How Hush works.

#Your first private chat.

There is no sign-up form, no card and nothing to install. Any Solana wallet works: Phantom, Solflare, Backpack, OKX, MetaMask and others. On a phone, the app opens itself inside your wallet’s browser.

1. Connect and sign. One line of text, no transaction.
2. Add credits in USDC, from $5. That is about 11,100 messages to Claude Haiku 5.5.
3. Ask. Pick any model; switch whenever you like.

#A signature, not an account.

The app asks your wallet to sign the text below. The server checks the signature against your address, refuses anything older than ten minutes, and hands back a session that carries your address and an expiry seven days out, sealed with a server secret. Signing moves no funds.

Sign in to Hush

Wallet: 7xKX…q2Pd
Issued: 2026-10-25T14:02:11.000Z

This signs no transaction and moves no funds.

#What leaves your browser.

Every request is rebuilt from three things only: the messages, the model, and the model’s own settings. Your wallet, any metadata and your IP never travel with it.

It goes out through OpenRouter with routing locked to providers that keep no data (zero data retention). If a model has none at that moment, the request fails instead of falling back to one that does. Type below and watch both sides.

{  "account": "usr_88120",  "email": "you@mail.com",  "ip": "84.21.140.7",  "device": "iPhone 16 · Seoul",  "card": "visa •••• 4242",  "history": "kept",  "prompt": "is it bad that i lied on my resume about one year"}

{  "model": "anthropic/claude-sonnet-5.5",  "messages": [{ "role": "user",    "content": "is it bad that i lied on my resume about one year" }],  "provider": { "zdr": true }}

#One key for everyone.

Every Hush user reaches the model under the same key. To the provider that is one customer sending many requests. It can count them; it cannot tell whose is whose.

#What we keep.

Two things, both needed to bill you, and nothing else.

#History on your device.

By default a conversation lives only in the open tab. If you choose to keep history, your wallet signs one more fixed line, and your browser turns that signature into a key that never leaves it:

Wallet signatures of this kind are deterministic, so the same wallet rebuilds the same key on another device. Nothing about your history reaches our server. Conversations can be renamed, exported as Markdown, or deleted from the sidebar.

#Two rooms.

#Prices, in the open.

One credit is one cent and never expires. A request costs the provider’s own price for its tokens, read live, plus 12%. A typical message, 1,500 tokens in and 500 out, costs

Read at 06:46 UTC. A wallet may send 60 requests a minute and four at once.

#Web search.

Turn on Search under the message box and the model may look things up before answering, with the provider’s own search where it has one. Sources are listed under the answer.

#Make one, or send one.

Make one: pick an image model (Gemini’s image models have zero retention routes) and describe the picture. It comes back in the chat and is kept only if history is on, encrypted like the rest.

Send one: attach an image to ask a model that can see. It is shrunk in your browser, travels inside the request, and is never stored by our server.

#The API.

Hush speaks the OpenAI chat format at https://askhush.xyz/api/v1. Make a key in the app under Billing → API keys. It starts with hk_, is shown once, and spends your wallet’s credits.

curl https://askhush.xyz/api/v1/chat/completions \
  -H "Authorization: Bearer hk_..." \
  -H "Content-Type: application/json" \
  -d '{"model": "anthropic/claude-haiku-5.5", "messages": [{"role": "user", "content": "Say something quiet."}]}'

Errors

#Every purchase, split.

Credits are bought by paying the Hush program on Solana in USDC. The program divides each payment before the transaction ends:

#Staking, paid in USDC.

Stake $HUSH and you are paid your share of every purchase in USDC, in the same transaction that pays for it:

• Paid at once. Your share lands with each purchase; claim whenever you like.
• Locked 24 hours. Staking or adding to a stake locks it for a day, so no one can borrow tokens, collect and leave in one block.
• Counted as received. A stake counts what the vault actually received, so a token with a transfer fee cannot inflate it.

Stake and claim in the app at app/stake.

#Buyback and burn.

The buyback part of every purchase goes to a single wallet whose only job is to buy $HUSH on its market and burn it. Both transactions are public, and the burned total is read from the token’s supply below.

#What the admin can do.

Only the program’s upgrade authority can set it up. After that, the admin key has exactly these powers, and nothing pauses staking, moves staked tokens or takes rewards.

Program: BANup4LjAanvWu9M5wcmxrj5bDS1sZMeV8bY31QAY3PH, deployed at launch.

#Live numbers.

Starts at launch

The yearly rate is last week’s USDC to stakers scaled to a year, over what is staked at today’s price. It moves with every purchase and is not a promise.

#Who sees what.

#Limits, stated plainly.

• Zero retention is a promise. That providers keep nothing rests on their terms and on the routing above. The sealed room is how open models move from promise to proof.
• Our server relays your words. It sees them in passing and is trusted to keep nothing, as described here.
• A wallet is a name. The chain links an address to its purchases and to where its USDC came from. A fresh wallet used only for Hush keeps those apart.
• Words can name you. A message that identifies its writer still does, whoever carries it.
• Answers can be wrong. Hush changes who keeps the conversation, not what the model knows. Nothing here is financial, medical or legal advice.

#What comes next.

• The sealed room: open models inside hardware enclaves, with a public signed report for each.
• A stakers’ allowance: free messages every week for staked $HUSH.
• Studio: video and audio under the same rules.
• Desktop and agents: the same room, with tools.

#Questions.