← Back to Hopwhere

Privacy Policy

Last updated: 13 June 2026

This policy explains what data Hopwhere processes and why. The short version: there are no accounts, we don't store your trips, we don't use tracking cookies, and we don't sell anything. Everything we process stays in the EU. The “Search flights” buttons are affiliate links to our travel partners — see below.

Who is responsible

The data controller is devpitot OÜ, established in Estonia. You can reach us at support@devpitot.com.

What we process

  • Your trip.The places, order, and dates you enter live only in your browser. When you use “Share”, the whole trip is encoded into the link itself — we don't store it on a server, and we have no way to look up your itinerary later.
  • IP address. Your IP is processed transiently by our rate limiter and recorded in standard server logs, to keep the service available and prevent abuse. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). It is not used to identify you and is never sold.
  • Anonymous usage stats. We use a privacy-friendly, cookieless analytics tool that counts page views and aggregate usage. It sets no cookies, builds no personal profile, and does not track you across other sites.

What we don't do

No user accounts. No stored itineraries. No display ads or ad networks. No tracking cookies. We never sell your personal data, and we don't share it with third parties for their own purposes. (The “Search flights” buttons are affiliate links — see the next section for what that involves.)

Affiliate links

The “Search flights” buttons are affiliate links to Kiwi.com via the Travelpayouts network. If you book after following one, we may earn a commission — at no extra cost to you, and it doesn't change the routes we suggest. The link carries only a non-personal partner ID so the booking can be credited to us; we don't send any of your personal data to these partners ourselves.

Once you click through, you're on the partner's own site: they may set cookies to attribute the referral and may operate outside the EU, under their own terms. See the Travelpayouts and Kiwi.com privacy policies for details.

Where your data is processed

Hosting is provided by Hetzner Online GmbH in Germany, and our analytics is self-hosted on the same infrastructure. All processing wecarry out therefore takes place within the EU/EEA, and we make no international transfers ourselves. (Following an affiliate link takes you to a third party that may be located elsewhere — see “Affiliate links” above.)

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to, and port your personal data. Because we don't hold accounts or itineraries, in practice this mostly concerns server logs. To exercise any right, email support@devpitot.com.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee.

Changes

We may update this policy as the service evolves. The date at the top reflects the latest version.