parties

Hush shares no data with third parties, sells no data, and contains no advertising or attribution SDK. Two parties are nevertheless worth naming:

The servers you connect to. Data you send to a host is held by whoever runs it, under their terms.
Google. If you installed Hush from Google Play, Google collects install and crash diagnostics at the platform level under its own privacy policy. This happens through Android and Google Play rather than through code in Hush, and the developer sees only aggregate, anonymised crash and installation statistics in the Play Console. Native crash reports show the developer only stack addresses and device model, never the contents of a session.

10. Children

Hush is a system administration tool. It is not directed at children, has no content aimed at them, and knowingly collects nothing from anyone - including children under 13.

11. Retention and deletion

Data stays on your device until you remove it. Deleting a host, identity, known host key or transcript in the app deletes it from Hush's database or storage.
Uninstalling Hush removes its private storage entirely - hosts, keys, settings and transcripts. Nothing survives elsewhere, because nothing was ever sent elsewhere.
The developer holds no copy of your data, so there is nothing to request the deletion of, and no deletion request to make.
Files you exported, transcripts you shared, and files you uploaded to a host are outside Hush's control once written; delete them where they live.

12. Changes to this policy

If a future version of Hush changes what is stored or where it is sent, this policy is updated before that version ships, and the effective date at the top changes with it. Material changes will also be noted in the release notes on Google Play.

13. Contact

Matt Stamp · hello@hushssh.app

Hush is free software. The terminal it draws with is a fork of ConnectBot's termlib, and its SSH transport is ConnectBot's sshlib; licences ship inside the app.