Privacy Policy.

Hopfly is a social app for sharing the beers you drink with your friends, run by Niklas Trapp ("we," "us," or "our"), the data controller within the meaning of the EU General Data Protection Regulation (GDPR) for personal data processed in connection with the Hopfly app (on Android and in the browser) and the hopfly.app website.

Niklas Trapp
Mooswaldstrasse 11
79576 Weil am Rhein
Germany
Email: support@hopfly.app

If you have any questions about this policy or our data practices, contact us at support@hopfly.app.

Account data

When you sign up with email, we collect your email address and a password. The password is stored only as a bcrypt hash — we never see it in plaintext. When you sign in with Google, Google tells us your email address, your name and an account ID; we don't get your Google password. We also store the display name you choose and, if you set one, your profile picture (your own photo, your Google photo, an initials badge or your Pinto).

To confirm your email address or reset your password we email you a 6-digit code. We store it only as a hash, and it expires after 30 minutes.

Posts

A post holds a photo or a short video clip (up to 3 seconds, with sound), the brand and beer, the pour size, an optional caption, the friends you tag and, if you add one, a location. We keep the time each post was made. Pinned posts and the posts you save are stored too.

Location data

Location is optional. A post only gets a location when you add one, or when you have turned on automatic location in the settings and allowed location access on your device. We then store the coordinates with that post, so it can appear on the map. We never track your location in the background, and you can revoke the permission at any time in your device settings.

Camera, microphone and photos

The camera is used to take the photos and clips you post, and to scan barcodes. The microphone is only used while you record a clip. Photo library access is only used when you pick a picture yourself. Nothing is uploaded until you post it or set it as your profile picture.

Activity in the app

We store what you do with other people's posts: likes and dislikes, comments and replies (including the GIFs you pick) and likes on comments. We record that you have seen a post, so its author can see how many people have seen it — never who. We also store when you were last online, so your friends can see it.

Friends and safety

We store your friends, friend requests, your notification setting for each friend, the people you block, the people whose comments you hide, and any reports you send. If our moderators act on a report, we keep a record of that decision, including any ban and its reason.

Levels, Hops and games

We keep a history of the experience points you earn, and from it your level, rank and achievements. When you reach a new rank, a promotion post is shown to your friends. We also keep your Hops (our in-app points, with no money value) with their history, the items you unlock for Pinto, your game rooms and scores, and the rounds you play in the Hops casino and the lootboxes you open.

Age check

Hopfly asks for your birth date and country once, to check that you are of legal drinking age where you live. We don't store your birth date. We store only when you passed the check, the country it was checked against and the date from which you are 18, because the Hops casino and lootboxes are 18+.

Notifications

We keep your in-app notifications. If you allow push notifications, we store your device's push token, or for the web app your browser's push subscription and browser name, so we can deliver them.

Newsletter

If you sign up for our newsletter on the website, we collect your email address. Sign-up is double opt-in: we first send you an email with a confirmation link, and your address is only added to the newsletter list once you click it. If you don't confirm, your address is not added to the list.

Device and technical data

When you use the app or website we receive standard technical information such as your IP address, device or browser type and app version. We use it to keep the service secure (for example to limit how often a form can be sent) and to diagnose technical problems.

Stored on your device

The app keeps your login and settings (such as language, colour theme and your Flappy Pint best score) on your device.

Communications

If you contact us by email, we keep the content of that correspondence to resolve your issue.

• Run the service — sign you in, store your posts and show them to your friends, and calculate your levels, ranks, achievements and Hops.
• Notifications — tell you in the app, and by push if you allow it, about your friends' posts, comments, likes, tags, friend requests and promotions.
• Newsletter — if you signed up and confirmed, send you our newsletter, about once a month. Every newsletter contains a link to unsubscribe.
• Safety and moderation — review reports, remove content that breaks our Terms, and ban accounts where needed.
• Security — detect and prevent fraud, abuse, and unauthorised access.
• Legal compliance — meet our obligations under applicable law, including the age check.

We do not show ads, sell your data, build profiles for third parties, or make automated decisions with legal or similarly significant effects.

We process your personal data only where we have a lawful basis to do so:

• Contract (Art. 6(1)(b)) — processing your account, posts, friends, activity, levels and notifications is necessary to provide the Hopfly service you signed up for.
• Consent (Art. 6(1)(a)) — optional features such as location, camera, microphone and photo access, push notifications and the newsletter. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)) — the age check, and keeping or disclosing data where the law requires it.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, moderating content, preventing abuse, and measuring website visits without cookies. We balance these interests against your rights; you can object at any time.

