Privacy policy.

Who processes the data

Data is processed by the owner of the Hush SMS service: the website hush-sms.com and the Telegram bot @HushNumBot. For questions about your data, write to support@hush-sms.com.

What data we collect

• Account: email, the password as a protected hash (we never store or see the password itself), account ID. If you sign in with Google or Telegram, also the Google identifier and email or the Telegram ID.
• Security: IP address, browser and device, approximate country and internet provider for the device list in the settings; Authenticator settings.
• Orders: service, country, the number issued, the SMS and codes received, order time and status.
• Payments: top-up and charge amounts, balance history, payment system invoice data (amount, currency, network). Bank card data never reaches us.
• API: a fingerprint of the key (we do not store the key itself) and the webhook address, if you set one.
• Notifications: if you allow browser notifications, the push subscription your browser gives us (the push service address and its encryption keys), so codes and alerts can reach you while the website is closed. Turning notifications off removes it.
• Requests: ideas and messages you send through the web account or support, and partnership applications.
• Referrals: whose link brought you and the rewards from your link.
• Telegram bot: Telegram ID, username and language, if you use the bot.

Why

• To provide the service: issue numbers, show codes, keep the balance and order history.
• To protect the account: sign-in, Authenticator, the device list and ending other sessions.
• To accept payments and resolve disputed transactions.
• To answer support requests.
• To prevent fraud and abuse and to meet legal requirements.

We do not sell data and do not use it for advertising.

Who we share data with

Only with those the service cannot work without, and only as much as the task needs:

• the hosting provider whose servers run the service;
• Resend: sending emails with verification codes;
• Cloudflare: checking at sign-up that you are not a robot;
• Google and Telegram, if you sign in through them;
• payment systems such as Heleket, to accept payments;
• the push service of your browser (Google, Mozilla, Apple or Microsoft), if you allow notifications: it receives encrypted messages it cannot read;
• number suppliers: they receive the request for a number (service and country), but not your email or name.

Cookies

The website uses only technical cookies, without which the web account does not work:

• the sign-in session: valid for up to 30 days of inactivity and no longer than 90 days;
• a sign-in or sign-up step with a code from an email: 10 minutes;
• a step with an Authenticator code: 5 minutes;
• a referral mark, if you came through an invitation: 30 days.

There are no advertising or analytics cookies. The theme and favorite services are stored in your browser and are not sent to us.

How long we keep data

Account data is kept while the account exists. Verification codes are valid for 10 minutes, and sign-in sessions expire on their own.

Order and payment records may be kept longer if they are needed for accounting, resolving disputed transactions and fraud protection.

Security

The connection to the website is protected by HTTPS. Passwords are stored as a strong hash and API keys as fingerprints. Google Authenticator protection is available for sign-in. Only those who need access to run the service have it.

Your rights

To find out what data we keep about you, correct it or delete your account, write to support@hush-sms.com from the email linked to the account. Include your account ID: it is in the web account under "Settings" → "Account". We usually answer within three business days.

Changes to the policy

We may update this policy. A new version applies from the moment it is published on this page, and the update date is shown at the top.