Know what stays private.

Message content

Hush requires OMEMO for text and attachment keys, based on Conversations’ existing encryption implementation. Files are encrypted on the sending device before upload. The server stores ciphertext for offline delivery and synchronization. Verify contact fingerprints using a separate trusted channel, particularly when a device key changes. Encryption does not protect a compromised or unlocked phone.

Account and connection data

Your handle, password verifier, contact relationships, device public keys, group membership, message routing and timestamps remain visible to the server operator. No phone number, email address or contact permission is requested. The server can observe your IP address. Hush is pseudonymous; it does not make you anonymous to the server or network provider.

Calls and notifications

Audio and video use DTLS-SRTP with OMEMO verification required. This build forces media through the authenticated TURN relay to reduce disclosure of your IP address to another caller. The relay can observe traffic timing and addresses, but not unencrypted call audio or video. Notifications use the app’s direct XMPP connection, without a Google push service. Message notifications contain no decrypted text or contact names and are hidden on the lock screen. Incoming-call notifications and the call screen may show the caller.

Storage and retention

Server message archives and uploaded files expire after seven days, with periodic cleanup. Offline queues are bounded; unacknowledged offline messages may remain until delivered or the account is removed. Daily server backups retain up to eight days of snapshots, so deletion is not immediate in backups. Backups contain password verifiers and metadata and must be treated as private. Chat history on your phone remains until you delete it. Its protection relies on Android storage encryption and your screen lock; the app database is not separately encrypted with an app password.

Private defaults

Android cloud backup is disabled, screenshots are disabled by default, crash reporting is off, attachments use app-private storage, and read receipts, typing indicators and last-activity broadcasts start off. You can change supported preferences in the app. Account handles and private-group member handles are visible to participants. Group names and other account metadata are not end-to-end encrypted. The server disables federation and public group discovery.

Recovery and deletion

There is no phone or email recovery. Keep your password and an encrypted export from Settings → Backup. The server owner can reset an account password but cannot reconstruct lost OMEMO private keys or decrypt old messages. Use the account menu to delete an account; contacts may retain messages they already received.

Open-source basis

This independently modified application is based on Conversations 2.19.4 and uses Prosody and Coturn. It is not WhatsApp or an official Conversations release. The custom changes have not received an independent security audit. Download the complete application source and deployment scripts.