Privacy Policy
Last updated: to be confirmed before launch
1. Who we are
Hopp is operated by Hopp Apps ("Hopp", "we"). We are the controller of the personal data described in this policy. Contact: [email protected].
2. The short version
Hopp is a player for content you already have the right to use. We do not provide, host, index or recommend any content. The playlists you add, the credentials you enter, your favourites and your settings are encrypted on your device before anything reaches our servers, using a key we never receive — we cannot read them, and neither can anyone who obtains a copy of our servers. Analytics and crash reporting are off until you turn them on, and when on they contain no channel names, no playlist addresses, and no account identity.
3. What we process, and why
3.1 Without an account ("local mode")
Everything stays on your device. No account is required to use the app. If you keep analytics off, no data about you reaches us at all.
3.2 Your account (if you create one)
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address | Sign-in, security notices, account recovery | Contract | Until account deletion, then removed within 30 days |
| Password verifier (a one-way hash — never your password) | Sign-in | Contract | As above |
| Recovery code hash | Regaining access after a password reset | Contract | As above |
| Device records: a random device id, platform, model, the name you give it | Enforcing the device limit of your plan; letting you see and remove devices | Contract | Until you remove the device or delete the account |
| Entitlement: your plan, its expiry, and a signed token that lets the app verify it offline | Providing what you paid for, also when our servers are unreachable | Contract | Until account deletion |
| Encrypted sync data (your playlists' addresses and credentials, favourites, settings) | Keeping your devices in sync | Contract | Deleted immediately on account deletion |
| Handoff intents (encrypted: which channel or video to continue, where, and from which of your devices), stored against the device it is for and the time it was sent | Continuing what you watch on another of your devices | Contract | Deleted when that device reads it, or after 2 minutes; the latest "now playing" after 10 minutes |
The encrypted sync data and handoff intents are opaque to us: they are encrypted on your device with a key derived from your password (and protected by your recovery code), and we store only the ciphertext. We cannot decrypt them, recover them for you if you lose both your password and your recovery code, or hand them to anyone in readable form.
3.3 Payments and invoices
When you buy a plan from us, the checkout processor listed in section 6 handles your payment details, and we never see card numbers. When you buy a plan with an app store's own in-app purchase, the store handles the payment under its own privacy policy, and RevenueCat (section 6) passes us the purchase's status; it receives your account's opaque identifier and the product bought, never your name, email address, playlists or anything you watch. Either way we receive the fact and status of a purchase (plan, seller, dates, cancellation, refund) so we can unlock it. For a plan we sell ourselves, we issue the invoice for what you buy and keep the accounting record behind it for to be confirmed before launch, which Dutch tax law requires of us regardless of any other choice you make about your account — including deleting it. Nothing else about you is added to that record.
3.4 Optional analytics and crash reporting
Both are off by default and switched on, separately, by you — during onboarding or later in Settings — and off again at any time.
When analytics is on, the app sends a small set of events: app version, platform and device class, which screens are used, that a playlist was added (how many items, in a rough bucket, never what), that playback succeeded or failed (the engine, container and error code, never the stream), and your plan state. Each event also carries the country you connected from, which our analytics processor derives from your IP address before discarding the address; the country is the only location-shaped value on any event, and nothing finer is ever derived or kept. Events carry a random installation identifier that is not linked to your account and that you can reset in Settings at any time; resetting it disconnects everything sent before. Events never contain playlist addresses, hostnames, IP addresses, channel or group names, programme guide data or account identifiers, and the app enforces this with an allow-list — a field that is not on the list cannot be sent.
When crash reporting is on, the app additionally sends a report when it fails unexpectedly: the type of error and where in our code it happened, with any address or credential removed from the message before it leaves the device.
These events are processed for us by PostHog, Inc., on PostHog Cloud EU, in Frankfurt, Germany (see section 6). Legal basis: your consent.
3.5 Security and abuse prevention
Our servers keep short-lived technical logs (request timestamps, response codes, coarse error information) to keep the service running and to detect abuse. IP addresses in these logs are retained for no longer than 14 days; sign-in attempt counters one hour. Legal basis: our legitimate interest in operating a secure service.
3.6 Casting to a television (Google Cast)
On phones, tablets and in the Chrome browser, Hopp can play what you are watching on a Chromecast or Google TV. This uses Google Cast, software from Google LLC that is part of the Hopp app on phones and tablets and part of Chrome on the web; television versions of Hopp do not contain it.
While Cast is available, Google Cast looks for receivers on your local network, the way any app that casts does. When you choose to cast, your device sends the stream's address to the receiver on your network, and the receiver then fetches the stream itself — so the address, and any credential your provider put in it, goes to that receiver and never through our servers. A stream that needs extra request headers or cookies is not cast at all. The receiver loads Hopp's receiver page from our servers, which sees what the technical logs in section 3.5 describe and nothing else.
