Your records. Your choices.

Effective date: 3 November 2026

This policy describes the current data flows and the planned Free, Plus and Pro release.

Who is responsible

Hoppet's operator is responsible for the personal information described here. Legal review: insert the operator's legal identity, address, privacy contact and any required EU/UK representative or India grievance contact before launch. You can use the support page to find the published contact once verified. We will not publish this draft with an unusable contact.

What stays on your iPhone

Your training records, routines, food diary, targets, body measurements, notes and progress photos are stored on your device. You decide which records to enter. Local records are not sent to an AI provider simply because you use Hoppet. Device and operating-system backups are controlled separately through your Apple settings.

Your account and optional cloud backup

Supabase provides authentication, private backup storage and server processing. An account uses an email address or a supported sign-in provider and a user identifier. Optional display/profile details may be included. Authentication credentials are used to keep accounts separate. Your accepted initial profile, goal, starter routines and onboarding-completion status are saved with your account to resume unfinished setup and recover your starting plan after reinstalling. This setup snapshot excludes workout logs, food diary entries, photos and Apple Health readings and is removed with your account.

If you enable cloud backup, the backup can contain your profile, routines, workouts, manually entered health and body measurements, food logs, saved foods and meals, preferences, notes and progress photos. The app keeps the latest two recovery snapshots. The current backup format excludes Apple Health readings and the compressed source photos attached to AI food-diary entries. Exported backup files are under your control; keep them private.

Traffic is encrypted in transit. Private storage and access controls are used, but Hoppet does not claim that cloud backups are end-to-end encrypted or inaccessible to all service administrators. Signing out does not itself delete a cloud account or its backups.

Sign-in providers

If you choose Google sign-in, the sign-in process exchanges authentication information with Google and Supabase. Sign in with Apple, when enabled and offered, can use an Apple-provided relay email if you choose Hide My Email. These providers also handle information under their own privacy terms. We do not use sign-in permission to access unrelated Google or Apple content.

Optional AI meal analysis

After first-use consent, a meal description or resized meal photo is sent through Supabase to Google's paid Gemini API. The request is limited to the selected meal and the instructions needed to estimate its foods, portions and nutrition. We do not include your workout history, Apple Health readings, body measurements, progress photos or cloud backup in that request.

Google's paid-service terms say submitted content is not used to improve its products. Google's published abuse-monitoring policy describes 55-day retention of prompts, context and responses, including possible authorised human review. Legal obligations and separately configured project logging can affect retention; TO VERIFY: the actual paid-service and logging settings used at release. See Gemini terms and monitoring information. Do not submit faces, medical details or other personal information.

Hoppet's server does not intentionally store uploaded meal-photo bytes. Account-linked meal text and derived estimate-review records are retained for review and operation. A separate private result store supports retry recovery. When you confirm a photo analysis, a compressed source photo stays with the diary entry on your device. Estimates are not medical advice or verified nutrition; check and edit them before saving. Manual logging remains available if you decline AI, reach a limit or the service is unavailable. Internal comparison and trial-provider tools are not public features.

Barcode and nutrition-label logging

Barcode lookup sends the code to Hoppet's server to search its catalogue. Nutrition-label text recognition runs on your iPhone; label scanning does not send the image to Gemini. If you enable label-fact sharing in Privacy & Data, the signed-in label-saving flow can send the product name, barcode, serving information and confirmed nutrition values to an account-linked review queue; it does not upload the label image through that submission. Reviewed non-personal product facts may become shared catalogue data. Do not put personal or medical details in product names.

Sharing label facts is off by default. You can turn it off in Privacy & Data to stop future submissions. TO VERIFY — release review: confirm these controls and the final data flow on the signed release before publication.

Apple Health

With your permission, Hoppet reads steps, active energy and resting energy on your iPhone. This access is read-only; Hoppet does not write to Apple Health in the current iPhone flow. These readings are not included in the current cloud snapshot or sent to meal AI or product analytics. Change or withdraw access in Apple Health or iPhone Settings. We do not sell Health data or use it for advertising.

