Security

Sign-in is handled by Supabase Auth — by magic link or password — and we never store your password ourselves. Sessions are carried in signed, http-only cookies that JavaScript on the page cannot read.

Every decision about what you may see or change is made on the server, from the session, on each request. The interface hides things you cannot do, but hiding is never the control: the same check runs again behind it, so a modified page grants nothing extra.

Rooms and walls are public, inner-circle, or private, and the stricter of the two settings wins — a private room does not leak through a public wall inside it. Private and inner-circle material is filtered out server-side before a page is built, not hidden in the browser.

Share links can require a password and can be set to expire. Passwords on share links are stored hashed, never in the clear, and unlocking one sets a signed cookie scoped to that room alone.

On team accounts, each seat has a role — owner, editor or viewer — and the role is enforced on the server for every action that changes anything. Removing someone ends their access on their next request rather than whenever a cookie expires.

Uploads go to Cloudflare object storage, and display copies are served through Cloudflare’s image pipeline. Everything travels over TLS, and files are encrypted at rest by the storage provider. The database is likewise encrypted at rest by Supabase.

The original file you uploaded is kept as uploaded. Resized and reformatted versions are derived for display; we do not overwrite your original with a compressed one.

Card details are handled entirely by Stripe and never reach our servers. We store only the identifiers needed to connect your account to your subscription. Billing actions are restricted to account owners.

When you connect Dropbox or Google Drive, HOP asks for the narrowest access that will work — with Drive, only the folder you pick through Google’s own picker, using a token that expires within the hour and is never stored. Where a refresh token has to be kept, it is encrypted before it is written down, with a key held outside the database.

Wallet imports read public blockchain data. Verifying that a wallet is yours is done by signing a challenge — HOP never asks for a seed phrase or a private key, and cannot move anything.

Database tables carry row-level security, so nothing is readable through the public API surface without going through our server. The administrative credential that bypasses it is server-only and is never sent to a browser; a build check fails the deploy if server-only code becomes reachable from client code.

Administrative access is limited to a small named allowlist, matched on verified email addresses rather than on anything a request can claim about itself.

Analytics for shared rooms are first-party. We do not store visitors’ IP addresses; they are combined with a salt that is regenerated every day and hashed, so visits cannot be linked across days or traced back to a person. There is no third-party tracker on a shared room page. The full description is in the privacy policy.

HOP has not completed a SOC 2 audit or an ISO 27001 certification, and has not had a third-party penetration test. We do not imply otherwise; when it changes, this page will say so with a date.

We do not offer contractual uptime guarantees. The register records that a file existed in an account at a time — it is not a claim about authorship or ownership, and it does not depend on a blockchain.

Everything in HOP is exportable, on every plan, precisely so that is easy – but also keep your own copies of anything irreplaceable.

If you find a vulnerability, please tell us before telling anyone else, at security@hop.gallery. Give us enough detail to reproduce it. We will confirm we have it, keep you updated, and we will not pursue anyone who reports in good faith and does not access, alter or retain other people’s data while doing so.

We do not run a paid bounty programme, but we credit anyone who wants to be credited.