Skip to content
Hushd
Open app
02 / 04

Privacy

Hushd is built so that we learn as little as possible about you. This page says what that means in practice, including what we cannot keep private.

Last updated 9 November 2026

Who runs Hushd

Hushd is open-source software run by Arham Khan at hushd.net, on NEAR testnet. There is no company behind it. This page covers the website and app at hushd.net, the hosted MCP server at hushd.net/mcp, and the Hushd API at api.hushd.net. For anything about it, open an issue on GitHub.

What we do not collect

  • There are no Hushd accounts. We never ask for your name, email or any other personal details.
  • We never see your seed, your spending key or your notes. They are made and kept on your device, and nothing we run can spend for you.
  • We do not sell data, and we do not run ads or ad trackers.

What is kept on your device

  • Your notes, in your browser's storage, encrypted with AES-GCM under a key from your seed. Without the seed they are unreadable.
  • With a passkey, which account it opens. With a NEAR wallet, nothing secret: your wallet signs the same message again each time you open your balance.
  • Your theme and your cookie choice.

Clearing this site's data removes all of it. Every note you make for yourself is also on the board, sealed to you, so your seed alone recovers your balance. See cookies and storage.

What is public on NEAR

Some things are public because they happen on a public blockchain, and nobody, including us, can remove them:

  • Deposits into the pool and cash outs from it, with the NEAR account, the token and the amount.
  • That a desk deal happened, its maker, its settlement class, its bond and how it ended.
  • The hedge order of a hedged deal, on the desk and on Hyperliquid testnet.
  • Board posts, which are ciphertexts that only their recipient can open.

What happens inside the pool, and who traded what, is not public. The full list is in the privacy model.

What our services see

Request metadata. Like any web server, the API, the relayer and the hosted MCP server see the IP address and timing of each request. Hushd's own services keep IP addresses only in memory, to limit request rates. The hosting providers that serve the site and the API may keep their usual access logs.

Sealed content. The API stores what the desk needs to work: sealed requests, the asks sealed to each maker, sealed quotes, sealed deal room messages and match results, plus the public events it indexes from the chain. It cannot open anything sealed. The relayer sees the actions it sends, which are public once on chain anyway, and never your keys.

Testnet data may be deleted at any time, for example when the testnet contracts are deployed again.

Plain-language intake

When you describe a deal in words, your browser encrypts the text to a model on NEAR AI Cloud whose TEE attestation has been verified, and checks the model's signed answer. Our API only passes the ciphertext on with an API key; it cannot read your words, and neither can the NEAR AI gateway. The model reads them inside its TEE. NEAR AI Cloud's own terms cover its service.

Other services your browser talks to

  • NEAR RPC nodes (dRPC, with FastNEAR as a fallback), which your browser reads the chain from and sends your own transactions through. They see your IP address and what you read.
  • Your wallet, if you connect one through NEAR Connect. Each wallet has its own privacy policy.
  • Vercel Web Analytics, only if you choose Accept all: cookieless page view counts. Before anything is sent, the address is cut to its path, so nothing after a ? or # leaves your browser.

Proofs you share

A proof shows one fact to the account it names. You decide who gets it. A proof link carries the proof after the #, which browsers do not send to our servers when the link is opened.

Changes

If this page changes, the date at the top changes with it, and the history is public in the repository.

Back to home