Product analytics and diagnostics

Product analytics is off by default. If you enable it in Privacy & Data, Hoppet uses first-party event counts to understand how features and subscription screens are used. Along with onboarding, saved-workout or meal, AI and review events, the server supports paywall views and plan selections; purchase starts, completions, cancellations and pending states; restore actions; and locked-feature or allowance-limit sheets. Only fixed categories are accepted, such as the screen source, selected plan and billing period, product identifier, whether a trial or restored subscription was found, and the kind or reason of a limit.

Event rows contain an event name, UTC date, app version, platform, server recording time and a random identifier for that action. They do not store your account, email, stable device identifier, Apple transaction identifiers or prices, and accept no meal text, exercise names, body values, photos or arbitrary user properties. Requests are authenticated to reduce abuse; account identity is discarded before event-row storage. Infrastructure still processes connection and authentication metadata. TO VERIFY — release review: confirm the final app's emitted events, consent controls and infrastructure log linkage before publication; a categorical event table alone does not establish anonymity. While enabled, the client queues up to 50 pending events locally and retries sending. Turning analytics off clears pending events and stops future collection; signing out also resets the choice. Market-specific legal requirements and the final signed-app behavior still require review before release.

Raw product events, including purchase-flow events, are scheduled for deletion after 90 days. There is no third-party behavioural analytics SDK, advertising SDK, advertising identifier or cross-app tracking in the documented launch design. Apple may provide aggregate App Store analytics and platform diagnostics under your Apple settings. Hoppet keeps a bounded local reliability history; it is only shared if you deliberately send an issue report. Review any report before sharing.

Purchases and subscription status

Apple processes subscription payments. When a subscription is verified, Hoppet stores its association with your Hoppet account on Supabase, including Apple original and current transaction identifiers, product identifier, plan and subscription status, billing period and start/end dates, renewal state, grace or revocation dates, and storefront/environment information. These records let us verify ownership, restore access and provide the correct plan and AI allowance. They are separate from the product-event counts above. We do not receive your full card details.

Operational subscription records are not subject to the 90-day product-event retention rule. Entitlement rows are removed with account deletion in the current schema; Apple notification audit records, which may include original transaction identifiers, are scheduled for deletion after 90 days by a daily cleanup job. Infrastructure backups require a confirmed retention/deletion policy. TO VERIFY — owner and legal review: confirm that policy, the deployed daily cleanup job and any lawful recordkeeping exceptions before publication. Purchase records held by Apple follow Apple's own retention rules. Deleting Hoppet or your Hoppet account does not cancel an Apple subscription.

Where we plan to offer Hoppet

Launch countries and regions have not been selected. Storefront availability, audience, local privacy contacts and applicable obligations are TO VERIFY for each intended market before release. This draft does not certify compliance. Rights and lawful exceptions depend on the law that applies to you.

Why we process information

We use account and operational information to provide requested features, recover backups, enforce allowances, prevent abuse and resolve support requests. We do not sell personal information or share it for targeted advertising.

For EU/UK users, proposed legal bases are performing our service contract for account, backup and entitlement functionality; legitimate interests for proportionate service security; and consent where required for optional processing. Health information may require a separate special-category basis, such as explicit consent, in addition to an ordinary legal basis. You can withdraw consent for future optional processing without making earlier processing unlawful. TO VERIFY — legal review: confirm these bases and implement any required consent or analytics controls before launch. A policy alone does not establish consent.

Where processing happens

TO VERIFY: the configured Supabase region, processor agreements and international-transfer safeguards. Earlier project notes identify Sydney, Australia; the deployment region has not been rechecked for this draft. Supabase, Google, Apple and their service providers may process information in other countries. Review Supabase's subprocessors and the providers' privacy terms. TO VERIFY — legal review: verify applicable EU standard contractual clauses, UK transfer safeguards and vendor arrangements; do not assume an Australian server provides EU/UK residency.

