Privacy Policy

EULA · Privacy Policy

Privacy Policy

Shush Privacy Policy

Version: 2026-09-08-v1 · Applies to: the Shush mobile app and shush.watch

This Privacy Policy describes what information Shush ("Shush," "we," "us") collects when you use the app or shush.watch, why, and who else sees it. It should be read alongside the End User License Agreement, which covers your account and your content; this document covers your data.

1. Information you give us

Account: email address, first and last name, a public handle and display name you choose, and — only if you use Sign in with Apple or Google — the identity token those providers give us.
Date of birth: the date you give when you create your account. We keep it so the service can tell, on its own, when an account comes of age — a minor's protections end on their eighteenth birthday, and an under-13 account's additional protections end on their thirteenth — without ever asking you again. An adult can correct it from Profile; a minor account cannot change it.
Profile photo (optional): a photo you choose for your profile, shown to other members. Profile photos are served from a public web address, so anyone who has the address can view the photo. A profile photo is never collected from an under-13 account, which shows the account's initials instead.
Content you post: comments and reviews, tied to a timestamp in a film, show, or live event.
Reactions: emoji taps placed at moments in a film or event. Each reaction records your account, the film or event, the moment (to the nearest five seconds), the emoji, and the audience you chose (friends or global). Reactions feel low-friction, but each one is stored as an individual attributed record tied to your account — not only as an anonymous counter.
Friends: who you invite and who you accept, including any personal message attached to an invitation.
Home location (optional): if you choose to share it, an approximate or precise location used to show nearby live events. This is opt-in, never requested from a minor account, and never required to use Shush.
Support requests: anything you send to support@shush.watch.

2. Information collected automatically

Usage analytics — which screens you open and which features you use — tied to your account unless you are a minor account (never included in analytics) or have opted out. We also collect the kind of technical data any mobile app or website does to keep the service running: IP address, general device type, and request logs.

Visitors to the shush.watch marketing site are also counted through a Cloudflare Web Analytics beacon — an anonymous, browser-side script that records page views, device type, and country without tying the visit to an account.

3. The Identify feature

When you use the Identify feature — pointing your camera at your TV to identify what is playing — a photo of your screen is sent to Anthropic's Claude API for image recognition. That photo may incidentally capture your surroundings. Anthropic does not use this data to train its models under our agreement with them, and we do not store the photo after the request completes.

4. Content moderation

Comments and reviews may be screened before or after posting to catch content that violates the content rules — slurs, threats, harassment, or content matching a maintained watchlist of designated extremist material. Screening that needs judgment a simple filter cannot make is escalated to Anthropic's Claude API, which may see the comment text, a proposed handle, and your handle for that one request. Anthropic does not use this data to train its models under our agreement with them.

5. Sponsored content

Shush shows sponsored posts — paid placements from brands — alongside organic comments in certain feeds. Shush does not sell your personal data and does not share it with sponsors for targeting. Sponsorship decisions are made by Shush based on the content context (which film or event the comment feed is attached to), not on personal profile data. Sponsored posts are labeled as such when they appear.

6. Who we share information with

We share data only with the service providers that make the app work, each only for the purpose below:

| Provider | Data received | Purpose || ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- || Anthropic | TV screen photos (Identify feature); flagged comment text and handles (moderation) | Screen identification, content moderation || Resend | Email addresses (including invitees who have no Shush account); your name, handle, and any note in an invitation; sign-in codes | Transactional email || MapTiler | Your typed venue query plus coarsened coordinates (city-block precision, not exact-address precision) for geocoding; map viewport for tile requests | Venue geocoding, map tile delivery || TMDB | Your search queries; screen-read film titles; device IP addresses (via TMDB's artwork CDN when poster images load) | Film, show, and episode metadata and artwork || Neon | The entire Shush database | Primary data store || Upstash Redis | Hashed email addresses and hashed IP addresses (as key material); presence signals; cached comment counts | Sign-in codes, rate limiting, real-time presence || Cloudflare | All network traffic; Worker logs; photos in R2 object storage; admin email addresses (via Cloudflare Access); page-view telemetry from visitors to shush.watch (via Cloudflare Web Analytics beacon) | Hosting, CDN, storage, admin gate, visitor analytics on the marketing site || Apple / Google | Sign-in identity tokens | Social sign-in authentication |

MapTiler's basemap data is sourced from OpenStreetMap contributors (© MapTiler © OpenStreetMap contributors). OpenStreetMap is a data source, not a separate data processor.

We may also disclose information if required by law, or to protect the safety of Shush's users.

7. How long we keep information

Your content and account data are kept for as long as your account exists. Deleting your account (Profile → Delete account) permanently removes your comments, reactions, reviews, attributed reaction records, friendships, home location, and analytics history. Some records are retained after deletion where the law requires it — moderation records, for example, are kept to maintain the integrity of safety decisions. Records retained after deletion are documented in our internal data-retention policy. Your date of birth is kept for as long as your account exists and is deleted with it.

8. Children's privacy

Shush is not directed at children who do not meet the minimum age described in the EULA. A minor account has reduced functionality: it is never included in analytics, never offered home-location sharing, never surfaced to strangers in discovery, and is excluded from sponsored content targeting.

An account for a child under 13 exists only where a parent or guardian has given verifiable consent, which we record before the account is created. From such an account we collect only what the account needs to work: the account details a parent gives us (email address, name, a display name and handle, and the child's date of birth), the comments, reviews and reactions the child posts — which are shown to the child's friends only, never publicly — and their friend connections. We do not collect a profile photo from a child (the account shows initials), do not collect or infer location, do not include the account in analytics, do not offer the Identify camera feature, and do not show any advertising or sponsored content.

A child's date of birth is used for one thing: to know when they turn 13, at which point the under-13 protections end and the ordinary minor protections continue until 18. Nothing in the app asks a child to confirm or change their age, and a minor account cannot change its own birthdate.

A parent or guardian may review the information we hold about their child, have it deleted, or withdraw consent at any time by writing to support@shush.watch. Withdrawing consent ends the child's ability to sign in.

9. Your choices

Analytics: toggle analytics sharing at any time from Profile → Privacy.
Display name and handle: change at any time from Profile.
Date of birth: an adult can correct their date of birth from Profile → Birthdate. A minor account cannot change it.
Home location: add, change, or remove at any time from Profile.
Account deletion: delete your account at any time from Profile → Delete account. Deletion is immediate and permanent.
Blocking and muting: block someone to cut contact in both directions; mute someone to hide their content from you only.
Do Not Sell or Share: residents of certain states (including California under CCPA/CPRA) may exercise a "Do Not Sell or Share My Personal Information" right from Profile → Privacy. Because Shush does not sell or share personal data for cross-context behavioral advertising, this setting has no additional effect beyond analytics opt-out — but it is honored as a distinct signal.

10. Security

We use industry-standard measures to protect your information, including encryption in transit and at rest. Sign-in codes and approval tokens are stored as cryptographic hashes. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

11. Changes to this policy

Shush may update this Privacy Policy. Material changes are published as a new version, and you will be asked to accept the new version the next time you sign in — continued use is always preceded by that acceptance, never assumed silently.

12. Contact

support@shush.watch

Record identifier 2026-09-08-v1 — the exact string this
version's acceptance records cite.

Record identifier 2026-09-08-v1 — the exact string this version's acceptance records cite.