Hopewall — Privacy Policy

Effective 4 November 2026 · Last updated 4 November 2026

Read the Terms of Use · Support

Hopewall is a vision board where every picture is a goal. It works with no account, it shows no ads, and your boards, goals and photos stay on your phone. This page lists what Hopewall holds about you, why, where it is stored, and how long it is kept.

Who we are

Hopewall is made by Luxxat Labs, IP, a sole proprietor registered in the Republic of Kazakhstan. We are the controller of the data on this page. You can write to us at hello@luxxatlabs.dev.

The short version

• There is no sign-up and no login. You do not give us a name, an e-mail address or a phone number.
• Your boards, goals, steps and photos are kept on your phone. We do not upload them. They are not part of the usage statistics, the crash reports or the suggestions board.
• When you search for pictures, your search words go to our own server, with no account, device id or other identifier. Then we ask Pixabay for pictures. See “Photo search”.
• Usage statistics are on from the first start. Hopewall shows one notice after you make your first board, and you can turn them off at any time in Settings. They are pseudonymous: they are tied to a random app id, not to your name, but we treat that id as personal data.
• Hopewall shows no ads, does not use the advertising id, does not ask to track you, and does not follow you across other apps or websites.
• We do not sell your data.

What stays on your phone

• Your boards, goals and photos. The boards, the pictures on them, each goal, its steps, due date and progress, the text and the crop you set on a picture, and your settings are saved in Hopewall’s own storage on your phone. Hopewall does not upload them.
• Pictures from your photo library. You choose pictures in the system photo picker. Hopewall reads only the pictures you pick, and keeps a copy, made smaller, inside the app. It does not read the rest of your library.
• Saving to Photos. When you save an image of a board to your Photos, the system may ask for permission to add pictures. Hopewall only adds the picture; it does not read your library.
• The home-screen widget. Hopewall gives the widget a small copy of your board’s pictures and your goal progress, in storage that only the app and its widget share on the same phone. The copy does not leave the phone.
• Reminders. The daily nudge and the step reminders are notifications that Hopewall schedules on your phone. We have no push server and we send no push messages. Hopewall asks for notification permission only after you make your first board and add a step, and you can turn the reminders off in Settings.
• Exports and share cards. An export, a wallpaper, a poster or a backup file is made on your phone. Nothing leaves your phone until you choose where it goes.

What we hold

Scroll the table sideways on a phone.

Photo search

Photo search lets you find pictures for your board without leaving the app. This is what happens, step by step.

• Your phone to our server. Hopewall sends your search words, a page number and the app language (for example “en”) to hopewall.luxxatlabs.com. This is our own server. It is a small program that runs on Cloudflare. The request carries no account, no device id, no cookie and no other identifier. Cloudflare processes the request as our host, so Cloudflare sees the network address of your phone to deliver the answer and for its own short security logs, under its data processing terms. We have switched off the logs of this server and we do not write down the search words.
• Our server to Pixabay. Our server asks Pixabay (pixabay.com) for matching pictures, with the studio’s key. Pixabay receives the search words from our server. It does not receive your phone, your network address or any id from this step. We ask for pictures that are safe for all ages, and we do not search for words on a blocked list. To spare Pixabay repeat calls, our server keeps the answer for a search in Cloudflare’s cache for up to 24 hours. The entry is not linked to you.
• Pixabay to your phone. The result pictures load on your phone straight from Pixabay’s servers. Pixabay therefore sees the network address of your phone and the usual details of a web request, like any website you open.
• The picture you pick. When you pick a picture, Hopewall downloads it from Pixabay and keeps it only on your phone. The photographer’s name and a link to the photographer’s Pixabay page are saved with it. Nothing about the picture you picked is sent to us.
• The licence. The pictures come from Pixabay under the Pixabay Content License. The app shows the photographer’s credit and a link. If you tap a link, it opens in your browser, and that site’s own privacy policy applies.

Your search words are never part of the usage statistics. The statistics only note that a search happened, whether you tapped a suggestion chip or typed, and whether it found none, a few or many pictures.

Usage statistics

Usage statistics are on from the first start. Hopewall shows one notice after you make your first board. The “Usage stats” switch in Settings → Privacy turns them off, or on again, at any time. You can also tap “Turn off” on the notice. Our basis is legitimate interest in knowing how Hopewall is used, and the switch is how you object.

What is sent, unless you turned the statistics off: events from a fixed list, such as that a screen was opened (by its screen name), that a board was made from a template, that a goal step was added, that a goal was marked done, that a picture was added from the picker or from search, that an image was saved or shared, that a backup was exported or imported (with the number of boards), that you tapped a button, which setting changed, and the steps of the paywall and of a purchase (the plan, the store’s product id, the price and the currency). Each event carries only a fixed word, a template name or a number from a short list. Events never carry your photos, the title of a board, goal or step, a caption, your search words, or any text you typed.

Google Analytics for Firebase also adds standard technical details, such as the app version, the phone model and system version, the language, the country, and a random app id that the Firebase SDK makes. We do not give the statistics your name, your e-mail or your account id. Because the events are tied to that random app id, they are pseudonymous, not anonymous. If you turn the switch off, Hopewall stops sending events and asks Google to clear the analytics data that the SDK keeps on your phone. Events already sent are kept for the retention period in the table above.

