隐私政策

This Privacy Policy explains how Stratava HK Limited ("we", "us" or "the Company") collects, uses, discloses, transfers, stores and otherwise processes your personal data when you access or use the Hush mobile application, the Hush website and related features and services (collectively, "Hush" or the "Service").

Hush is an AI-powered interactive story app for adults. You can browse AI characters, chat with them in story-based conversations, report content, and, where available, purchase virtual items and paid features within the Service. Hush is only for users aged 18 and older.

With respect to your personal data, we are a "data user" under the Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO"). We are committed to handling your personal data in accordance with the six Data Protection Principles (DPPs) of the PDPO and relevant PCPD guidance.

Please read this Policy carefully. By creating an account or using Hush, you acknowledge that you have read and understood this Policy. Where we rely on your consent to process personal data, we will seek that consent separately, and you may withdraw it at any time (see Section 5).

1. Information We Collect

We collect personal data only by lawful and fair means, and only to the extent necessary and not excessive for the purposes described in this Policy (DPP1). Some information is provided by you directly; some is generated or collected automatically when you use Hush.

1.1 Information You Provide

• Account and profile: Your nickname, gender, age range and any other profile information you choose to provide. Hush verifies your identity through third-party sign-in and does not set a separate password for your account.

• Third-party sign-in information: When you sign in through Apple or Google, we obtain a basic account identifier and, depending on that service's settings, the associated email address.

• Chat content: The messages you send to AI characters, the AI-generated replies you receive, and your chat history.

• Transaction and purchase information: Where paid features are available, we collect and process information relating to the purchases, subscriptions and virtual items you acquire, hold or consume, including balances, top-ups, spending records and subscription status (including renewal or cancellation). Payments are processed by the Apple App Store or Google Play; we do not collect or store your full card number and receive only transaction confirmations and limited information.

• Reports, support and correspondence: Information you provide when you report a character or content, contact support@rezona.ai, submit a complaint or seek assistance. When you contact support, we may collect application diagnostic logs (which may include user identifiers and device status).

1.2 Information Collected Automatically

• Device and technical information: Operating system and version, device identifiers, app version or browser type and version, language and region settings, network information and performance diagnostics; information such as device model and carrier is collected automatically by our analytics and crash-reporting service providers.

• Usage and interaction data: The characters you browse and chat with, the number of messages you send, time spent, features used and your interactions in the feed.

• Logs, analytics and diagnostic data: IP address, access times, crash reports, error logs and similar data, used for operations, security and service improvement.

• Cookies and similar technologies: On our website, we use cookies and similar technologies to keep you signed in, remember preferences and measure performance. You can manage these through your browser settings.

• Push and notifications: To send you service notices and reminders, we collect device or browser push tokens (such as FCM tokens).

1.3 AI Processing

Because Hush is AI-powered, the messages you send and the relevant conversation history are processed by our AI systems and by third-party AI service providers on our behalf (listed in Annex A) to generate character replies. We ask for your permission before your first chat, and you may withdraw it at any time in Settings; if you withdraw it, you will not be able to chat with characters. We handle such data with reference to the PCPD's "Artificial Intelligence: Model Personal Data Protection Framework".

We do not use your chat content to train AI models, and our AI service providers are not permitted to use it to train their own models. A small number of authorized staff may review chat content only (1) when it is reported, (2) when our safety systems flag it, or (3) in limited, de-identified samples used to improve reply quality. Access is restricted and logged. Please do not include unnecessary personal data in your messages.

1.4 Advertising Identifiers and Attribution

To measure advertising performance and user acquisition (attribution), we use advertising identifiers (IDFA on iOS and the Advertising ID/GAID on Android) and work with attribution providers and platforms to process these identifiers and app events. On iOS devices, we request your permission as required by Apple's App Tracking Transparency (ATT) framework; you may decline, in which case we will not read the IDFA to track you across apps. If we introduce new uses such as personalised advertising in the future, we will obtain your separate consent in advance and update this Policy.

1.5 Sensitive Information

Hush is not designed to collect sensitive personal data such as health, biometric, religious or political information. Please do not submit such information in your messages; if you nevertheless choose to do so, you consent to our processing it in accordance with this Policy.

2. How We Use Your Information

Under DPP1 and DPP3 of the PDPO, we use your personal data only for the purposes for which it was collected or purposes directly related to them. We will not use it for a new purpose without your express and voluntary ("prescribed") consent. We use your personal data to:

• Create, verify and manage your account, and provide Hush's core features;

• Generate AI character replies and keep your chat history;

• Process and account for purchases of virtual items, subscriptions and other paid features, and prevent fraud or unauthorised transactions;

• Personalise your experience, such as recommending characters and remembering preferences;

• Operate, maintain, secure, debug and improve the Service, including analysing usage, diagnosing crashes and improving characters and reply quality;

• Maintain platform safety: detecting, reviewing and acting on inappropriate, illegal or violating content, handling reports, and keeping Hush limited to adults;

• Respond to your enquiries, requests, reports and complaints, and provide customer support;

• Comply with applicable laws and regulations, lawful requests and our legal obligations, and establish, exercise or defend legal rights;

• Send you service notices and reminders (such as push notifications);

• Measure advertising performance and user acquisition (attribution) to evaluate and optimise our promotional campaigns.

2.1 Direct Marketing

If we introduce marketing features in the future, we will first obtain your consent in accordance with Part 6A of the PDPO, and every marketing message will include a simple, free opt-out; you may opt out at any time, after which we will no longer use your data for direct marketing, at no charge.

