Privacy-First Policy
Zero-PII Cryptographic Relay Architecture • Last Updated: October 2026
At HushTag (operated by Zaffrio), our core mission is simple: Contact anyone. Share nothing. Unlike traditional services that treat privacy as an afterthought or compliance checklist, HushTag was engineered from day one so that our servers hold the absolute minimum data required to deliver real-time anonymous alerts.
Zero Phone Exposure
Phone numbers are never revealed to scanners.
AES-256 Encryption
End-to-end encrypted tunnels for messages & media.
Ephemeral Sessions
Scanner sessions expire automatically without tracking cookies.
01. How the Zero-PII Relay Works
When you create an HushTag tag (e.g. for a vehicle windshield or pet collar), the physical sticker displays a unique public tag identifier (e.g., SC-9428).
- No Plaintext Identifiers: Your phone number, full name, address, or vehicle registration are never embedded inside the QR code or NFC payload.
- Tokenized Relay: When a bystander scans your tag, our backend verifies the tag status and creates an ephemeral, tokenized session. Messages dispatched through the web interface are delivered to your app as masked push notifications.
- WebRTC Audio Calls: If you enable audio calls, the browser-to-app connection operates over an encrypted WebRTC voice tunnel. Neither party dials a telephone number or exchanges carrier metadata.
02. Information We Collect & Why
We collect only the bare minimum data necessary to operate the relay:
A. Tag Owners
• Verified phone number (used exclusively for account authentication and critical SMS relay fallback if push notifications fail).
• Optional display name and vehicle/pet label (e.g., "Black RAV4" or "Milo").
• Push notification device token (FCM / APNs) to route incoming alerts to your phone.
B. Scanners & Finders (Passersby)
• Zero personal registration required. Passersby do not download an app or provide their name or email.
• Ephemeral session identifier stored temporarily in memory to link alert replies.
• If optional OTP verification is configured on high-security tags, the scanner's phone number is verified via Redis OTP expiring in 5 minutes and is never revealed to the tag owner.
03. Location Data Handling (Lost Mode GPS Pin)
When a tag is in "Lost Mode" (e.g. for a lost dog or missing luggage), the scanner web page provides an optional button: "Share Current Location with Owner".
- Location is accessed only with explicit permission granted through the finder's mobile browser prompt.
- The coordinates are transmitted directly to the tag owner's private device map to facilitate item recovery.
- We do not record ongoing background GPS coordinates, track scanner movement, or maintain historical movement telemetry.
04. Zero Data Brokering Pledge
We Never Sell or Broker Your Data
HushTag does not sell, rent, monetize, or trade user data to third-party ad exchanges, data brokers, credit rating agencies, or insurance firms. Our business model is funded purely by hardware sticker sales and transparent Pro annual memberships.
05. Data Retention & Right to Erasure
You maintain complete control over your data at all times:
- Instant Tag Invalidation: With 1 tap in the mobile app, you can delete or regenerate any tag QR code. The previous code becomes immediately inert and cannot be scanned again.
- Account Deletion: You can permanently delete your account and all associated tags directly in the app under Profile → Delete Account, or by emailing
privacy@zaffrio.com. All cryptographic links are purged from our database immediately.
06. Security Standards & Encryption
All network communication between mobile devices, scanners, and our relay cluster is enforced via HTTPS and TLS 1.3. Stored records are encrypted using AES-256-GCM. Session keys and transient OTPs are stored in ephemeral in-memory caches configured with automated TTL expiries.
Privacy or Data Officer Contact
Reach our designated Data Protection Officer at privacy@zaffrio.com