Built on your device
Every nap, feed, diaper and note is sealed with a key only your family's phones have. The bytes that reach our server are ciphertext — we couldn't read them if we tried.
For Android · coming to Google Play
Baby tracking that even we can't read.
Hush logs naps, feeds, diapers, growth and the handoff notes between caregivers. Every event is encrypted on your phone before it leaves it, so our server never sees what you tracked — only that something happened.
Free with optional non-personalized ads. Premium removes them — $4.99 / mo, $39.99 / yr, or $129 once.
Why Hush
Built so the secrets stay yours.
Three things we got right that most baby apps don't.
For real families
Co-parents, grandparents, daycare. Multiple children. Edits made on the bus that resolve cleanly with the ones made at home. One subscription covers everyone you invite.
Calm by default
Quiet notifications, no streaks, no nags. Opt into the noisy ones if you want them. The Home screen is one big number telling you how long since the last feed — nothing else.
How it works
What our server sees.
Every event your phone uploads to keep your family in sync looks like this. That's the whole record.
{
"family_id": "4f2c9a…b81e",
"child_id": "e9d0…7c2a",
"event_id": "01HQX…ZNRA",
"created_at": "2026-05-26T14:22:08Z",
"ciphertext": "v3VRz…Q3kc", // XChaCha20-Poly1305
"blob_size": 412
}
That's it. Your handoff notes, feed times, symptoms — encrypted on the phone with a key only your family's devices hold. Routing fields are unavoidable (we have to know which family to replicate to), but the payload itself is opaque to us.
Pricing
14-day free trial
Pay once, monthly, or yearly.
Free works for one parent, one kid, 30 days of history. Premium is the everyone-and-forever version. One subscription covers every caregiver you invite.
Monthly
$4.99
/ month
Cancel anytime in Google Play
The flexible one. Premium for as long as you're using it, gone the moment you cancel.
- Unlimited children & caregivers
- Full timeline history
- No ads, ever
- Encrypted backup export
Yearly · Most popular
$39.99
/ year
$3.33 / mo · save 33%
The sensible one. Two free weeks, then a third less than monthly with everything Premium ever ships.
- Everything in Monthly
- Pediatrician-prep PDF
- Photo journal (E2E)
- Priority sync
Lifetime
$129
once
Pays back at ~26 months
The one for people who hate subscriptions. Pay once, keep Premium for the operational lifetime of Hush.
- Everything in Yearly
- Never billed again
- 90-day notice + export if we ever wind down
Privacy report
Mirror of the in-app screen.
The same Privacy Report your phone shows you, audited against the shipped binary. If any of these numbers change, we change them here too.
What we collect
Count
Baby data on our servers
Naps, feeds, notes, photos — in plain text
0 bytes
Third-party trackers
Behavioral analytics, attribution, fingerprinting SDKs
0
Analytics SDKs
Mixpanel, Amplitude, Segment, Firebase Analytics…
0
Crash reporters
Crashlytics, Sentry, Bugsnag — none in the baby-data path
0
AdMob — non-personalized
Free tier only. Disabled entirely for Premium subscribers.
1
FAQ
The honest answers.
What if I lose my phone?
When you set up Hush, the app generates a 24-word recovery phrase and asks you to write it down somewhere offline. With that phrase you can restore on a new device and decrypt everything that was synced.
If you lose every device and the phrase, we genuinely can't help you — the key never touched our servers, so there's nothing on our end to recover from. That's the trade.
Can I export my data?
Two ways. There's a pediatrician PDF that
assembles a clean date-range report locally, ready to email or
print. And there's an encrypted backup file
(.hushbk1) sealed with a passphrase you choose
— you can park it on Google Drive, a USB stick, anywhere
you trust.
How do you make money if you can't see anything?
Premium subscriptions, and on the free tier, Google AdMob running in non-personalized mode. That means AdMob picks the ad from generic context (rough geography, app category) — not from a behavioral profile of you. No Advertising ID is linked to your baby data, because the baby data never leaves your device in plain form.
Upgrading to Premium turns the SDK off completely.
Is this really end-to-end encrypted? Can I check?
Yes. The Android client uses
libsodium (XChaCha20-Poly1305 for content,
X25519 for key wrapping, Argon2id for the recovery phrase). On
the wire, the server only ever sees ciphertext plus minimal
routing fields like family_id and a blob size.
The client is open-source — you can read the sync code, the encryption code, and the build pipeline yourself. Repo: github.com/hush-app/hush-android (link placeholder; goes live with v0.1).
Is Hush a medical device?
No, and we're careful about that line. Hush logs what you tell it and surfaces it back — growth, symptoms, vaccination timing relative to your child's date of birth. It is not a diagnostic tool. Always check with your pediatrician for medical decisions.