Privacy policy

1. Who is responsible

hopzup (hopzup.online) is operated by Armin Ravkić. Contact for all privacy questions: support@hopzup.online. Postal address: see the imprint.

2. What hopzup does

hopzup transfers text, links, photos and files between devices that you have connected to each other. It does not need an account. We process only the data needed for this.

3. What we process and why

• Content you send (text, files, file names, file types and sizes): stored encrypted on our server only to deliver it to the device you chose. It is deleted automatically 10 minutes after the upload is complete (or after the longer time you chose in a paid plan, at most 24 hours), or earlier when you delete it. We do not read, analyse or scan content, and it is never included in backups.
• Device data: a random device ID, the device name you choose, the device type (phone, tablet, computer), your interface language, a hashed security token, which devices are connected to each other, the time of creation and last use, and the amount of data sent per day for usage limits.
• Technical connection data: your IP address is processed when you connect, to deliver the service and to protect it against abuse (for example rate limits held only in memory). Our web server keeps access logs with IP address, time, requested address, status and browser identification for 14 days, for security and troubleshooting.
• Feedback you send us: your message, the category, optionally your email address and, if you leave the box ticked, your browser, operating system and app version.
• Usage statistics: only aggregated daily counts (for example how many transfers succeeded per day) and which device IDs were active on a given day, to measure reliability and retention. No content, file names or IP addresses are used for statistics. We use no third-party analytics, no advertising and no tracking across websites.

4. Legal basis

We process content and device data to provide the service you request (Art. 6(1)(b) GDPR). Connection data, logs, abuse protection and aggregated statistics are based on our legitimate interest in a secure, reliable service (Art. 6(1)(f) GDPR). Your email address in feedback is used because you give it to us to get an answer (Art. 6(1)(a) GDPR); you can withdraw this at any time.

5. Cookies and local storage

hopzup uses one strictly necessary cookie that identifies your device so it stays connected. Your language choice and, temporarily, a pairing code are kept in your browser's local storage. The installable app version keeps the app files (not your transfers) in the browser cache. These are needed for the service you request, so no consent banner is required. We use no advertising or tracking cookies.

6. Who receives data

Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a processor under a data processing agreement. Servers are located in the European Union. Content you send is delivered only to the device you chose. We do not sell data and do not pass it to third parties unless we are legally obliged to.

7. How long we keep data

• Transferred content: until it expires (10 minutes after upload by default) or until you delete it. Afterwards, a short record without content (type, size, status) remains visible for up to one hour so both devices can show that it expired.
• Device data: until you choose "Forget this device", or automatically after 180 days without use (12 hours for "shared computer — this session only").
• Daily usage counters: 40 days. Aggregated statistics: up to 400 days. Web server logs: 14 days.
• Feedback: until it is handled, at most 24 months.
• Backups of the device database (no transferred content): 14 days.

8. Security

Connections are encrypted with HTTPS. Content waiting on the server is encrypted with a separate key per item; the key is erased when the item expires or is deleted. This is not end-to-end encryption: technically the server could decrypt content while it is waiting. Files are not checked for viruses.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You can delete your device data yourself at any time with "Forget this device". Because hopzup has no accounts, please include the device ID shown in the settings when you contact us. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Children

hopzup is not directed at children under 16.

11. Changes

We update this policy when the service or the law changes. The date at the top shows the current version.