Hopp sends no analytics through Google Cast and asks Google for none. Google's handling of the Cast software and of the receiver itself is governed by Google's terms and privacy policy, not by this one. Legal basis: casting happens only when you ask for it, as part of the service you use.
4. What we never collect
- The content of your playlists, your provider credentials, or what you watch — these never leave your device in a form we can read.
- Advertising identifiers. No third-party advertising, no advertising SDK and no tracking. The free tier shows Hopp's own Premium promotion.
- Precise location.
- Contacts, photos, or other device data unrelated to playing video.
5. Where your data is stored
Our servers are in the European Union. Analytics, when enabled, is stored on PostHog Cloud EU, in Frankfurt. We do not transfer your personal data outside the EU/EEA, with one exception: for a plan bought with an app store's in-app purchase, RevenueCat (section 6) processes the purchase's status and your account's opaque identifier in the United States, under its data-processing agreement with us.
6. Who processes data for us
| Processor | What | Where |
|---|---|---|
| PostHog, Inc. (PostHog Cloud EU) | Optional analytics and crash reports (section 3.4) | Frankfurt, Germany |
| Hetzner | Our servers and encrypted storage | European Union |
| Cloudflare, Inc. | Reverse proxy, TLS termination, firewall and rate limiting for our API and website | The network edge: a request is handled by the data centre nearest to it, worldwide |
| to be confirmed before launch | Transactional email: sign-in links, address verification and receipts | As stated by that provider |
| to be confirmed before launch | Payment for plans bought from us, their subscription status and invoicing | European Union |
| RevenueCat, Inc. | Status of plans bought with an app store's in-app purchase: it verifies the store's receipt and tells us the plan, its dates, cancellation and refund (section 3.3) | United States |
We do not sell personal data and do not share it with anyone other than the processors above, who act on our instructions under data-processing agreements.
7. How long we keep data
- Account data: until you delete your account, then removed within 30 days, with one exception below.
- Encrypted sync data: deleted immediately on account deletion.
- Handoff intents: deleted when the device they are for reads them, or after 2 minutes; the latest "now playing" after 10 minutes.
- Invoices and the accounting record behind them: kept for to be confirmed before launch, because Dutch tax law requires it of us regardless of your account's status. This is the one exception to the promise above: deleting your account does not delete an invoice already issued, though it deletes everything else about you at the processor (section 3.3).
- Analytics events: PostHog retains events for the duration of our plan with them, which can be up to seven years — the retention period is set by PostHog's plan and is not something we can shorten for individual events. This is acceptable to us only because the events are anonymous, contain no content or account identity, and carry only an identifier you can reset in Settings at any moment, which detaches every earlier event from your device.
- Technical logs: 14 days; sign-in attempt counters one hour.
8. Your rights
Under the GDPR you may ask us to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent at any time (withdrawing consent does not affect processing that already happened). Each of these has a route:
- Access and export. Download a copy of what our servers hold about you from Account in the app or on the website, at any time. Your encrypted library exports separately, from Settings, in the app that holds it.
- Correct. Change your email address from Account; a device's name changes from the device list. Anything else, use the route below.
- Delete. Delete your account from Settings. Your library and your devices are gone at once; the account record is removed within 30 days, and section 7 states the one exception.
- Restrict, object, or anything not listed above. Write to [email protected]; we answer within one month, and we tell you if we cannot act on a request and why.
- Withdraw consent. Turn analytics and crash reporting off in Settings, and reset the analytics identifier there at any time — because analytics events are anonymous, we cannot identify which events came from you, which is why the reset control exists rather than a request to us.
You have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Ours is the Autoriteit Persoonsgegevens.
9. Children
Hopp is not directed at children under 16, and we do not knowingly collect personal data from them.
10. Security
Data in transit is protected with TLS; connections to our own servers are additionally pinned to our certificates. Sync data is encrypted end-to-end on your device. Passwords are never stored — only a verifier that cannot be reversed. Connections to a third-party playlist provider use whatever that provider offers; the app tells you when an address is not encrypted.
11. Cookies and similar technologies
The apps set no cookies and contain no third-party trackers; the only optional data collection is the analytics described in section 3.4, which you switch on yourself. Our website uses cookieless, aggregate analytics for page views, which carry the same country-level value as the app's events and nothing finer; session recording on the website happens only after you agree to it on the page, and can be declined with one click.
12. Changes
We will post changes here and, for material changes, tell you in the app before they take effect.
13. Contact
Hopp Apps, [email protected].