We do not sell, rent, or trade your personal data. We share it only in the following limited circumstances:

Other Hopfly users

Your posts, profile, stats, levels, map and promotions are visible only to your friends. People you tag can always see the post they are tagged in. Anyone signed in to Hopfly can find you by your display name, or by your exact email address, and see your name and profile picture so they can send you a friend request; in search results your email address is shown only partly.

Hosting and storage

Our servers and database run on European infrastructure. Photos, clips and profile pictures are stored with Cloudflare (Cloudflare, Inc., USA) and delivered through its network.

Email delivery

We send emails (account emails such as sign-up and password reset codes, and the newsletter) through Resend (Resend, Inc., USA). For the newsletter, Resend also stores your email address and subscription status on our behalf.

Sign-in and push notifications

If you sign in with Google, Google (Google Ireland Ltd. / Google LLC, USA) confirms your identity to us. Push notifications to the Android app are delivered through the push service of Expo (650 Industries, Inc., USA) and Google's Firebase Cloud Messaging. Push notifications to the web app are delivered through your browser maker's push service (for example Google, Mozilla or Apple).

Services the app uses directly

• Mapbox (Mapbox, Inc., USA) draws the map. Your device loads map tiles from Mapbox, which receives your IP address and the map area shown.
• KLIPY provides the GIFs in comments. When you search for or pick a GIF, your search term and IP address go to KLIPY.
• Open Food Facts (Open Food Facts, France) helps identify a scanned barcode. The barcode number and your IP address are sent to it.

Transfers outside the EU

Some of these providers are based in the USA. Where personal data is transferred there, it is protected by the EU–US Data Privacy Framework where the provider is certified under it, or by the EU Standard Contractual Clauses. Providers that process data on our behalf are bound by data-processing agreements.

Legal requirements

We may disclose information if required by law, court order, or governmental authority, or to protect the safety of our users.

We keep your account data for as long as your account exists. You can delete your account at any time in the app under Settings → Delete account, or on our deletion page. To delete only your data and keep the account, use our data deletion page. Your account is hidden from everyone straight away. If you sign in again within 30 days, it is restored; after that it is deleted for good, together with your posts, photos, clips, comments and everything else linked to it.

Sign-in sessions end 30 days after you last used the app. Email codes expire after 30 minutes. Content you delete yourself, such as a post or a comment, is deleted straight away.

Your newsletter subscription lasts until you unsubscribe, using the link in any newsletter or by writing to us. Your address is then marked as unsubscribed, so you get no more newsletters; write to us if you'd like it deleted completely. Confirmation links expire after 3 days.

Our database backups are overwritten after 14 days, so deleted data is gone from them within 14 days as well.

Server logs containing IP addresses are retained for 90 days for security purposes, then deleted.

Aggregated, anonymised data (no link back to you) may be kept indefinitely.

Under GDPR you have the following rights regarding your personal data. To exercise any of them, email us at support@hopfly.app. We will respond within 30 days.

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — ask us to correct inaccurate or incomplete data. You can change your name and profile picture in the app yourself.
• Erasure (Art. 17) — request deletion of your data ("right to be forgotten"), or delete your account yourself as described above.
• Restriction (Art. 18) — ask us to limit how we process your data while a dispute is resolved.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent — at any time, for consent-based processing, without penalty. For permissions, use your device settings; for the newsletter, the unsubscribe link.

You also have the right to lodge a complaint with your national data protection authority. In Germany, that is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).

The hopfly.app website sets no cookies at all — no advertising cookies, no cross-site tracking. The web app uses only technically necessary cookies and browser storage to keep you signed in and to remember your settings.

We measure website visits with a self-hosted instance of Umami. It is privacy-respecting by design: it counts page views without fingerprinting you, sets no cookies, and the data stays on our own server.

The website loads its font from Google Fonts (Google Ireland Ltd. / Google LLC, USA), so your browser sends your IP address to Google when it loads the font.

Hopfly is only for people of legal drinking age where they live, and never for anyone under 16. The app checks this when you sign up (see "Age check" above). The Hops casino and lootboxes are only open from 18. If you believe someone underage has given us their data, please contact us and we will delete it promptly.

We may update this policy from time to time. For material changes we will notify you by email or via an in-app notice before the change takes effect. The "Last updated" date at the top of this page always reflects the most recent revision.