Privacy

What other members see

They see your pseudonym on a remark, and only if they hold that gossip. They see the teaser, the tag, and the price of a listing in your community. If they unlock it, they see the gossip.

They do not see your email. They do not see who listed a piece of gossip, or who unlocked one. The house keeps an internal reference so it can pay the right member. That reference is not sent out with the listing.

What the house keeps

The membership

Your email, a salted hash of your password, the date you were admitted, your credit balance, whether the house has already paid you for a first piece of gossip, your pseudonym, the community you belong to, and the identifiers of gossip you have unlocked. The password itself is not stored.

Gossip you list

The tag, the teaser, the gossip, the price, the time, and that internal reference to your membership. It is stored on the community, not on a public page.

A remark

The text, the time, the gossip it belongs to, the community, your pseudonym, and the same internal reference. Colleagues who hold the gossip see the pseudonym and the text.

The community

Its name, whether the room is open, how many members it has, its gossip, an invitation code, and the addresses the house has written to, with the time of each letter. It does not record which member asked for a letter. If you started the community, that is noted until you close your membership, and then the note is removed. The community stays.

A payment

The pack, the price in pounds, the credits, the Stripe Checkout reference, and the time. Card numbers stay with Stripe. Stripe is also given your email and a reference to your membership, so the credits reach the right account.

A waitlist request

If you asked to be admitted before you held a membership: your email, a company name if you gave one, and the time.

A workplace you look up

The name you type into the search on the homepage is kept by the house, with the time, and whether a room of that name already exists. It is not tied to you, so closing a membership does not remove it. The same name is also kept in your browser, under hush-workplace, until onboarding seats you there or you leave it behind. It is not a community until a member is seated.

Cookies

Two cookies, both essential. There is no advertising, and the house does not run analytics.

• hush_session. Set when you sign in, for 30 days. It holds a random token. The house stores only a hash of that token. The cookie is httpOnly and SameSite Lax, and it is marked Secure when the house is served on Vercel. Signing out deletes it.
• hush_invite. Set for 7 days when you open an invitation link. It holds the invitation code, so the house knows which chair you were offered. It is cleared when you take the chair or set the invitation aside.

Letters

Letters are sent through Resend, from the house's own address. Resend receives the recipient's email and the text of the letter. It does not receive the gossip, a teaser, or the name of a member.

• On admission, a welcome, to you.
• A cloakroom invitation, to the two addresses you named. That letter names the workplace. It does not name you.
• When a room opens, a note to the members of that community. It does not name the workplace.
• When gossip is listed, a note to the other members. It does not say what was listed, or by whom.
• When gossip of yours is bought, a note to you, with the number of credits. It does not say who paid.

Each letter is addressed on its own, so one colleague never sees another's address.

Who else receives it

• MongoDB Atlas holds the database.
• Vercel hosts the house, and may keep ordinary server logs.
• Stripe takes payment for credit packs.
• Resend sends the letters described above.
• Google Fonts serves the type. Opening a page sends your IP address to Google.
• Pexels serves the film on the homepage. Opening the homepage sends your IP address to Pexels.

Some of these providers process data outside the United Kingdom, under their own terms. The house does not sell personal data, and it does not use it to advertise.

Why

The membership, the market, the credits, and the payments are kept in order to perform the contract in the terms.

The session, the invitation cookie, the record of addresses already written to, and the sealing of a room until three members have each left some gossip are kept as a legitimate interest in running a private house. A waitlist row is kept because you asked the house to keep it. The names typed into the workplace search are kept so the house can see which workplaces people are looking for.

How long

For as long as the membership lasts, and then as set out below. A session expires after 30 days, or sooner if you sign out. The invitation cookie lasts 7 days. Invitation addresses stay with the community, so the house does not write twice.

Closing a membership

From your profile, with your password. The house then deletes your account, your credits, the record of gossip you have unlocked, your remarks, your purchase history, and your sessions. It removes a waitlist request made with the same email, reduces the community's member count, and clears the note of who started a community.

Gossip you listed stays. It is not labelled with your name, and the community still holds it. Addresses the house has already written to stay with that community.

Your profile already shows the email, the house name, the balance, the community, and the gossip you hold. Closing the membership is how you erase the rest.