Privacy

Your account

Email address, username, display name, and anything you choose to add to your profile — bio, avatar, social links. Your email is held by our authentication provider; we read it to identify you and to send you the messages described below.

What you put in HOP

The images, video, text and quotations you upload or import, together with whatever you record about them: titles, provenance, acquisition details, valuations, condition, private notes, custom fields. Some of that is deliberately private, and we treat all of it as yours.

Billing

If you subscribe, Stripe processes the payment and holds the card details. We store only the identifiers that let us match your account to your subscription. We never see or store your card number.

Visits to your rooms

For rooms you share, we record that a visit happened: a coarse location from the network edge (country, region, and sometimes city), the referring site, and how long the visit lasted. We do not store the visitor's IP address — see the next section.

How the product is used

Product analytics: which features are opened, which flows are completed, which fail. Used to decide what to build and fix. Tied to your account id, never sold, and not used to target advertising.

Things you send us

Feedback messages, waitlist signups, and — on team accounts — inquiries left by visitors to a viewing room, which include the name, email and message that person typed.

We think this deserves its own section, because it is the part most services are vague about.

When someone visits a room you shared, we do not store their IP address. We combine the IP and browser user-agent with a random salt that is generated fresh every day, hash the result, and keep only the hash. That lets us count one person visiting three times as one visitor rather than three — but only within a single day. When the salt rotates at midnight UTC, yesterday’s hashes can no longer be connected to today’s, and none of them can be reversed back to a person.

Your own visits to your own rooms are recognised and excluded, so your numbers are not inflated by you. Traffic we identify as automated is marked as such. This data is first-party — it is not shared with an advertising network, and there is no third-party analytics script on a shared room page.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not run advertising on HOP. We do not use the contents of your collection — your images, your notes, your records — to train machine-learning models, and we do not generate text or images on your behalf and present them as yours.

We do not display public follower counts, view counts or like counts, so nothing about your account is turned into a public scoreboard.

HOP is a small operation built on infrastructure we do not run ourselves. These providers process data on our behalf, under their own terms:

Supabase

Authentication and the primary database.

Vercel

Application hosting and the network edge.

Cloudflare

Image delivery and object storage for your files.

Stripe

Payments and subscription billing.

Resend

Transactional email.

PostHog

Product analytics.

Some services are used only if you choose a feature that needs them. Connecting Dropbox or Google Drive shares only the folder you pick, with access that expires; importing a wallet reads public blockchain data through a chain provider. If you never use those features, they never see anything of yours.

We send messages that report something you need to know: confirming an account, resetting a password, a receipt, a change to your plan, a team invitation, an inquiry left in one of your rooms, or being added to someone’s inner circle. These are part of the service.

Anything that is not — a newsletter, an announcement — carries an unsubscribe link and honours it.

We use cookies to keep you signed in, to remember which account you are acting in if you belong to more than one, and to remember that you have already entered the password for a protected room. Your browser also stores small preferences locally, such as your light or dark setting.

There are no advertising cookies and no third-party tracking pixels.

We keep your account and its contents for as long as the account exists. Deleting your account removes your sign-in credentials and your owner record, and everything beneath it — rooms, walls, pieces, your library, share links and their analytics — is deleted with it. This is not reversible, and we do not keep a shadow copy.

Backups taken for disaster recovery may retain content for a short period after deletion before they age out. If you move from a paid plan to the free one and your collection is over the free limits, we keep the excess for thirty days so you can export or resubscribe before anything is removed.

You can export your collection and its records at any time, from Settings — including PDF catalogues and per-piece certificates. You can make your profile and each room undiscoverable, so they never appear in search, while direct links keep working. You can delete your account yourself.

Depending on where you live you may also have rights to access, correct, or restrict the use of your personal information, and to object to it. Write to us and we will do it — we would rather answer the email than make you find a form.

HOP is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, tell us and we will remove it.

If this policy changes in a way that materially affects you, we will say so — by email or in the product — rather than quietly editing the page. The date at the top always reflects the current version.

HOP is made by TENDER Art, Inc. in New York. Questions, requests, or anything that reads wrong here: hello@hop.gallery. See also our terms and security overview.