Privacy

Draft for operator review before any public launch. This is not legal advice.

What HUSH is

HUSH is an opt-in crush reveal for people who verify a Duke email. It is not a Duke University service and it does not import the university directory.

What other students can see

Search opens only while crushes are open. It shows a display name and class year for people who consented and left their profile discoverable. It does not show NetIDs, email addresses, who selected whom, or invitation history. If you enter a Duke email that already belongs to a HUSH account, we tell you that person is already here. Instagram handles are shown only to a mutual match after the reveal, and only if that person opted in.

Crushes

A selection is visible to the person who made it. It is disclosed to the other person only when both people selected each other in the same round, and only after that round's reveal time. A one-way selection is not announced.

Invitations

A verified participant can ask HUSH to email a Duke address. The email does not name the sender. Destination addresses are encrypted, and a separate hash is used to prevent repeat mail and to honor opt-outs. We do not keep a public profile for someone who has not joined. Invitation links use unguessable tokens stored only as hashes.

What operators can access

The application stores account, profile, selection, and invitation records so the product can function. Operators are not given a screen that browses individual crushes. They can see aggregate counts, reports, and account status. A person with database access could still read stored records. Do not describe HUSH as technically incapable of operator access.

Retention

Sign-in codes are removed about a day after they expire. Invitation email ciphertext and private nicknames are cleared about two weeks after an invitation ends. You can delete your account, hide your profile, block someone, or opt out of invitation email.