Retention

• Local records and confirmed My Foods: remain until you delete them or remove the relevant local app data. Subscription expiry does not erase records.
• Cloud account and recovery snapshots: remain until account deletion or replacement through the backup flow. Infrastructure backup copies may follow separate provider retention; the exact configured recovery window must be confirmed before publication.
• AI and package review records: expire after 30 days and are subject to scheduled cleanup; successful account deletion removes account-linked rows sooner.
• Temporary AI results: become unavailable for replay after seven days. Current code performs expiry checks and cleanup on relevant requests; physical deletion of inactive accounts' expired results may occur later. Confirm the global cleanup schedule before making a stricter promise.
• AI operational ledger: completed/refunded records are scheduled for removal after 90 days, rejected/failed records after seven days and stale reservations after one day. They contain request IDs, allowance and token/cost metadata rather than meal images or description text.
• Product events: raw records expire after 90 days. They are not stored with an account ID and cannot be individually located by email.
• Provider logs, support and legal records: follow applicable provider settings, the purpose of a support case and legal obligations. TO VERIFY — owner/legal review: set and publish concrete support, authentication and platform-log retention periods; do not assume account deletion erases provider logs immediately.

Delete your account and control your data

In Hoppet, open Settings → Delete Account. The account-deletion page explains the process and the separate local-data controls. Successful deletion removes your authentication account, private backup objects and account-linked records that cascade with the account, including private AI recovery records. If deletion fails, the app must report failure rather than claim completion.

After server-confirmed deletion, Hoppet erases this account’s local records and progress photos on the iPhone used to delete it. Other accounts on the same device remain separate. Copies you exported and data retained independently by Apple or Google are not removed. Disconnected devices cannot be remotely erased immediately. Already published, non-personal catalogue facts may remain. Local food-search misses are not uploaded. Explicitly choosing USDA online search sends the search text as described above; the catalogue update process does not collect other local searches.

Optional online food lookup

An internal fatsecret US search preview sends an explicitly requested search term through Hoppet’s authenticated backend to fatsecret without the user’s name, email or account identifier. Its results are temporary, cleared on closing and expired within 24 hours; they are not saved into the diary, backups or shared catalogue. Powered by fatsecret Platform API.

Choosing Check Open Food Facts sends the scanned barcode directly from your iPhone to Open Food Facts, which receives your IP address and app identifier. Hoppet does not attach account credentials, meal history or photos. Choosing USDA online search sends your search text through Hoppet’s authenticated Supabase service to USDA FoodData Central without your name, email or account ID. Avoid personal information in searches. Local search and label scanning remain available. Selected, reviewed results are saved privately with attribution and may be included in optional private backups; they are not automatically published into the shared catalogue. Open Food Facts data is under ODbL; USDA data is CC0. Review preparation, units and nutrition before logging. See Open Food Facts privacy.

External links and website operation

If you open an external exercise search, sign-in page or provider link, that provider receives the request and applies its own terms. Do not include private information in external searches. TO VERIFY — owner review: confirm the final website host, its access logs, cookies and retention before publication; the current static pages do not embed a separate marketing analytics script.

Your privacy rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing, and withdraw consent. EU/UK users can complain to their supervisory authority, including the UK Information Commissioner's Office. Indian users can raise a grievance and exercise applicable rights as the DPDP framework takes effect. Its provisions have phased commencement; we do not claim that every provision is already operative. See the EU rights overview and MeitY DPDP rules and timeline. Contact the verified privacy contact for requests; reasonable identity checks may be needed. TO VERIFY — legal review: confirm response deadlines, exceptions, grievance escalation and any applicable nomination right.

Age and health information

Age eligibility has not been finalized. TO VERIFY — release blocker: approve and enforce the audience policy for each launch market, including the AI provider’s age requirements, before launch. Hoppet is a fitness-recording tool, not medical advice, a diagnosis or an emergency service.

Changes and contact

We will date policy changes and provide additional notice where required. The verified operator/contact details must appear here and on Support before this policy is published.