Privacy policy

What stays on your device. Your chosen passport, theme, saved trips, the countries you mark as visited, currency picks and favourites, the demo Premium switch, a dismissed install prompt, and a count of how many separate days you have opened Hop are kept in your browser’s local storage, on your device only. If you attach a photo or PDF of a visa or approval to a trip stop, that file is also kept only on your device, in Hop’s own storage. Hop never uploads it or sends it anywhere, and does not read or scan it. Anyone who can unlock your phone and open Hop, or who can read a backup of your phone, could see it, unless you turn on the optional passcode lock (Settings, Visa documents). The lock encrypts the stored file with a key made from your passcode. The passcode is 4 to 8 digits, so it raises the bar but is not unbreakable, and if you forget it the documents cannot be recovered. Removing a stop or trip deletes its document. Deleting the app or clearing its site data removes everything above permanently, documents included; Hop keeps no other copy, so keep your own.

Network requests Hop makes. Hop is served by its hosting provider (Cloudflare), so opening it involves the standard requests any website needs, and like any host their servers see routine technical data such as your IP address. For live exchange rates, Hop fetches a public rate table from ExchangeRate-API, or Frankfurter as a fallback. Hop also fetches a public government travel-advisory data file, published on GitHub, to keep advisory levels current between app updates — primarily from raw.githubusercontent.com, or a jsDelivr CDN mirror of the same file as a fallback. Both of these requests carry no personal data, no account and no identifier. Offline, Hop uses its built-in rate table and baked-in advisory levels and makes no requests at all.

Counting how Hop is used. Hop uses GoatCounter, a privacy-focused analytics service, to count how many times it is opened and how many of those are people coming back. It sets no cookies and stores no personal data. Hop counts a page view and the country it came from — worked out from your IP address at the moment of the request — and nothing else: no referrer, no browser or device information and no screen size are collected. No account, no identifier and no cross-site tracking. Hop also reports how many separate days this device has opened it — as a band only, one of day 1, days 2–3, days 4–7, days 8–14, or days 15+, at most once a day. That count is kept on your device and only the band is sent; there is no identifier, so nobody can follow a person from one day to the next. GoatCounter also records the country a request appears to come from, worked out from your IP address at the moment of the request and kept as a country name only — not a city, not an address, and never stored next to anything that could identify you. Hop does not load the counting script at all on launches when a visa document is stored on your device. If you add your first document during a session, counting has already started for that launch and stops from the next one. It exists to answer one question honestly — do people find Hop useful enough to come back — and it can tell the developer nothing about who you are or which destinations you looked at.

Links out. Government visa and advisory links open third-party websites with their own privacy practices.

UK and EU visitors (GDPR). The developer processes no personal data and holds nothing to access, export, correct or erase. The preferences and documents above never leave your device, and clearing the app’s data erases them completely. The hosting, rate and counting providers’ handling of your IP address is the minimum technically necessary to answer requests you make, and none of them retains it in a form that could be traced back to you.

Children. Hop collects no data from anyone, including children.

Changes and contact. Changes to this policy will appear here, dated. Questions: [email protected].