What we never do
Five rules Hush SMS works by:
- No ads. There are none on the website or in the web account.
- No trackers. No Yandex Metrica, no Google Analytics, no ad pixels. Cookies are technical only: signing in to the web account and the referral mark.
- No third-party scripts. The website and the blog load files only from hush-sms.com, even the fonts. The web account has one outside service: the Cloudflare check at sign-up that you are not a robot.
- We never sell data and never use it for advertising.
- Suppliers never learn who you are. A number supplier only gets the request: which service and which country. No email, no name.
Check it yourself in a minute
- Open any page of the website, this one for example.
- Press F12 (on a Mac: Cmd+Option+I) and open the Network tab.
- Reload the page. Every request goes to hush-sms.com: not a single call to analytics or ad services.
This is not just a promise but a rule for your browser. The server response carries a Content-Security-Policy header with script-src 'self': the browser will not run a script from another address on our pages, even if someone tries to slip one in.
What we keep and for how long
| Data | Why | How long |
|---|---|---|
| Email and the password as a hash | Signing in. We never store or see the password itself | While the account exists |
| Orders: number, service, country, the SMS received | Order history and resolving disputes | While the account exists |
| Payments and balance history | Balance and accounting. Card data never reaches us | As long as accounting needs them |
| Sign-in devices: browser, IP, approximate country | The device list in the settings, so you can see and end other sessions | While the account exists; a session itself expires after 30 days without activity |
| Website visit log: page, where you came from, browser, IP without its last part | Knowing which pages people read | 30 days, then deleted automatically |
| Sign-in codes sent by email | Confirming the email is yours | 10 minutes |
| Browser notification subscription | Sending codes while the website is closed | While notifications are on |
Order and payment records may be kept longer when accounting, resolving disputes or fraud protection needs them.
Who we share data with
Only those the service cannot work without, and only what the task needs:
- the hosting provider whose servers run the website;
- Resend, to send the email with your sign-in code;
- Cloudflare, to check at sign-up that you are not a robot;
- Google or Telegram, if you sign in with them;
- a payment system such as Heleket, when you top up;
- your browser's push service, if you turned notifications on: it carries encrypted messages and cannot read them;
- the number supplier: only the service and the country.
To see or delete your data
Write to support@hush-sms.com from the email linked to your account and include your account ID: you find it in the web account under Settings → Account. We usually reply within three business days. Abuse reports go to the same address.
Sign in with email, Google or Telegram. A number for your SMS code in a couple of minutes, in the bot or on the website.