HOP Privacy Policy

About this policy

This policy describes the HOP travel app, including its TestFlight beta, and this public privacy website. HOP helps you organise trips, flights, boarding passes and airline memberships. Mail connections are optional; you can enter trips manually. Availability of integrations may be limited during the beta.

Account and travel information

We process your email address, account identifier and authentication information to create and protect your account. Optional profile information includes your display name, home airport, passport country and country of residence. Saved travel information may include trip names and destinations, dates, airlines, flight numbers, airports, booking references, seats, cabin and baggage details, document links, and airline membership numbers, status and balances that you enter.

These details support account access, trip organisation, displaying your itinerary and the features you choose. Country information helps display entry-information guidance. HOP does not require a passport scan. Only add information you need for your trip. Account and travel records are stored with Supabase. When confirming account deletion, your current password is sent to the HOP server and checked with Supabase; it is not saved by the deletion function.

Purposes and legal bases

We process the account and travel information needed to provide the HOP service you request, including authentication, account emails, trip organisation, selected travel features and account deletion, on the basis of Article 6(1)(b) GDPR (performance of a contract or steps at your request before entering into one). An email address and authentication information are necessary for an account. Optional profile fields, documents, memberships and mailbox connections are voluntary; without them, the corresponding optional features may not be available.

Accessing and analysing your mailbox for the optional import is based on your consent under Article 6(1)(a) GDPR. You may withdraw it at any time through the mailbox controls in HOP or by contacting us. Pausing stops further imports; disconnecting also removes the saved connection and related import records as described below. Withdrawal does not affect the lawfulness of processing before withdrawal. Travel records already added to your account continue to be held as part of the trip service until you delete them.

Sending booking source content to OpenAI is part of your consent to booking import under Article 6(1)(a) GDPR. HOP asks you to accept the updated processing terms before this new processing is used. Connecting a mailbox alone does not start import. For manual files and older-message searches, the import action includes this consent. You may stop future email imports by pausing or disconnecting, and may contact us to withdraw consent. Withdrawal does not undo processing that has already taken place.

We process necessary technical connection and error information to keep HOP and this website available, prevent misuse and investigate faults on the basis of Article 6(1)(f) GDPR. Our legitimate interests are reliable operation and the security of accounts, data and infrastructure. General support enquiries are processed on the same basis to respond to you; enquiries about your requested service are processed under Article 6(1)(b). We process requests to exercise GDPR rights and any disclosures required by law under Article 6(1)(c), in particular to meet our obligations under Articles 12–22 GDPR.

HOP does not make decisions producing legal or similarly significant effects about you solely by automated processing. Automatically recognising a booking organises travel data; it does not book, cancel or change your travel arrangements.

Optional mailbox connections

You decide whether to connect a mailbox and separately enable import. Gmail and Outlook use the provider's authorisation process. Supported IMAP connections use the credentials you provide, such as an app password. We retain the mailbox address, provider, connection status, granted permissions and encrypted access credentials on the server. HOP uses read access and does not send, delete or mark messages as read.

When import is enabled, HOP initially checks a limited period of approximately 14 days and then checks for new messages. This is a search window, not a deletion deadline. Gmail filters potential booking messages outside spam and trash; Outlook and supported IMAP accounts check the inbox. The server temporarily processes message headers, text and supported attachments, including PDFs and attached PNG/JPEG images, to identify flight bookings. Full message bodies and attachment files are not permanently stored by the HOP import pipeline. Booking content may be sent to OpenAI for extraction after you accept the updated import consent described below.

For relevant messages, HOP stores limited sender and subject information, a hashed message identifier, extracted booking details, explicit local date/time hints, schedule-check results and an import or review status. It also keeps consent and technical synchronisation records. Unrelated messages may leave a technical identifier to avoid processing them again, but their sender and subject are not retained by this pipeline. Clear bookings can be added to your trips automatically; uncertain details and changes may require your review.

You can explicitly search a selected connected mailbox for older bookings within a chosen period of up to one year, independently of the automatic check. You can also select a booking PDF or a PNG/JPEG booking screenshot from your photo library for temporary processing on the HOP server without connecting a mailbox. Text recognition for scanned PDFs and screenshots runs on the HOP server. These manual imports create review drafts; flights are saved to a trip only after your confirmation. Drafts retain extracted flight details, explicit date/time hints, schedule-check results, limited message metadata where applicable, and a hashed source identifier to prevent duplicate processing. Original documents, images and full extracted text are not permanently stored by the HOP import process. The import consent and OpenAI processing described below also apply to these manual imports. The separate local boarding-pass and trip-document features keep their selected original files on your device.

