Privacy

Where the things you send go

Directly from one device to the other, over an encrypted connection: on your own Wi-Fi where both devices are on it, and otherwise straight between them across the internet. Files, typed messages, voice recordings, reactions, edits and deletions all travel the same way. Nothing is stored anywhere along the route, because there is no route — the two devices are talking to each other.

Between a phone and your own desktop you can prove this: turn off your internet and keep transferring. It still works, because nothing was ever going anywhere else.

The things that are not just your devices

Two phones that are not on the same Wi-Fi cannot find each other unaided, and a phone with its screen off cannot be reached at all. Making either work needs help, and help means somebody else sees something. Here is exactly what, and exactly how much.

A mailbox we run. When you create an invitation, your device seals a small pairing message and leaves it with a service of ours (a Cloudflare Worker) under a random name. The other device collects it and it is deleted. The key that unseals it travels inside the link or the QR code — never to the mailbox — so what the mailbox holds is a few hundred bytes it cannot read, for at most fifteen minutes, and usually seconds. It holds no files, no messages, and nothing that says who either of you are.

Two STUN servers we do not run. To connect across networks, both devices ask a public STUN server what their address looks like from outside. hopli uses Cloudflare's and Google's. Those requests disclose your IP address to Cloudflare and to Google, the way loading any web page discloses it to whoever serves the page. They carry nothing else — no file, no message, no indication of who you are connecting to. This is how every browser-based direct connection works, and it is the honest cost of not putting a relay in the middle.

A push service, only if you turn on notifications. This one is off unless you ask for it, because it is the only part of hopli that involves a company you did not choose in a message you did send.

A phone with a locked screen is not running hopli, so nothing can be handed to it. What it does have is a connection its browser keeps open to a push service — Google's on Android and in Chrome, Apple's on an iPhone, Mozilla's in Firefox — whose whole job is waking a sleeping device. If you turn notifications on, your phone gets an address there and hands it to the person you are paired with, over the connection between you and nowhere else. When they message you while your screen is off, their phone seals a message to that address and hands it to our worker, which passes it on.

That last step is a machine of ours in the path, and it is the only place in hopli where that is true. It is not a design we chose: a push service refuses requests made directly by a web page, so there is no version of this without a forwarder. What passes through is already sealed — the worker cannot read your message any more than Apple or Google can. What it could see, if it kept anything, is that something was sent to a particular subscription at a particular time. It keeps nothing and logs nothing. That is a promise you have to take our word for, which is weaker than the rest of this page, and it applies only if you turn notifications on.

The message is sealed to keys only your phone holds, so the push service carries an envelope it cannot open. What it does learn is that something reached your device at that moment, and roughly where your device is on the network. That is real, and it is more than the rest of hopli gives away, which is why it is asked for rather than assumed and why turning it on says so in those words. Ending the session gives the address up: your phone unsubscribes, and the phone that had it throws it away.

On an iPhone this works only if you have added hopli to your Home Screen. In a Safari tab there is no such thing as being woken, and no way for us to make one.

There is deliberately no relay. A relay would make almost any connection succeed and would carry your files through a machine of ours, which is the thing this whole design exists to avoid.

What this website sees

To open hopli, your browser downloads these pages from a static host (Cloudflare Pages). Like any website, that request involves your IP address and reaches their servers. We add no analytics on top of it and receive nothing from it.

The pairing details — an address, a certificate fingerprint, a session token, a pairing key — travel in the part of the URL after the #, which browsers never send to a server. Neither the host nor the mailbox can learn who paired with whom, even in principle.

The same property is why a shared invitation always shows the same preview card in a chat app: the preview is fetched without the fragment, so it cannot say anything about your invitation. Whoever the link passes through on the way learns that somebody sent a hopli link, and nothing more.

Permissions the app may ask for

Microphone, only when you press record, and only for as long as you are recording. The recording is a file like any other: it goes to the other device and nowhere else, and hopli keeps no copy.

Notifications, only if you press the button offering them. When a message arrives while you are looking at something else, your device shows the sender's name and what they said — which means your operating system handles that text, the same as for any other app. Saying yes also lets you be reached with your screen off, which brings in a push service; what that costs is set out above. If neither is what you want, decline, and nothing else changes.

Camera, only on a video call, and only once you press the camera button in it. A video call starts with your camera off: the call connects as sound, and nothing is opened until you decide to be seen. What it sends goes straight to the other device, like everything else here.

hopli asks for nothing else. Location and payment are refused to this site by its own security policy, which you can read in the response headers.

What stays on your devices

A random device id in browser storage (hopli.device), so a desktop you have already approved does not ask again every time.

Whether you have already been asked about notifications (hopli-alerts-asked), so you are not asked twice.

For the length of one browser session only: the key for the connection you are in (hopli.session), so closing a tab by accident does not end the conversation, and a diagnostic record of what the app did (hopli.trail), which is what you would send if you were reporting a fault. Both are cleared when the browser session ends, and the session key expires after twelve hours regardless.

The desktop program keeps its own certificate and a list of devices you have approved, in its configuration folder on that machine.

Clearing your browser data removes the first set. Deleting hopli's configuration folder removes the last. Neither has ever been anywhere else.

What a conversation leaves behind

Nothing, unless you saved it. Messages are shown rather than stored: there is no history, and reopening hopli gives you an empty screen. A file exists where you chose to put it and nowhere else. A voice message is not saved at all — it plays and it is gone.

Which also means hopli cannot show you what you were sent yesterday, and never will. That is the same property described from the other side.

Children and everyone else

hopli has no accounts and collects no personal data from anyone, of any age.

Questions

The code is the real answer to most privacy questions, and it is readable. If anything on this page does not match what the code does, that is a bug worth reporting.