Privacy Policy

Effective 24 October 2026. This policy covers the Hopper desktop app for macOS and Windows, the Hopper account and sync service at api.hopper.computer, and this website, hopper.computer. Hopper is operated by Doğukan Tuna (“we”). Questions: dtunabuilds@gmail.com.

The short version

• Your library lives on your computer. Hopper also keeps a copy of it in a private storage area that belongs to your account alone, so your other devices can load it. This sync is on by default while your account is active, and you can turn it off in Settings → Account.
• The account knows who you are (from Google sign-in), which devices are signed in, whether you have a subscription, and a list of what is in your synced library.
• We do not sell data, show ads, or use tracking in the app. This website counts visits with Google Analytics.
• You can delete your account from inside the app at any time. That also deletes the synced copy.

1. Your library on your computer

Everything you put on a canvas: notes, labels, images, videos, PDFs, web pages and clippings, voice recordings, stacks and spaces. Hopper writes them as Markdown and media files into one folder on your disk (~/.hopper on macOS, your user profile on Windows) and keeps a daily backup beside them. The app works without the network; the copy described next is made from this folder. Uninstalling Hopper leaves the folder in place; deleting it is up to you.

2. The synced copy

• What. Every card and space as a small record, and every file on a canvas (images, videos, PDFs, recordings, imported pages), stored by its content. Settings, window positions and the Trash are not synced.
• Where. An object store run by Cloudflare (R2) in the European Union only, in an area reserved for your account. Nothing in it is public.
• Who can reach it. Only your own devices, through the Hopper service: the app never holds storage credentials, and the service hands it links that work for a few minutes and for one of your objects at a time. The service’s own credential is limited to that store. One account cannot read another’s area.
• Encryption. In transit (TLS) and at rest by Cloudflare. The copy is not end-to-end encrypted: in principle we can access it; in practice nobody does, except to run the service or when you ask us to look at a problem.
• Turning it off. Settings → Account → Sync across devices stops uploads and downloads from that computer. What is already stored stays until you delete your account.
• When Hopper Pro ends. Sync pauses; the copy stays while the account exists and picks up again with a subscription.
• Size. Up to 20 GB per account.

3. What the account collects

Hopper requires a Hopper account, created by signing in with Google. We store:

• Identity: your Google account identifier, email address, display name and profile picture, as provided by Google.
• Sessions: one record per signed-in device with an operating-system label (such as Windows PC), operating system, app version, IP address and when it was last used, so you can review and sign out devices. New app versions do not send your computer name or hostname; names sent by older versions may remain in existing session records.
• Subscription: when your free trial ends and the status of a Hopper Pro subscription (active, expired, cancelled, refunded) as reported by Apple. We receive an Apple transaction identifier; we never see your payment details.
• Sync index: for each synced object its path, size, a hash of its content, a revision number, the device that sent it and timestamps. The index lists your objects; it does not contain their content.

The app keeps a sign-in token and a cached copy of your subscription status on your computer, encrypted by the operating system. The account service runs on servers in the European Union; the database is hosted by Neon in Frankfurt.

4. Why we use it

To let you sign in, to keep your library in step across your devices, to know whether Hopper Pro is active, to answer support requests, and to keep the service secure (for example, limiting repeated sign-in attempts from one address). We do not profile you and we do not use your data for advertising.

Software updates

New Windows versions check downloads.hopper.computer at launch and every six hours, and when you choose Check for updates in Settings. Cloudflare serves only public installation files there, separately from your private synced library. Requests expose your IP address and requested file; the updater also uses a randomly generated installation identifier for update checks. It does not send your library, account token, computer name or local file paths. Available updates download in the background; installation requires your confirmation to restart. File checksums and the Windows publisher signature are verified before installing. These app versions do not automatically send crash reports to Sentry.

5. Third parties

• Google handles sign-in. Google’s privacy policy applies to what Google does with your Google account.
• Apple handles payment for Hopper Pro through the Mac App Store and tells us whether a subscription is active. Apple’s privacy policy applies to the purchase.
• Cloudflare (object storage, EU jurisdiction) holds the synced copy; Neon (database hosting) and Hetzner (server hosting) store account data. All three act on our behalf under their data processing terms.
• Vercel hosts this website; Google Analytics counts visits to it (pages viewed, country, device type) with Google’s cookies. Your Hopper account is never connected to it.
• A live website card loads that website inside Hopper, the way a browser would; that site sees a visit from you and may set its own cookies, kept in a sandboxed profile.

We share account data and your synced copy with nobody else, unless the law requires it.

6. Retention

Account data and the synced copy are kept while the account exists. A file you delete from every canvas is removed from the copy as well. Sessions expire after 30 days of inactivity and are removed after that. Subscription records are kept for as long as needed for billing and tax purposes.

7. Your choices and rights

• Turn sync off in Settings → Account; your library keeps working on that computer.
• See and sign out devices in Settings → Account.
• Delete your account in Settings → Account. This removes your identity, session and sync records and the synced copy, and ends every session; your library on your computer is untouched. Signing in again with the same Google account creates the account anew, with an empty copy.
• Export your library at any time as a .zip from Settings.
• Under the GDPR and similar laws you may ask us for a copy, correction or deletion of your account data by writing to the address above.

8. Children

Hopper is not directed to children under 13 (or the age of digital consent where you live), and we do not knowingly create accounts for them.

9. Security

Sign-in uses Google with PKCE; tokens on your computer are encrypted by macOS Keychain or Windows DPAPI; traffic to the account service and to the storage is encrypted (HTTPS); storage links are short-lived and limited to your own objects; purchases are verified with Apple server to server. No system is perfectly secure, and we will tell you if a breach affects your account.

10. Changes

We will post changes to this page and update the date at the top. Material changes will also be announced in the app.