Booking recognition with OpenAI

HOP uses OpenAI to recognise flight details as part of the booking imports you authorise: connected mailboxes, searches for older bookings and manually imported booking PDFs and screenshots. After you accept the processing terms, the HOP server may send booking source text and supported PDF or image content to the OpenAI API. Depending on your source, this content can include passenger names, booking and ticket references, routes and travel dates. Mail access credentials and HOP sign-in tokens are not sent to OpenAI. Existing accounts must confirm the updated terms before their source content is sent to OpenAI. Standard recognition can continue internally when OpenAI is unavailable.

OpenAI is an additional service provider for this processing. API data is not used to train OpenAI models by default. HOP requests no response storage (store=false), but this is not a guarantee of zero retention: OpenAI may retain content in abuse-monitoring records for up to 30 days, with longer retention where required by law or necessary for safety. Image and file inputs are subject to OpenAI safety checks and associated retention exceptions. OpenAI describes these controls at https://developers.openai.com/api/docs/guides/your-data.

HOP stores the import consent version and minimal technical usage information needed to enforce the recognition spending limit. Extracted booking details and review results are handled as described above. Pausing or disconnecting email import stops future imports without removing saved trips. You choose whether to submit further manual imports. Requests already sent may finish and provider retention rules still apply. Account deletion removes the HOP consent record; it does not immediately erase provider abuse-monitoring records.

Google user data and Limited Use

HOP handles Google API data under the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. Google data supports the visible mail-import and trip features. We do not sell it, use it for advertising, or use it to train AI models. Necessary service providers process it to deliver these features with your permission. Human access is restricted to your specific agreement, necessary security investigations, legal requirements, or other cases expressly permitted by Limited Use. HOP does not routinely have people read your mailbox.

Information on your device

Boarding passes and trip documents you import, your own trip and country photos, personal entry checklists and flight visibility and Miles archive markers are stored on your device and separated by HOP account. These local files are not automatically uploaded or synchronised to other devices. HOP opens your photo library only when you choose to add or change a photo and saves the selected image. Recently loaded trips, flights and baggage information may be cached for offline display. On iOS, the app stores your sign-in session using the device's secure storage.

Visa & Entry stores the entry dates, exit dates and optional visit deadlines that you confirm on this device, separated by HOP account. Day counts are calculated locally from these dates; they are not automatically synchronised. Signing out keeps these records for your next sign-in to the same account. Removing the trip or deleting the account on this device also removes its local visit records.

When you choose I missed this flight, HOP saves that personal marker on this device, separated by HOP account. It does not change the airline booking or delete the original boarding pass. You can undo the marker. It remains when you sign out and is removed when you delete its flight, trip or account on this device; it is not automatically synchronised to other devices.

On supported iPhones, HOP can use the flight number, airports, departure time and internal flight identifiers to show a boarding-pass shortcut as a Live Activity on the Lock Screen. The PDF or image remains inside HOP and opens through that shortcut. Availability depends on the app version and device settings.

Signing out clears the offline trip cache; saved local files, checklists and flight visibility and Miles archive markers remain for when you sign back into the same account. Removing the app can erase local data. Check-in and mileage reminders are scheduled locally after you allow notifications. Sharing a document or feedback uses an action you choose; check the content and recipient before sharing.

Public destination photos and their credits are saved separately from personal documents, reused by image address on this device, and do not contain HOP account or trip identifiers. They are not included as photo files in the app download. The first download requires internet; the web version uses the browser image cache.

Service providers and external connections

Supabase provides account authentication and database storage. Railway hosts the HOP integration server and mail-import worker. Resend delivers account emails for Supabase, such as confirmation and password-reset messages, and processes the recipient address and message contents for delivery. Google, Microsoft or your supported mail provider participate when you connect a mailbox. These services receive information needed to perform the corresponding function and technical connection information.

Flight lookup sends the flight number and date through the HOP server to AeroDataBox via API.market when that integration is available. Destination photos are downloaded when needed from public image sources and saved on your device for later offline display. A small catalogue supplies known image addresses; for other destinations, the app requests a public city name, sometimes with its country, from Wikipedia and image credits from Wikimedia Commons. These requests do not include your private trip title, travel dates, booking reference or HOP account details. Image hosts, including Wikimedia and any external host of a displayed image, receive normal image requests and connection information such as your IP address.

Airline check-in, entry-information and other external links open the selected service. Files you choose to share go to the destination you select. Those external services have their own privacy information. Apple operates TestFlight and may provide beta usage, diagnostic and feedback information under its TestFlight terms and privacy information.

