Privacy Policy

1. Data Controller

Agency Fourtify UG (haftungsbeschränkt) Dürerstraße 38, 42579 Heiligenhaus, Germany Email: info@agencyfourtify.de Phone: 017644684970

2. Hosting

This application is hosted on a server by Hetzner Online GmbH in Germany. When accessing the app, server log files are automatically recorded (IP address, timestamp, requested resource, status code). This data is stored solely to ensure proper operation and is automatically deleted after 30 days.

3. Data Collection and Processing

During registration, we collect your email address, display name, and password (hashed). During use, travel data (destinations, daily plans, hotels, flights, trains), journal entries with photos, expenses, packing and wish lists, as well as chat messages with the AI assistant are stored. The legal basis is Art. 6(1)(b) GDPR (contract performance).

4. Cookies and Local Storage

HoppKit does not use tracking cookies or analytics. Fonts are served locally (no external requests to Google Fonts). Only authentication tokens (JWT), the language preference, and the cookie notice status are stored in Local Storage (web) or Secure Storage (mobile). These are technically necessary for the application to function.

5. External Services

Google Maps API

The Google Maps API is used for map display, place search, and route calculation. Location data is transmitted to Google LLC. Privacy policy: https://policies.google.com/privacy

OpenRouter

The AI travel assistant uses OpenRouter (OpenRouter Inc., USA) as its AI gateway. Chat messages and travel context data are transmitted to OpenRouter for processing. No user data is used for training. Privacy policy: https://openrouter.ai/privacy

API Ninjas

API Ninjas is used for flight status queries. Only flight numbers are transmitted. Privacy policy: https://api-ninjas.com/privacy

Stripe

For payment processing of HoppKit Pro, we use Stripe (Stripe Inc., USA). During a purchase, your email address and payment information are transmitted to Stripe. Stripe processes this data as an independent data controller. Privacy policy: https://stripe.com/en/privacy

Brave Search

The AI travel assistant can perform web searches via the Brave Search API (Brave Software Inc., USA) when needed. Search queries are transmitted server-side to Brave; your IP address is not shared with Brave. Privacy policy: https://search.brave.com/help/privacy-policy

Open-Meteo

The Open-Meteo API (Open-Meteo GmbH, Switzerland) is used for weather forecasts. Only coordinates (latitude/longitude) are transmitted server-side. Open-Meteo is an open, free service without authentication.

Apple Push Notification Service

For push notifications on iOS, the Apple Push Notification Service (APNs) by Apple Inc. (USA) is used. Device tokens and notification content are transmitted to Apple. Privacy policy: https://www.apple.com/legal/privacy/

OpenFreeMap

In the mobile app, map tiles are loaded from OpenFreeMap. Your IP address is transmitted to OpenFreeMap servers. No other personal data is transferred.

GetYourGuide

In the day view we offer a link to GetYourGuide (GetYourGuide Deutschland GmbH, Berlin) for relevant places. This is an affiliate/partner link: only when you click “Tickets” are you redirected to getyourguide.com, where their privacy policy applies. No GetYourGuide script is loaded on HoppKit’s pages and no GetYourGuide cookies are set. If you book via this link, we may receive a commission. Privacy policy: https://www.getyourguide.com/privacy

6. International Data Transfers

Some of the services we use are based in the USA (Google LLC, OpenRouter Inc., Stripe Inc., Apple Inc., Brave Software Inc., API Ninjas). The transfer of personal data to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We ensure that all third-party providers maintain an adequate level of data protection.

7. Push Notifications

Push notifications are optional and require your explicit consent. On the web, they are delivered via Web Push (VAPID); on iOS, via the Apple Push Notification Service (see §5). You can disable notifications at any time in Settings.

8. Data Security

Sensitive data is stored using AES-256-GCM encryption. All communication is encrypted via HTTPS/TLS. Passwords are hashed with Argon2id. Photos are stripped of EXIF metadata on the server.

9. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR). You can delete your account at any time in Settings — all your data will be permanently removed. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

10. Data Protection Inquiries

For privacy-related questions, please contact: Agency Fourtify UG (haftungsbeschränkt) Dürerstraße 38, 42579 Heiligenhaus, Germany Email: info@agencyfourtify.de