§01
Who we are
hush is a pre-launch project run from the United Kingdom. For any privacy question, including the rights set out below, write to [email protected].
Privacy policy.
hush · Reading, UK · Last updated 22 August 2026
Contents
hush is a pre-launch UK food project run from Reading. This page tells you exactly what data we take when you reserve or leave your email, why we take it, and how to ask us to delete it. It's short on purpose. Nothing about how we handle your data should be a surprise.
§02
What we collect
When you leave your email address, we record:
- The email address you give us.
- Which version of the landing page you saw (we run a small number of ad variants with different headlines).
- Where you came from: the UTM parameters in the link you clicked, the referrer URL, and the page URL you submitted from.
- Your IP address and browser user-agent string, recorded by our form server.
- The date and time you submitted.
- If you tick the consent box at submit, Meta (Facebook) Pixel cookies set in your browser so we can measure which advert led to your sign-up.
§03
What we use it for
- Building a pre-launch waitlist so we can email you when hush ships.
- Measuring which advert creative is converting, so we don't waste ad budget on copy that isn't working.
§04
Lawful basis under UK GDPR
Consent, given by the act of submitting the form alongside the purpose statement shown next to the submit button. We record which version of that statement you saw at the time you submitted, so we can show you exactly what you agreed to. You can withdraw consent at any time using the unsubscribe link in any email or by writing to us.
There have been three versions of that statement. Which one applies to you depends on when you signed up, and we hold yours against your record:
- Before 9 August 2026 (hush-2026-06-12-*). "One email when there's real news. No newsletter." If you signed up under this promise it still stands: we will email you once, at launch, and not otherwise. The wider permission below is not applied to you retrospectively.
- 9 to 22 August 2026 (hush-2026-08-08-email-v1). "Launch news and the odd baking note. Nothing else." This allows an occasional email about baking with tagatose alongside the launch announcement. Still no newsletter, no third-party marketing, and an unsubscribe link in everything.
- From 22 August 2026 (hush-2026-08-22-email-v2). "Only ever about hush: launch news, the odd baking note, and sometimes a question to help me get this right. Not often, and one click to stop." The change from the previous version is that it lets us ask you something — a question about price, or what you would want us to make next — rather than only announce things at you. The earlier wordings named the two kinds of message we would send and so ruled that out. "Only ever about hush" is the stricter half of this promise and it is unchanged in substance: no newsletter, no third-party marketing, nothing about anything but this product, and an unsubscribe link in everything.
If you reserve with a £5 deposit, the lawful basis for handling that payment is performance of a contract, not consent. Reserving does not sign you up to emails; the email permission above is separate and is only given by submitting the email form.
§05
Cookies
This site sets no cookies until you successfully submit the form. Our analytics tool, Plausible, is cookie-free by design. The Meta Pixel, which does set cookies, is only loaded after you submit, which is what makes our cookie posture banner-free.
§06
Who we share data with
- Meta (Facebook). Receives a hashed copy of your email, your IP address, and your user agent so it can attribute your sign-up to the right ad in our reporting. This is via Meta's Conversions API.
- Our email provider (Listmonk, self-hosted on UK infrastructure). Handles the delivery of the confirmation email and any future launch emails. Your email address transits via the system hush itself operates.
- Stripe, but only if you reserve with a £5 deposit. Stripe takes your card details directly and we never see or store them; we receive the email address you give Stripe, the amount, and whether it succeeded, so we can refund you and apply the £5 to your first order. Stripe acts as an independent controller for the payment itself and has its own privacy policy. If you only leave an email address, Stripe receives nothing.
- That's it. No other third parties.
§07
How long we keep it
Until launch (anticipated 2026) plus 12 months thereafter for transactional purposes (your founder's discount code, order history if you buy). Earlier if you ask us to delete it.
§08
Your rights
Under UK GDPR you have the right to:
- access the data we hold about you;
- correct it if it's wrong;
- have it deleted ("right to erasure");
- receive a portable copy of it;
- withdraw consent at any time, with no effect on the lawfulness of past processing;
- complain to the Information Commissioner's Office at ico.org.uk if you think we've handled your data badly.
Write to [email protected] for any of these and we'll respond within one month.
§09
Security
Your data is held on a UK-region server. The waitlist database is backed up daily and encrypted in transit (TLS) on the wire.
§10
Updates to this policy
If we change anything material (what we collect, what we use it for, who we share it with), we'll update the "Last updated" date at the top, and email anyone on the list before the change takes effect.