Privacy Policy

Hoosh (هوش) · Effective 26 August 2026

Hoosh is built for one of the most private things a family has: helping someone who doesn't speak the local language handle their own life. This policy says plainly what the app does with data. It is written to match what the software actually does, not to cover possibilities.

Where your data lives

The App Store version of Hoosh talks to a server we operate, and that is where your contacts, health record, conversations, transcripts and settings are stored. Everything durable is encrypted at rest. We do not read it, sell it, or use it to train anything, and you can erase all of it from inside the app at any time.

Hoosh can also be pointed at a server your own family runs, on a home computer or your family's own cloud account, in which case none of it reaches us at all. Settings shows which server the phone is using.

What the app stores (on your family's server)

• Contacts you save — names, phone numbers, what calls to them are usually about, and an optional photo for the speed-dial card.
• Profile details your family enters for phone calls (for example a name, phone number, or date of birth) — disclosed on a call only where your family has explicitly allowed that detail for that specific contact.
• A health record, only after recorded consent: emergency contacts, doctor and pharmacy, conditions, medications, allergies, medicine schedules and dose history. It is used to answer the user's own questions, run reminders, and — only where explicitly released per contact — answer a pharmacy's question on a call.
• Call transcripts and summaries, so the user and their family can review what was said. Call audio is recorded only if your family's server operator switches recording on; every playback is logged.
• Companion chat history only for accounts where memory is enabled; otherwise conversations live on the phone alone.

Everything durable is encrypted at rest. One-time security codes relayed on a call are never stored anywhere — not in the profile, not in transcripts, not in logs.

Your agreement, asked for in the app

The first time Hoosh is opened it shows a screen naming what is sent, who receives it and why, and asks you to agree. Nothing that carries your words, your pictures or your place leaves the phone before that: the app refuses those requests until you have agreed, and Listen and the camera each say so again the first time they are opened. You can read the same disclosure at any time in Settings → What Hoosh sends.

What leaves the server, and to whom

To do its work, your family's server calls these services. Each receives only what its job requires, at the moment of use:

• Anthropic (Claude) — text being translated or answered: call turns, chat messages, text found in photos you ask about, and — with each question you ask the companion — the health record saved for you (allergies, medicines and their times, conditions, doctor and pharmacy) and the names of the contacts it may offer to call, which is how it can answer about your own medicines.
• Microsoft Azure Speech — audio for speech recognition and the synthesized voices.
• Telnyx — places the actual phone calls.
• Open-Meteo — weather, sent only coordinates rounded to about a kilometre; never stored.

There are no ads, no analytics SDKs, no trackers, and no data is ever sold. Nothing is used to train models by us.

What stays on the phone

• The camera translator recognizes text on the device; only the recognized words are sent for translation — frames and photos are not uploaded.
• Photos you show the companion are sent once for the answer; the picture itself is not kept. Only your question may be kept, and only with memory enabled.
• Location is used with your permission, for weather, while using the app; it is not stored.

Phone calls made by the assistant

Every call the assistant places begins by disclosing that it is an AI assistant calling on someone's behalf. It can never dial emergency services, premium-rate numbers, or countries your family has not explicitly opened. It never shares payment details, government ID numbers, or passwords — it does not have them.

Subscriptions and the free trial

Phone calls and live call interpreting need a subscription. Listening and translating in the room is free and stays free — it is not a call and is never metered.

Subscriptions are sold and billed by Apple through your Apple ID. Hoosh never sees your card, your billing address, or any payment details; Apple does not pass them to us. What Apple does send is a signed record of the purchase — which plan, when it started, when it renews, and whether it is in the free trial — and the server checks Apple's signature on that record before it lets a call be placed. That record is stored against your account on your family's server so calls keep working; it is deleted with the account.

The free trial is three days and is offered once per Apple ID, which Apple enforces — deleting the app, or deleting your Hoosh account and creating a new one, does not start another. During the trial, calls are limited to ten minutes in total, to keep the cost of a trial to your family bounded. After the trial the subscription renews at the plan's price unless it is cancelled at least 24 hours before the period ends. Cancel any time in iOS Settings → your name → Subscriptions.

Deletion

Deleting your account. Anyone signed in can delete their own account from inside the app: Settings → Account → Delete account. The account record and every session are removed from the server and from its durable storage, and the phone is signed out at once. If the account is the household's owner, deleting it also erases the household — the profile, contacts, health record, conversations, call history and alerts — and closes the other family members' accounts; the app says so before it asks you to confirm. There is no soft delete, no deactivation, and no retained copy. Sign in with Apple gives us no token to keep: Hoosh verifies the identity token Apple hands the app and never exchanges it for one of its own, so there is nothing left at Apple to revoke.

Erasing the records without deleting accounts. The owner can also erase everything about the person the app is for — Settings → erase — which deletes the profile, contacts, health record, transcripts, alerts and settings from the server and from its durable storage.

How long things are kept

Records of what happened are deleted automatically once they are old enough, without anyone having to ask. The periods follow the practice for the region your account's data is held in (the United States or Canada today):

• Call recordings (only if recording is switched on): 30 days.
• Call transcripts and call history: 90 days.
• Conversations with the companion: each message is removed 90 days after it was said.
• Recordings sent in to correct a translation: 90 days.
• Daily usage counts (numbers only, never words): two days.

The profile, contacts, health record and the translation rulebook are kept for as long as the account exists, because they are how the app works; they are deleted with the account.

Card numbers

If a payment card is read out on a call, Hoosh passes it on — that is what an interpreter does — but never writes it down. The transcript, the live transcript on your family's phone and the notes after the call show a blank where the number was, and so do the expiry date and the security code. If the call is being recorded, the recording pauses while a card is being discussed; if a card number is read out with no warning, that call's recording is deleted. This is the rule contact centres follow for card payments.

Family access

Family members sign in with Apple. The first person to sign in is the owner; anyone who signs in after that can use the app straight away, and the owner decides, per person, whether they may see call summaries, full transcripts, or recordings, and can remove them.

Children

Hoosh is not directed at children under 13.

Changes and contact

If this policy changes, the date above changes with it. Questions: jelveh71@gmail.com.