Last updated: September 14, 2026
Shush is a private AI chat app. The AI model runs entirely on your iPhone, so your conversations are processed on your device rather than on a server. This policy explains exactly what stays on your device, the few optional features that use the internet, and what those features send.
• Your conversations are processed and stored only on your device
• There are no accounts, ads, analytics, or tracking
• Web search is off unless you turn it on, and never sends your conversation
• Dictation, read-aloud, and reading text from photos all happen on your device
• The only information we keep is feedback you choose to send us
Everything you type, every reply the AI writes, and anything you attach is processed by the AI model running on your device. Your conversations are stored only on your device. We have no servers that receive them, and we cannot see, read, or recover them.
By default, your conversations are included in your device backups (iCloud Backup or a backup to your computer), which are handled by Apple under Apple's privacy policy. You can exclude them from backups at any time in the app's About screen. You can delete individual conversations, or all of them, from within the app.
Before you can chat, Shush downloads an AI model (such as Qwen, Gemma, or Ministral) from Hugging Face, where the model files are hosted. As with any download, Hugging Face receives your IP address and which model file was requested, under its own privacy policy. We do not send Hugging Face anything about you or your conversations.
Once downloaded, the model runs offline on your device. The companies that created these models (Alibaba, Google, and Mistral AI) receive no data from Shush.
Web search is optional and turned off by default. Shush asks for your permission before you use it for the first time, and you can turn it off at any time.
When web search is on and a question would benefit from current information, the AI model on your device usually writes a search phrase of about a dozen words or fewer, based on your question and, for follow-up questions, your previous few questions. If you ask Shush directly to search for something and the model cannot write a phrase, the text of your message is used instead, with words like "search for" removed.
Either way, the search phrase can contain words you typed, so avoid including private details in questions you want searched. The rest of your conversation, the AI's replies, and your attachments are never sent.
The search phrase is sent to a relay we operate on Cloudflare, which forwards it to Brave Search and returns up to five results. The relay:
• Does not store your search phrase
• Passes at most the first 400 characters of it to Brave
• Returns only each result's title, link, and summary to your device
• Uses a scrambled, one-way code derived from your IP address to limit how many searches each person can make per day. This code cannot be turned back into your IP address, changes every day, and is deleted automatically within a day
Because of how Cloudflare forwards requests, Brave receives your IP address along with the search phrase, as it would if you searched Brave yourself. Brave processes both under Brave's privacy policy. Our relay is hosted by Cloudflare, which processes network traffic under its own privacy policy. If you tap a source link in a reply, that website opens in your browser and receives your visit like any other.
Photos, pictures taken with the camera, and documents you attach (such as PDFs, text files, and spreadsheets) are read and processed on your device. They are stored on your device alongside the conversation they belong to and are never uploaded. Shush asks for camera permission only when you choose to take a picture, and you can change this in your device Settings.
When you speak a question, your recording is turned into text on your device using Apple's on-device speech recognition. Your voice is not sent to us or to Apple's servers. The recording is saved on your device with the conversation and is deleted when you delete that conversation. iOS may download language files for speech recognition from Apple the first time you use a language.
Replies read aloud use the voices built into iOS and are generated on your device. Shush asks for microphone and speech recognition permission only when you first use dictation, and you can change this in your device Settings.
If you choose to send feedback from within the app, we receive your message, the app version, your platform (iOS), your IP address, and your email address if you choose to provide one. We use this only to read and respond to your feedback and to improve Shush. Feedback is sent to a server we operate on Cloudflare. Sending feedback is entirely optional. To have your feedback deleted, contact us at the address below.
If you allow notifications, Shush can let you know when a model download has finished. These notifications are created on your device. We do not use push notifications and do not collect a device token.
Shush shares data with the following services only as needed to provide the features described above:
• Hugging Face receives your IP address and the requested model file when you download a model
• Brave Search receives your search phrase and IP address when web search is on
• Cloudflare hosts our search relay and feedback server and processes the network traffic sent to them
We only use third-party services whose privacy practices protect your data at least as well as this policy describes, and we will stop using any service that does not. We do not share your data with any other third parties, and we never sell it.
• Turn web search off at any time in the model menu
• Change camera, microphone, speech recognition, and notification permissions at any time in your device Settings
• Exclude your conversations from device backups in the app's About screen
• Delete individual conversations, or erase all of them from the About screen
• Ask us to delete feedback you have sent by emailing the address below
• No accounts or sign-in
• No advertising or ad networks
• No analytics, usage statistics, or behavioural tracking
• No crash reporting services
• No location data
• No contacts or address book access
• No selling of your data, and no sharing beyond the services listed above
Shush does not offer in-app purchases or subscriptions, and does not collect any payment information.
Your settings, conversations, attachments, and downloaded models are stored on your device. Downloaded models are excluded from device backups because they can be downloaded again. Deleting Shush removes all of this data from your device.
Because conversations stay on your device, you control how long they are kept. Deleting a conversation also deletes its photos, recordings, and documents. Our search relay keeps nothing beyond the daily rate-limit code described above, which expires within a day. Feedback you send is kept until you ask us to delete it.
Shush does not require an account and does not collect personal information during normal use. Web search results are filtered with Brave's strictest safe-search setting. We do not knowingly collect personal information from children under 13. If you believe a child has sent us feedback containing personal information, please contact us and we will delete it promptly.
Replies are generated by an AI model and may be inaccurate, incomplete, or outdated. Do not rely on Shush for medical, legal, financial, or other professional advice.
If we make material changes to this privacy policy, we will update this page and the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the revised policy.
If you have any questions about this privacy policy or your data, please contact us at [email protected]