[Last updated: replace before launch]
This is a good-faith starter document, not legal advice. It has not been reviewed by a lawyer. Have counsel review and adapt it before relying on it. Items in [BRACKETS] need the owner’s input.
Who we are
hop is operated by [BRACKETED: company legal name]. For privacy questions, contact support@hop.n3wth.com [BRACKETED: confirm privacy / DPO contact email].
What we collect
- Account & profile. When you sign in via Auth0 we store your Auth0 user identifier and basic profile fields it provides (such as name, email, and avatar).
- Home airport. The home airport you set, used to personalize search.
- Loyalty balances. Balances you enter manually, and — only if you choose to connect it — balances synced from AwardWallet.
- Saved searches. Searches you save so you can return to them.
- Bookings. Records of cash bookings you make through hop (such as itinerary and provider references).
- Payment details.For cash bookings, your card is collected and processed by Duffel’s hosted payment component. hop does not receive or store your full card number.
How we use it
- To run the core service: compare cash vs. miles and show award sweet spots.
- To personalize results to your home airport and tracked balances.
- To facilitate cash bookings via Duffel and keep your booking records.
- To maintain your account, security, and sessions.
Third parties we share with
We rely on the following service providers to operate hop:
- Auth0 — sign-in and identity.
- Supabase — database storage for your home airport, balances, saved searches, and bookings.
- Duffel — flight search and cash-booking processing, including payment.
- AwardWallet — optional loyalty-balance sync that you connect and can revoke. When connected, hop receives the balances it returns.
- Google (Gmail) — optional, explicit-consent connection so hop can learn from your past trips. We request read-only access and read only your travel-confirmation emails (a tight search). We store only the normalized trip facts (destination, month, airline, cabin, whether points were used) — never the emails themselves — and you can disconnect and delete them at any time.
- seats.aero — award availability data.
- Unsplash — destination imagery (image requests are made to Unsplash).
We do not sell your personal data. Each provider processes data under its own terms and privacy policy.
Data retention
We keep your data while your account is active and as needed to provide the service. When you delete your account, we delete or anonymize the data we hold for you, except where we must retain records to meet legal, accounting, or fraud-prevention obligations. [BRACKETED: confirm retention periods with counsel.]
Your rights & controls
- Access and correction. View and edit your home airport, balances, and saved searches from your account.
- Disconnect AwardWallet. You can revoke the AwardWallet connection at any time from your account; we stop syncing balances from it.
- Disconnect Gmail. You can revoke Gmail access at any time from your account; we revoke our token with Google and delete the stored trips.
- Delete your account. You can request account deletion from your account or by emailing support@hop.n3wth.com.
Depending on where you live, you may have additional rights over your personal data. We honor applicable requests. [BRACKETED: confirm jurisdiction-specific rights and response process with counsel.]
Cookies
hop uses essential cookies needed to sign you in and keep your session active (set by Auth0 and Supabase). We do not run a third-party advertising or cross-site tracking stack. [BRACKETED: update if you later add analytics.]
Children
hop is not directed to children and is not intended for anyone under [BRACKETED: age threshold, e.g. 13 or 16]. We do not knowingly collect data from children under that age.
Security
We use reasonable technical and organizational measures to protect your data, and rely on established providers (Auth0, Supabase, Duffel) for sensitive operations. No method of storage or transmission is perfectly secure.
International transfers
Our providers may process and store data in countries other than yours. Where data is transferred internationally, we rely on the safeguards offered by those providers. [BRACKETED: confirm transfer mechanism with counsel.]
Changes to this policy
We may update this policy; material changes will be reflected by updating the “Last updated” date above.
Contact
Email support@hop.n3wth.com [BRACKETED: confirm contact email] with any privacy question or request.