Hopkey

Privacy Policy

What personal data the Hopkey app and this site process, why, who receives it, how long it is kept, and how to have it deleted.

Last updated November 12, 2026

Controller

The controller under the General Data Protection Regulation (GDPR) is Sorin-Ionut Curescu, Nürnberg, Germany ("we", "us"). The full postal address is on the imprint. For any privacy question or request, write to [email protected]. We are not required to appoint a data protection officer and have not appointed one.

Scope

This policy covers the Hopkey app for Mac and this website, hopkey.app.

Data that stays on your Mac

To show results in its bar, Hopkey reads the open tabs of your supported browsers and, if you grant Full Disk Access, your browser history and Safari Tab Groups. This data is processed on your Mac and is not sent to us or anyone else.

Hopkey's settings, the items you pin or save, and cached site icons are stored on your Mac. A license key is stored in the macOS Keychain. Hopkey has no account, no analytics and no crash reporting.

What the app sends over the network

  • Search suggestions. While you type a search, the text is sent to Google, or to the site you search (Amazon, Wikipedia, DuckDuckGo), to get suggestions. That provider receives the text and your IP address. You can turn suggestions off in Settings.
  • Site icons. Hopkey first uses the icons your browsers have already saved on your Mac. If none is found, it loads the icon from that site, which receives your IP address. Icons are then cached on your Mac.
  • Updates. Hopkey checks hopkey.app for updates and downloads them from there. The request includes the app version.
  • License. When you activate a license key, Hopkey sends the key, the name of your Mac as the activation label, and the app version to Polar. About once a day it checks the key with Polar, sending the key and an activation id. When you remove the license from a Mac, the activation id is sent.

Visiting hopkey.app

  • Hosting and delivery. The site and downloads are served by Cloudflare, Inc. To deliver a page or file, Cloudflare processes your IP address, browser user agent, the requested URL, the referring URL and the time of the request. This is necessary to deliver the site and keep it secure, including limiting how often one IP address can download (Art. 6(1)(f) GDPR). Logs are kept by the host for a limited period and then deleted.
  • Download and update counts. Downloads, update checks and updates are counted. Each count stores only its kind and the app version, with no IP address or other identifier.
  • Cookies and browser storage. The site sets no cookies and loads no analytics or advertising scripts. Fonts and images are served from this domain. The site may keep a small value in your browser's storage to remember a display choice. It is never sent to a server.
  • Buying Pro. Pro is sold through Polar, which acts as merchant of record. When buying is open, the Buy button opens Polar's checkout, and pages load Polar's checkout script from cdn.jsdelivr.net, which receives your IP address and browser information. Polar processes the details you enter at checkout, such as your email address and payment details, under its own privacy policy. We receive the order information, not your card details.
  • Email. If you write to us, your email address and message are processed to answer you (Art. 6(1)(b) or (f) GDPR).

Legal bases

  • Contract, Art. 6(1)(b) GDPR. Providing the features you use, including search suggestions, updates, license activation and license checks.
  • Legitimate interests, Art. 6(1)(f) GDPR. Delivering and securing the site and downloads, preventing abuse, and counting downloads and updates without identifying anyone.
  • Legal obligation, Art. 6(1)(c) GDPR. Retention of tax and accounting records for purchases.

You are not legally or contractually required to provide personal data. Some features cannot work without it; for example, a license cannot be activated without sending the key. No decisions based solely on automated processing that have legal or similarly significant effects are made about you.

Recipients

  • Cloudflare. Hosting and delivery of the site and downloads, acting as processor under a data processing agreement (Art. 28 GDPR).
  • Polar. Sale of Pro, payment, and license keys, as merchant of record.
  • Search suggestion providers. Google, Amazon, Wikipedia and DuckDuckGo receive the text you type when suggestions are on and you search with them.
  • Websites. Sites whose icons Hopkey loads.
  • Authorities. Where there is a legal obligation to disclose.

Some of these providers are located in or process data in the United States. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Retention

Personal data is kept only as long as needed for the purpose it was collected for, and then deleted:

  • Data on your Mac: until you delete it or remove Hopkey.
  • License activations: while the activation exists. Settings, License, Remove from this Mac ends it.
  • Logs: for a limited period needed for security and troubleshooting.
  • Tax and accounting records: for the periods required by German law, up to ten years.

Deletion

Everything Hopkey stores locally is on your Mac, and you can remove it by deleting the app and its data. To have data we hold about you deleted, email [email protected]. Data is deleted without undue delay and at the latest within one month, unless the law requires it to be kept.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to [email protected]. Requests are answered within one month, which can be extended by two further months where necessary (Art. 12(3)).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

Right to object

Where processing is based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Processing then stops unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. To object, write to [email protected].

Security

Appropriate technical and organisational measures protect personal data (Art. 32 GDPR), including encryption in transit and keeping license keys in the macOS Keychain.

Children

Hopkey is not directed at children under 16. If it becomes known that data of a child under 16 was collected without the required consent, it is deleted.

Changes to this policy

This policy is updated when processing changes or the law requires it. The current version is always on this page, with its date at the top.