Privacy policy
For Hopper. Last updated: .
Scope and privacy contact
This policy describes current data handling in Hopper, an Android app with nearby communication and internet-connected social features, and on this legal-information website. Hopper is the app name; this notice does not represent that a separately incorporated company exists.
For privacy questions or account-data requests, contact hopper-7827@gmail.com. See Account-data deletion for the request steps and current completion limits.
Information used by Hopper
Identity and local app data
Hopper stores identity keys, app preferences and feature data on your device. Public keys identify social activity and communication identities. A decentralized identity is still an identity associated with data; it does not mean that no account or personal data exists. Display names, message history and cached content may be stored locally.
Public social content
Published profile information can include a display name, biography, links, country selection and a spoken-bio reference. Public posts and media metadata can include content, an author public key, media URLs and an optional coarse posting-area geohash. Following or unfollowing publishes a contact-list event containing the current followed public keys, not only the latest change. Public content is sent to Nostr relays and can be copied by other users.
Media you publish, including a spoken bio, can be uploaded to a Blossom media server. Its URL or content hash can be included in a public event.
Messages and connection information
Message data is handled to send, receive and display communications. Internet direct-message bodies use NIP-44 encryption inside NIP-17 gift wraps. Relays can still observe recipient public keys, event timestamps, connection information and traffic timing. A timestamp may be randomized. Recipients can read and retain received messages.
Nearby communication uses device radios and peer sessions. Participants can receive information you choose to send and identifiers needed for communication. A nearby broadcast is not a private direct message. Visibility of messages and attachments depends on the feature and transport; this policy does not claim that every mode or file transmission has identical encryption guarantees.
Permissions and location-related information
Bluetooth and location-related permissions support nearby discovery and location features. Camera, microphone and media-access permissions support creating or selecting photos, audio, video and files. Permissions depend on the feature and Android version. Granting a permission does not itself mean that every item or your precise location is published to a relay.
Places, nearby activity and optional location sharing can reveal an area, presence or location-related information. Public SOS and location-scoped content can identify a posting area. A coarse geohash is not a guarantee of anonymity. Review the audience before sharing; Hopper must not be treated as a guaranteed emergency-response service.
External place search and location-name lookups can send entered search text or latitude and longitude, together with language and connection information, to a geocoding provider. Current OpenStreetMap/Nominatim location-name lookups can include precise coordinates. An approximate public posting area does not mean that an external lookup receives only approximate coordinates.
Safety reports
Reports can include a reason, the reported content, an evidence snapshot and a reporter public key. Reports are routed through encrypted message envelopes to the configured safety-review recipient; routing metadata may remain visible to relays. Submitting a report does not prove that a reviewer received or reviewed it. Report retention and end-to-end review operations have not yet been verified.
Purposes and sharing
The information above supports identity, peer discovery, messaging, social publishing, media display and your selected settings. Public events and media go to relays, media servers and other participants. Communication also exposes connection information to network operators. Recipients, peers and other users can retain or redistribute copies outside Hopper's control.
It is not accurate to say that all information stays on your device, that all transmissions are encrypted, or that every Hopper interaction is anonymous.
This website and email requests
This website contains static documents and has no analytics scripts, advertising scripts or web request form. It is hosted on GitHub Pages. The hosting service receives connection information, including visitors' IP addresses, under the GitHub privacy statement.
If you email the contact address, the email provider handles the message and contact information under the Google privacy policy. Email is not Hopper's encrypted messaging system. Information you submit is used to review your request. Do not send private keys, passwords, recovery phrases or private conversations.
Retention and deletion
App data and identities can persist on your device across ordinary restarts and replacement updates. Cache lifetimes vary by feature. Local reset is intended to remove local identity/app data; complete removal across every app store and operating-system backup has not yet been verified.
Independent relays, media servers, recipients and exported copies have their own retention practices. Updating a profile, withdrawing a public event or making a deletion request cannot guarantee erasure of those copies.
The contact inbox provides a deletion-request channel, not automated deletion. A fixed retention period for request records and a verified completion process for developer-controlled hosted data have not yet been established. No fixed completion deadline or universal deletion guarantee is offered. These operational limits must be resolved before deletion compliance can be claimed.
Security
Encryption can protect message bodies but does not hide all metadata or prevent recipients from taking screenshots, exporting or forwarding content. Public posts and published media are not private messages. Device access, backups, network services and the recipient's device affect privacy. No absolute security, anonymity or global-erasure guarantee is made.
Your choices and requests
You can review device permissions, choose whether to publish content, edit public profile information, change followed accounts or use local reset. Updated public events do not guarantee removal of older copies. You may contact the privacy inbox to request access, correction or deletion relating to data controlled by Hopper; available rights and obligations depend on applicable law and the data concerned. The request channel does not establish a verified fulfillment process.
Children's information
Public posts can be seen and retained by others. If you believe a child's information has been shared improperly, contact the privacy inbox without sending sensitive material. This notice does not claim that age verification, parental-consent processes or jurisdiction-specific child-privacy compliance have been verified.
Changes to this policy
Changes will be reflected on this page with an updated date. Revisit this policy when using a new feature or sharing information with a different audience.