1. Who we are

William Banham ("goHop", "we") is the controller of the personal data described here. Our address is . You can contact us about privacy at hop@bnhm.dev.

2. What we collect

If you have an account

• Your name, email address and profile image, from you or from GitHub if you sign in with it.
• A password if you sign up with one. We store it hashed, never in plain text.
• Session records: a session token, the IP address and browser details of the device you signed in from, and when the session expires.
• The links you create: names, short codes, destination URLs, limits, expiry dates, settings, and any link password (stored hashed).
• Earnings records: how much each link earned, fees, withdrawals and the status of your payout account.

If you open a short link (a visitor)

You don't need an account. When you open a link we record:

• Technical details: your browser's user agent, and the browser, operating system and device type we work out from it.
• Where you came from: the referring page and any utm_ campaign tags on the link.
• Approximate location (country, region and city) where available.
• Two hashed identifiers made from your IP address: one combined with your user agent, and one from the IP address alone. Both use a secret key, so we don't store your raw IP address with the view.
• Whether you were signed in to goHop (so owners' own views can be excluded).
• Whether an advertisement was shown to you, used to decide whether the view counts towards earnings.

Link owners see statistics and per-view technical details such as approximate location, device and referrer. They never see IP addresses.

Payments

Payouts are handled by Stripe. Stripe collects your identity and bank details directly, under its own privacy policy. We store your Stripe account ID, whether it can receive payouts, and our transfer records. We never see your bank details.

Contacting us

If you email us we keep the message and our reply.

3. Why we use it, and our legal basis

Some decisions are made automatically, such as whether a view counts towards earnings. If you think one is wrong, email us and a person will review it.

4. Who we share data with

• Stripe processes payouts and verifies the identity of people who want to be paid.
• Google (AdSense) serves and measures the ads on the short-link page. See section 5.
• GitHub, if you choose to sign in with it.
• Font Awesome, whose script we load for icons. Your browser contacts their servers when it does, which shares your IP address and browser details with them.
• Service providers such as hosting and email: [list your providers].
• Professional advisers, and authorities where the law requires it.

We don't sell personal data.

5. Advertising and Google

We show ads provided by Google AdSense on the short-link page. Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.

In the UK, the EEA and Switzerland, personalised ads only run with your consent. You can opt out of personalised advertising at Google Ads Settings or aboutads.info. To learn how Google uses data from sites that use its services, see Google's partner sites page.

6. Transfers outside the UK

Stripe, Google and some other providers process data in the United States and elsewhere. Where that happens we rely on safeguards the UK law recognises, such as the UK–US data bridge or standard contractual clauses with the UK addendum.

7. How long we keep it

• Account data: while your account is open, and for a short time after you close it.
• View records: for as long as the link exists, so analytics and earnings history stay accurate.
• Financial records: for the period tax law requires, typically six years in the UK.
• Support emails: as long as needed to deal with your request.

8. Security

Passwords (yours and link passwords) are stored hashed. Visitor IP addresses are hashed with a secret key. Access to production systems is restricted. No system is perfectly secure, and if a breach puts your rights at risk we will tell you and the regulator as the law requires.

9. Your rights

You can ask us to access, correct, delete or restrict the use of your personal data, to move it to another service, and to object to uses based on legitimate interests. You can withdraw consent at any time from our cookies page. Email hop@bnhm.dev and we will reply within one month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

10. Children

goHop accounts are for people aged 18 or over, and we don't knowingly collect data from children for accounts. Short links can be opened by anyone, and we don't target them at children.

11. Changes to this policy

If we make material changes we'll tell account holders by email or in the app before they take effect, and update the date above.