Privacy Policy

This policy applies to Hopscotch on Android (phone app) and the Hopscotch Wear OS companion app.

Information Stored on Your Device

When you use Hopscotch, the following information is stored locally on your device using Android's Room (SQLite) database:

• Card information: Card names (as you type them), barcode values, barcode formats, and card color
• Location data: The coordinates and radius you set for each card's geofence
• Reference photos: Optional photos you capture using your camera to help identify a card
• App settings: Your preferences for how the app behaves

We do not have access to this information. It never leaves your device except in the specific circumstances described below.

How Your Information Is Used

Camera

The camera is used for two purposes:

• Barcode scanning: The app reads the barcode number and format from your camera feed. No image is saved during a scan — only the decoded barcode value is retained.
• Reference photos: You can optionally take a photo to attach to a card (for example, to photograph the physical card for reference). This photo is stored on your device and may be synced to a paired Wear OS watch via the Android Wear Data Layer (see Wear OS Sync below). Reference photos are never transmitted to any server.

Location

Hopscotch uses precise location for geofencing:

• When you set a location for a card, Android monitors when you enter that area and triggers a local notification. This monitoring happens entirely on your device using Android's GeofencingClient — Hopscotch's servers never receive or log your real-time location.
• Location is also used during the location search process: when you open the location picker and search for a place, your search query and approximate current location are sent to Google Places (see Location Search below).
• The geofence coordinates you have saved for a card are not transmitted to our pass server when you add a card to Google Wallet on Android — see Wallet Pass Generation below for the exact data sent.

Background location. When you enable geofencing, the app requests permission to access your location while the app is running in the background and while it is closed. Before requesting this permission, the app shows you a disclosure screen that explains this use. Geofencing notifications will not fire when the app is closed unless background location access is granted. You can revoke location access at any time in Android's Settings.

You control location permissions in Android Settings. Geofencing requires location access to function. Background location access is required on Android 10 and later for geofences to fire when the app is not in the foreground.

Wear OS Sync

If you install the Hopscotch Wear OS companion app, card data syncs between your phone and your watch using Android's Wear Data Layer (Google's play-services-wearable API). The following data is included in the sync:

• Card names, barcode values, barcode formats, and card colors
• Optional geofence location coordinates (if set)
• Optional reference photos (if attached)

This sync routes through Google's infrastructure. Google's documentation states that Wear Data Layer channels are encrypted by the operating system and that Google does not use transit data for its own purposes. We disclose this conservatively: card data does transit Google's infrastructure as part of this sync. No server operated by Acorn Designs, LLC is involved — we never receive or store this data.

Wear OS sync only occurs if you have the companion app installed. No data is sent to any Acorn Designs, LLC server as part of this process.

Wallet Pass Generation

When you explicitly tap "Add to Google Wallet" on a card, the following data is sent over HTTPS to our pass generation server (hosted on Vercel at hopscotch-pass-server.vercel.app):

• A randomly generated, per-card UUID (not linked to your identity or device)
• Card name (as you typed it)
• Barcode value and format
• Card color

Location coordinates are not sent to our server on Android. (This differs from the iOS version, which includes location coordinates in the pass for Apple Wallet's relevant locations feature. On Android, the Google Wallet Generic Object format does not use geofence coordinates in the same way, and we do not include them in the server request.)

Our server uses this information solely to generate and digitally sign a Google Wallet JWT, which is returned to your device as a pay.google.com/gp/v/save/ URL. We do not store this data. It is processed in real-time and discarded immediately after the signed URL is returned.

Once you open that save URL, Google Wallet receives the pass content as part of the standard Google Wallet save flow. This is a Google service and is subject to Google's Privacy Policy.

As is standard with any web hosting service, Vercel may collect server access logs including IP addresses and timestamps. These logs are controlled by Vercel under their own data retention policies. See Vercel's Privacy Policy for details.

Location Search

When you open the location picker and type a search query to set a geofence, the app sends your search query and approximate current location to the Google Places API (New) to return relevant nearby results. Google receives this data and its terms of service permit Google to use query and usage data for its own purposes, including service improvement and abuse detection. See Google's Privacy Policy for details.

Location search is an optional feature. It is only triggered when you explicitly open the location picker and type a search query.

Google Maps Tile Rendering

When you view the in-app map in the location picker, the app uses the Google Maps Android SDK (maps-compose) to render map tiles. Map tile requests go to Google's servers and include the viewport coordinates (the area of the map visible on your screen). This is standard Google Maps SDK behavior. See Google's Privacy Policy for details.