International processing

The providers described above operate internationally. Processing and support access may take place outside the European Economic Area, including in the United States. Railway and Resend describe US processing in their published data-processing terms; Supabase permits processing by its international service and subprocessor network. Choosing a European server or email-delivery region does not by itself limit all processing to Europe.

The published data-processing terms of Supabase and Resend include European Commission standard contractual clauses for relevant transfers. Railway provides for those clauses or the EU–US Data Privacy Framework where the recipient is appropriately certified. The applicable mechanism depends on the recipient and transfer; this policy does not assert that every provider or recipient is certified. These terms describe the providers’ commitments and do not guarantee that third-country laws are identical to EU law.

The published terms and transfer provisions are available from Supabase at https://supabase.com/legal/customer-resources/data-processing-addendum, Railway at https://railway.com/legal/dpa and Resend at https://resend.com/legal/dpa. Cloudflare publishes its processing and transfer terms at https://www.cloudflare.com/cloudflare-customer-dpa/. You can contact us for information about the safeguards relevant to your data and a copy, subject to protection of confidential information.

Technical information, advertising and analytics

HOP does not include advertising or a separate behavioural analytics SDK. The app's servers and service providers process technical information needed to deliver, secure and troubleshoot the service, such as network addresses, request times, response status, account or connection identifiers and error information. This technical processing is separate from Apple's TestFlight diagnostics. HOP does not use mailbox content for advertising or sell personal information.

Visiting this website and contacting us

This public HOP website is published through Sites and delivered using Cloudflare hosting infrastructure. When you visit, the hosting infrastructure processes normal web-request information, such as your IP address, request time, requested page, response status and browser information, to deliver and secure the page. We have not added advertising, behavioural tracking or a contact form to this website. Cloudflare privacy information is available at https://www.cloudflare.com/privacypolicy/.

If you email us, we process your address, message and any information you choose to send so that we can answer your request. Our privacy-contact mailbox, max.mall@outlook.com, is provided by Microsoft Outlook. HOP support at support@hoptravel.app is provided through Porkbun email hosting. Please send only information needed for your enquiry; do not send passwords or full payment details. Correspondence is retained for as long as needed to resolve the request and any related legal obligations or claims.

Storage duration and your controls

Account and saved travel records remain while you keep them in your account, until you remove them or delete the account. Mail credentials remain while the connection is saved. Pausing import stops further import without deleting existing records. Disconnecting removes the saved connection, credentials and its associated import and synchronisation records; trips already imported remain until you delete them. Technical flight fingerprints used to prevent unwanted re-import may remain until account deletion.

Deleting an imported trip does not by itself erase the saved import record. That record can support an explicit restore action while the connection exists. HOP does not automatically restore a deliberately deleted trip during a normal refresh.

Offline trip entries older than 30 days are not restored for display. Public destination-photo metadata can be refreshed after 30 days when a lookup is needed. Downloaded public destination photos are kept for offline use, may be shared by several trips on the same device and remain after sign-out or account deletion until app data is removed; they do not store account or trip identifiers. These cache periods are not a guarantee that every stored copy is physically deleted at that moment. Personal local files remain until you remove them, delete the account on that device or remove the app. Provider backups and technical logs may have separate retention periods; immediate removal from every backup cannot be guaranteed.

Deleting your account and data

You can remove trips, passes and memberships in the app. Profile → Delete account offers permanent account removal and requires your current password and explicit confirmation. It checks server availability first. The process removes account-owned cloud files, the account and associated database records, including saved mailbox credentials and import records, then attempts to clear local account files, caches and reminders on the device making the request.

If deletion cannot finish, the app explains the problem and allows you to retry; some files may already have been removed. Copies previously shared or stored on another device are not automatically recalled. Contact us using the contact details in this policy if you cannot access the deletion function or need help with a deletion request. Disconnecting in HOP does not necessarily revoke the provider's authorisation; you can also remove HOP's access in your Google or Microsoft account, or revoke an app password with your mail provider.

Your privacy rights

Under the GDPR and subject to its conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on our legitimate interests for reasons relating to your particular situation. Where processing is based on consent, you may withdraw consent for the future without affecting the lawfulness of earlier processing. Contact max.mall@outlook.com to exercise these rights; we may need to verify your identity before acting on a request.

You may complain to a supervisory authority, in particular in the EU/EEA country where you live or work or where you consider an infringement occurred. For Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Wien, Austria, dsb@dsb.gv.at. Information and the complaint procedure: https://dsb.gv.at/eingabe-an-die-dsb/beschwerde.

Children and policy updates

HOP is not directed at children. If you believe a child has provided personal information inappropriately, contact us so we can review and address the situation.

We may update this policy when HOP or its data practices change. The date above identifies this version. Material changes will be communicated where required, and new consent will be requested where needed.