3. How We Share Your Information

We do not sell your personal data. We disclose personal data only in the following circumstances and consistently with the purposes of collection (DPP3):

• Service providers and data processors: We engage trusted vendors to provide cloud hosting and storage, AI models and content safety filtering, content delivery, analytics and attribution (advertising measurement), crash reporting, push notifications, customer support and communications services. They may process personal data only on our instructions and for our purposes. Under DPP2 and DPP4, we use contracts and other means to ensure they protect the data properly, do not retain it longer than necessary and do not use it for their own purposes.

• App stores: The Apple App Store and Google Play process your purchases of virtual items, subscriptions and other paid features and provide us with transaction confirmations and limited transaction information.

• Legal, safety and compliance: We may disclose personal data where necessary to comply with applicable law or lawful requests, enforce our terms, detect or prevent fraud and security or technical issues, or protect the rights, property and safety of users, the public or the Company, including reporting child sexual abuse material to the relevant authorities.

• Corporate transactions: In a merger, acquisition, financing or asset sale, personal data may be transferred as part of the transaction, subject to appropriate confidentiality and data protection safeguards.

Your chats are private. We do not show your conversations to other users.

4. Where We Store Your Information

Hush is operated from Hong Kong and offered to users globally. Your personal data may be stored and processed in Hong Kong and in other regions where we or our service providers operate, and may therefore be transferred outside Hong Kong and processed there. For example, chat content is sent to our AI service providers listed in Annex A, and some analytics and crash-reporting data is transmitted to service providers located in the United States for processing.

When transferring personal data outside Hong Kong, we take measures consistent with section 33 of the PDPO and the PCPD's "Guidance on Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data", including contractual clauses requiring the recipient to provide a level of protection comparable to the PDPO, transfer impact assessments, and appropriate technical and organisational safeguards such as encryption and access controls.

5. Your Rights and Choices

The PDPO gives you important rights over your personal data, and we are committed to helping you exercise them. To the extent permitted by the PDPO, you may:

• Access your data (data access request): Ask whether we hold your personal data and request a copy. Under the PDPO, we will respond within 40 days and may charge a reasonable fee that is not excessive.

• Correct your data (data correction request): Request correction of inaccurate personal data; you can also update some profile information directly within the Service.

• Withdraw consent: Withdraw any consent you have previously given, including your permission for AI processing (in Settings) and direct marketing consent, at any time, free of charge.

• Opt out of direct marketing: Require us at any time to stop using your personal data for direct marketing.

• Reset a chat: Reset any conversation within the Service.

• Delete your account and data: Delete your account directly in Settings within the Service or at [deletion page URL], or ask us to delete your account and related personal data. Records we must retain by law may continue to exist as described in Section 7.

• Manage device permissions: Control notifications, tracking permission and access to device features through your device, browser and app settings.

To exercise these rights, please contact us using the details in Section 10. We may need to verify your identity before handling a request. If you are dissatisfied with how we handle your personal data, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

6. Security of Your Information

Under DPP4 of the PDPO, we take all reasonably practicable steps to protect your personal data against unauthorised or accidental access, processing, erasure, loss or use, having regard to the kind of data, the harm that could result, and how it is stored and transmitted. With reference to the PCPD's "Guidance Note on Data Security Measures for Information and Communications Technology" and privacy-by-design practices, our measures include:

• Encrypting personal data in transit (and, where appropriate, at rest);

• Access controls, authentication and least-privilege principles for personnel and systems, including restricted and logged access to chat content;

• Secure software development, testing and regular security reviews;

• Logging, monitoring and measures to detect and respond to security incidents;

• Contractual security obligations imposed on data processors.

Despite these safeguards, no method of transmission or storage is completely secure. We maintain a data breach response plan and, with reference to the PCPD's "Guidance on Data Breach Handling and Data Breach Notifications", assess any suspected breach; where there is a real risk of harm, we will notify affected individuals and the PCPD as soon as practicable and take containment and remediation measures.

7. How Long We Keep Your Information

Under DPP2 of the PDPO and PCPD guidance on erasure and anonymisation of personal data, we retain your personal data only for as long as necessary to fulfil the purposes of collection, or for the period required by law.

• Account, profile and chat data is retained for as long as your account exists;

• Chats that have been reported may be retained for the period needed to handle the report;

• Transaction records are retained for the periods required by applicable accounting, tax and consumer protection laws;

• Logs, diagnostics and analytics data are retained for the limited periods needed to operate and secure the Service.

When personal data is no longer needed, we delete it securely or irreversibly anonymise it so that it can no longer identify you. After account deletion, some data may remain briefly in backups until routinely overwritten; we may retain limited information where necessary to comply with legal obligations, resolve disputes or enforce agreements.

8. Age Requirement and Minors

Hush is intended only for users aged 18 and above. If you are under 18, please do not create an account or use the Service. We ask users to confirm their age when they sign up, and we do not knowingly collect personal data from anyone under 18.

If we learn that we have collected personal data from a person under 18, we will take reasonable steps to delete such data and close the account. If you believe a minor is using Hush, please contact us at support@rezona.ai.

9. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, technology, legal requirements or business practices. When we do, we will revise the "Last Updated" date at the top of this Policy; for material changes, we will notify you more prominently (for example, by notice within the Service) before they take effect. Where required by law, we will seek your consent separately. Your continued use of Hush after an update takes effect indicates your awareness of the revised Policy.

10. Contact

If you have any questions, requests or complaints about this Policy or how we handle your personal data (including access and correction requests), please contact our data protection officer / privacy team:

Stratava HK Limited — Privacy Team / Data Protection Officer (DPO)
Email: support@rezona.ai
Room 1006, 10/F, Po Yip Building, 23 Hing Yip Street, Kwun Tong, Hong Kong
Hong Kong Special Administrative Region

If you believe your rights under the PDPO have not been respected, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

Annex A: AI Service Providers

The Service is provided by Stratava HK Limited. © 2026 Stratava HK Limited. All rights reserved.