Google Fonts

The app uses the Compose downloadable fonts library to fetch the Roboto typeface from Google's font CDN when the app starts. This request includes standard HTTP headers (IP address, User-Agent). No user data is attached to this request. This is a routine infrastructure call equivalent to a website loading a font from a CDN.

Local Notifications

When you enter a geofenced area, Android generates a local notification entirely on your device. No notification content or trigger data is sent to any server.

Platform Analytics (Aggregate)

Google Play Console provides anonymized aggregate analytics to developers — installs, uninstalls, active devices, retention, country/region distribution, device type, Android version. This data is collected and anonymized by Google under their own privacy policy. We see aggregate numbers only; we cannot identify individual users or devices.

Website Forms (Early Access and Product Survey)

This section applies if you use the optional forms on hopscotch.city — the early-access email signup or the one-question product survey on the "For businesses" page. These are website features and are separate from the app.

Early-Access Email Signup

When you submit your email address on the website, the following is sent over HTTPS to a Cloudflare Pages Function and stored in a Cloudflare D1 (SQLite) database operated by Acorn Designs, LLC:

• Email address (as you typed it)
• Source tag: which form you used (e.g., the business notify on the homepage or the For Businesses page) and the platform we detected from your browser (iPhone, Android, or unknown)
• Timestamp

We use your email address solely to notify you when Hopscotch for businesses is coming to your city. We do not sell, share, or trade it, and we do not enroll you in any marketing lists.

Product Survey

When you submit a vote in the "If you ran a rewards program, how would you want customers to redeem rewards?" survey, the following is sent over HTTPS to the same Cloudflare Pages Function:

• Your vote choice (one of five options)
• Timestamp

Survey votes are stored in a separate database table from email addresses, and the two are never linked. Votes are fully anonymous. We use survey results in aggregate to prioritize what we build first.

Retention and Deletion

• Email addresses: retained until you request deletion, or up to 18 months from collection — whichever comes first.
• Survey votes: retained indefinitely as anonymous aggregate counts; not tied to any individual.

To remove your email from the early-access list, email hello@hopscotch.city with the subject "Delete my data" and we'll remove it within 7 days.

Cloudflare Infrastructure

The Cloudflare Pages Function and D1 database run on Cloudflare's infrastructure. Cloudflare may collect server access logs (IP addresses, timestamps) under their own retention policies. See Cloudflare's Privacy Policy.

Information the App Does Not Collect

Aside from the optional website forms described above, Hopscotch does not collect:

• No user accounts: The app does not require registration, login, or authentication
• No analytics or tracking: We do not use analytics SDKs, advertising networks, Firebase, Crashlytics, Sentry, Mixpanel, or any other third-party behavioral tracking service. The app runs with zero external code dependencies for analytics or tracking
• No personal information: We do not collect your name, email address, phone number, or any other personally identifying information
• No browsing or usage patterns: We do not track how you use the app
• No location history: Geofence processing happens on-device via Android's GeofencingClient; we never receive or log your real-time location
• No advertising ID: We do not read the Android Advertising ID (AAID)
• No crash reports sent to us: The app does not use a crash reporting SDK. Any crash data collected by Android's platform-level reporting (Google Play Services) is governed by Google's own policies and is not data we collect or receive

External Links

The Settings screen contains links that open in your browser or email client: a support page (https://hopscotch.city/support), this privacy policy, and a voluntary "Buy Me a Coffee" tip link (https://buymeacoffee.com/robstout). Tapping these hands off to your browser or email app. We do not collect any data from these interactions. The linked third-party sites are subject to their own privacy policies.

Data Storage and Security

• Local storage: All card and location data is stored on your device using Android's Room (SQLite) database within the app's sandboxed storage
• No cloud sync from Hopscotch: The app does not actively sync data to Google Drive, an Acorn Designs, LLC cloud service, or any other cloud platform. Hopscotch also disables Android's Auto Backup, so your card data is not copied to Google Drive — it stays only on your device. (Wear OS sync routes through Google's Wear Data Layer infrastructure as described above, but no Acorn Designs, LLC server receives or stores that data.)
• Server communication: Outbound connections occur when you explicitly trigger Google Wallet pass generation, when you search for a location, when map tiles are rendered, and when Google Fonts are loaded on startup. All connections use HTTPS
• Device security: Your data is protected by your device's PIN, pattern, password, or biometric authentication. Android's file-based encryption protects the app's storage directory
• Data encrypted in transit: All server communication uses HTTPS/TLS. Wear Data Layer sync is encrypted by the Android operating system

Third-Party Services

The app uses the following external services:

We do not use any advertising networks, analytics platforms, or other third-party tracking services.

