Join the beta

Privacy Policy

Last updated: 19 October 2026 (version 2026-10-19, usage analytics added)

HOP is a social app for people who play sport: share plays (photos) and highlights (short videos), find and join sport events, and follow other athletes, coaches and brands. This policy explains what personal data we process, why, and the rights you have under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.

Who we are

The data controller is Start.it Digital Agency, a company registered in France under SIREN 881 474 746, with its registered office at 66 avenue des Champs-Élysées, 75008 Paris, France ("Start.it", "we").

For any question or request about your data, write to hello@startit.agency. We answer within one month.

Who can use HOP

HOP is for people aged 15 or older. By creating an account you confirm that you are at least 15. If we learn that an account belongs to someone younger, we delete it.

What we collect and why

Your account — email address, password (stored only as a secure hash), or your Apple ID identifier if you use Sign in with Apple, plus the name Apple shares the first time. Why: to create your account and let you sign in. Legal basis: performance of our contract with you (the Terms of Use).

Your profile — username, display name, profile photo, headline, bio, website, account type (athlete, coach, brand), city, country and sports. Why: to show your profile to other members and recommend people, events and places. Basis: contract. Your profile is visible to all signed-in HOP members.

Optional profile details — date of birth, gender, height and weight ("profile card"). You decide whether to add them and can remove them at any time in Edit profile. Other members never see your date of birth, only your age. Height and weight can reveal information about your health, so we only store them with your explicit consent, which you give with the "Show body details" switch and can withdraw with the same switch; withdrawing erases them. Basis: your consent (GDPR art. 6(1)(a) and 9(2)(a)) for height and weight; contract for the others.

What you share — plays, highlights (photos and videos with captions and the place name you type), comments, likes, saves, personal records (sport, discipline, result, date, optional note and proof photo, and the athletes you tag), messages (text, photos and what you share in conversations, when you read them), events you create or join, the places you favourite, the people you follow and the posts you send to other members. Why: this is the service. Basis: contract. Plays, highlights, comments, events and who joins them are visible to all signed-in members. Personal records are too, unless you make one visible only to you (and the athletes tagged on it). Messages are only visible to the people in the conversation; they are not end-to-end encrypted, and we don't read them except to handle a report or a legal obligation. Photos and videos are stored at web addresses that are not listed anywhere but can be opened by anyone who has the link.

Your location — only if you allow it in iOS. We use it on your device to centre the map, and send it to our server to sort places by distance (not stored). Photos are re-encoded before upload, which removes their GPS data. Basis: your consent, given in iOS and withdrawable in iOS Settings.

Showing you on the map — only if you turn on "Show me on the map" in Settings. Other members can then find you in Nearby › Map › Athletes. We store your profile city's approximate position and, while you use the app with location allowed, an area of about 1 km around you (never your exact position). The area is deleted after 14 days without an update, and everything is erased when you turn the option off. Basis: your consent, withdrawable at any time with the same switch.

Push notifications — if you allow notifications in iOS, the identifier Apple gives your phone for push messages (device token), linked to your account. Why: to alert you to likes, comments, follows, joins and things people send you. Basis: your consent, given in iOS and withdrawable in iOS Settings; signing out or deleting your account removes it.

Safety — the accounts you block and the reports you send (with the reason you give). Why: to protect members and moderate content. Basis: our legitimate interest in keeping HOP safe.

Technical data — IP address, device and app version, and sign-in events, kept in our server logs. Why: security, preventing abuse, fixing problems. Basis: legitimate interest.

Usage analytics — which screens you open and which features you use (for example "a play was posted" or "an event was joined", with its kind or sport), your device's language and screen size, and a random identifier created on your phone and renewed every 13 months. It is not linked to your account, and never includes your name, email, what you write or search, or who you talk to. Why: to see which features are used and improve the app. Basis: our legitimate interest, within the limits set for audience measurement; you can turn it off at any time in Settings › Share usage analytics.

Your consent records — the date you accepted these terms, confirmed you are 15 or older, and gave or withdrew consent for body details. Why: to show we respected your choices. Basis: legal obligation.

We don't sell your data, show ads, use advertising trackers or third-party analytics, or profile you for marketing.

Who processes your data for us

Your data is stored in the European Union. To make them load faster, copies of the photos and videos you share are temporarily kept on Bunny.net's servers around the world, close to the people viewing them. Resend is based in the United States, so your email address is transferred there when we send you an account email; this transfer is covered by the European Commission's standard contractual clauses in our data processing agreement with Resend.

How long we keep it

When you delete your account in Settings, we immediately delete your profile, plays, highlights, comments, likes, follows, events, personal records, messages, favourites and uploaded photos and videos. Deleting a photo or video also removes its copies from Bunny.net's servers.

Your rights

You can:

Write to hello@startit.agency. You can also complain to the French data protection authority, the CNIL (www.cnil.fr).

Security

Data travels encrypted (HTTPS). Access to your data in our database is restricted by account, and passwords are stored as secure hashes. If a breach puts your rights at risk, we will tell the CNIL within 72 hours and inform you when required.

Changes

If we change this policy in a way that matters, we will tell you in the app before it applies.