Children's Privacy

Hopscotch does not collect personal information from any user, regardless of age. Because we do not collect, store, or process personal information, COPPA and similar children's privacy laws do not apply — there is no personal data to govern. If you have questions, contact us at hello@hopscotch.city.

Note on content rating vs. Play Store target audience. Hopscotch carries a Google Play content rating of "Everyone" (IARC/ESRB), which reflects the absence of objectionable content — violence, mature themes, and similar. Content ratings and target audience age bands are separate settings in Google Play. Hopscotch is designed for adults and teenagers who manage loyalty and membership cards; it is not designed for or marketed to children. Accordingly, the app's Play Store Target Audience is set to ages 13 and above, which keeps the app outside Google Play's Families Policy and its associated SDK and data-handling requirements. This is a Play Store publishing configuration, not a restriction on who may use the app — the privacy policy itself imposes no age floor because there is no personal data to protect.

Your Rights

Because all data is stored locally on your device:

• Access: You can view all your data within the app at any time
• Delete: You can delete individual cards within the app, or delete all data by uninstalling the app
• Delete watch data: Uninstalling the Wear OS companion app removes its local copy of card data from the watch
• Export: There is currently no export feature

If you have questions about data processed through our wallet pass server, contact us at hello@hopscotch.city.

Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we will update the effective date at the top of this document and may display a notice within the app.

Data Retention

• On your device: Data persists until you delete individual cards or uninstall the app
• On the Wear OS watch: Data persists until you uninstall the companion app or delete it from the watch
• On our wallet pass server: Nothing. Pass generation data is processed in real-time and immediately discarded after the signed URL is returned to your device
• Early-access email addresses (website): Retained until you request deletion, or up to 18 months from collection — whichever comes first
• Survey votes (website): Retained indefinitely as anonymous aggregate counts; not linked to any individual

European Users (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following applies:

Legal basis for processing. When you generate a Google Wallet pass, we process your card data based on your explicit request (performance of a contract — you initiated the action). Because we do not retain that data, there is no ongoing processing to govern. When you use location search, your query and location are processed by Google under Google's own legal basis declarations for its APIs. When you submit your email address to the early-access list on hopscotch.city, we process it based on your consent (Article 6(1)(a) GDPR); you may withdraw consent at any time by emailing us. Survey votes are stored without any identifier and are not personal data under GDPR.

Data transfers. Our wallet pass server is hosted on Vercel, which may process data in the United States and other regions. Vercel complies with GDPR data transfer requirements via Standard Contractual Clauses. Google Places, Google Maps, and other Google services process data under Google's own GDPR compliance framework. See Google's privacy documentation for details on their data transfer mechanisms.

Your rights under GDPR. In addition to the rights listed above, you have the right to:

• Restriction of processing: Request that we limit how your data is used
• Data portability: Receive your data in a portable format (all card data is already on your device)
• Object to processing: Object to data processing based on legitimate interest
• Lodge a complaint: File a complaint with your local data protection authority (in the EEA, the supervisory authority in the EU member state where you reside; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner)

Aside from email addresses submitted to our early-access list, we do not retain personal data on our servers. Most data subject requests are fulfilled by the fact that all your app data is on your device and under your control. To exercise any rights — including requesting deletion of your email address from the early-access list — contact us at hello@hopscotch.city.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the following applies:

Categories of personal information collected. When you generate a Google Wallet pass, your card data (card name, barcode value, format, color, and a random UUID) is transmitted to our pass server and immediately discarded — it is not stored or retained by us. When you use location search, your search query and approximate location are transmitted to Google Places (see Third-Party Services). When you use the in-app map, viewport coordinates are transmitted to Google Maps. When you submit your email address to our early-access list on hopscotch.city, we collect and retain your email address along with the form source and a timestamp (see "Website Forms" above).

Sale or sharing of personal information. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Your rights. You have the right to know what personal information is collected, to request deletion, and to opt out of sale or sharing. To request deletion of your email address from the early-access list, see "Retention and Deletion" above. Card data is stored entirely on your device and under your control.

To submit a request, contact us at hello@hopscotch.city.

International Users

The app is developed and operated in the United States. The wallet pass server is hosted on Vercel's infrastructure, and the website (hopscotch.city) plus its early-access and survey backend run on Cloudflare's global network. Both providers may process data in various regions. Google Places, Google Maps, and other Google services process data globally under Google's own policies. By using the app or website, you acknowledge that data may be transferred to and processed in the United States.

Contact

If you have questions about this privacy policy or how Hopscotch handles your information:

Acorn Designs, LLC
Email: hello@hopscotch.city