Hopewall does not use the advertising id on Android or on iPhone, and it does not show the iOS “ask app not to track” prompt, because it does not track you across other apps or websites.

Crash reports

Release builds of Hopewall send crash and error reports to Firebase Crashlytics. Debug builds do not. A report holds the stack trace (which code was running), the app version, the phone model and system version, and a random installation id that Crashlytics makes. Hopewall does not add your account id, a board, a goal or a photo to a report. There is no switch for crash reports: they do not follow the “Usage stats” switch. Google keeps them for 90 days.

Purchases

Apple or Google takes the payment. We never see your card. When you buy or restore Hopewall Plus, Hopewall signs in with a random account id (see the table), then sends the receipt from your store to our Cloud Function. The function checks it with Apple’s App Store Server API or Google’s Play Developer API. If the store confirms it, the function keeps the purchase record and plan status described in the table. The function also reads renewals, trials and refunds from the store when the app asks: at a purchase, at a restore, when the store sends the app a late purchase update, and at the first start after a subscription’s renewal date. A Lifetime refund is read at the next restore. This is how Plus turns on and off at the right time. The store keeps its own purchase records under its own rules.

Only our Cloud Function can write the plan status. The app can read only its own.

The suggestions board

Settings has a Suggestions board, where you can post an idea or a bug report, and vote. The board is public inside Hopewall: every person who uses the app can read your post. A post shows the name “Hopewall user”, the title, your details and the time. The post record also holds your random account id, which the app does not show to other people. Do not put your name, e-mail, phone number or other private information in a post.

Every post has Report and Hide, and you can block an author. A report says why (spam, offensive or other), and only we can read reports. Your hidden posts and blocked authors are saved against your account id, so they stay hidden for you. We read the reports and may hide or remove a post that breaks the rules in the Terms of Use. To ask us to remove a post, write to hello@luxxatlabs.dev.

Backups

• Your own device backup. Your phone may back up app data by itself. On iPhone, Hopewall’s data (the database and the pictures) is part of your device backup, if you use one, such as iCloud Backup or a backup to a computer. On Android, Google’s backup of app data covers Hopewall’s goals database and its settings, not the pictures. The pictures move to a new Android phone only in a phone-to-phone transfer. After a restore from the Android cloud backup, a picture that did not come back shows as a missing picture that you can replace, or you can import your backup file. These backups are made and kept by Apple or Google, under their terms. We do not receive them.
• The backup file. In Settings → Backup you can export a .zip file with your boards, goals, steps, pictures and photographer credits, and import it again on a new phone. Hopewall makes the file on your phone, and you choose where it goes (Files, a drive, e-mail). We do not receive it. Importing adds boards and never replaces yours. If you save the file in a cloud service, that service’s own terms apply to it.

What we never collect

Hopewall itself never collects your name, e-mail address, phone number, your precise (GPS) location, contacts, bank details, health data or browsing history. If you write to us, we get your e-mail address and your message (see the table). Hopewall has no advertising SDK and no attribution SDK. Nothing we hold is sold or shared for advertising.

Where your data is stored

Cloud Firestore uses the eur3 multi-region in Europe (Belgium and the Netherlands). Our Cloud Function runs in europe-west1 (Belgium). Firebase Authentication keeps the random account id; Google runs it from data centers in the United States. Photo search and these pages run on Cloudflare, which serves them from a data center near the caller. Pixabay serves its pictures from its own network.

Google, Apple, Cloudflare and Pixabay run networks in many countries. Data handled by their services, such as Analytics, Crashlytics, the stores, the Worker and the picture downloads, may be processed outside the EU and outside Kazakhstan. They do this under their own data transfer terms, such as standard contractual clauses. Our database holds only a random id, the purchase record and plan status, the purchase-check counter, and your suggestions posts, votes, reports and hidden or blocked lists: they hold no name, e-mail, phone number, ID number or bank detail. Our Cloud Function’s request logs and our mailbox (only if you write to us) are listed in the table above. If you live in Kazakhstan, this data is stored outside Kazakhstan: in the EU (Cloud Firestore) and in the United States (Firebase Authentication, the random id only). Google keeps the request logs and our mailbox in its own data centers, which may be outside the EU.

Who handles data for us

• Firebase Authentication — the random account id.
• Cloud Firestore — purchase records and plan status, the suggestions board and the abuse counter.
• Cloud Functions — the purchase check. Like any web service, it sees the network address of a caller to answer the call. Google Cloud keeps the platform’s request logs, with the network address, for up to 30 days.
• Firebase Crashlytics — crash reports.
• Google Analytics for Firebase — usage events, unless you turned them off.
• Apple and Google — the payment and the receipt check. The update prompt also asks the App Store or Google Play whether a newer version of Hopewall exists, and the review prompt is run by the store.
• Cloudflare — serves these pages, runs the photo-search server, and passes the e-mail you send us to our mailbox (Cloudflare Email Routing).
• Google Gmail — our mailbox, where the e-mail you send us arrives.
• Pixabay — the pictures in photo search (see “Photo search”).

Apart from the public suggestions board, the database rules let a signed-in app read only its own user record and its own list of hidden posts and blocked authors. The purchase receipts, the abuse counter and the reports cannot be read by any app.

Deleting your data

• On your phone. Delete a goal to remove its picture and steps. Delete Hopewall from your phone to remove everything it stored there. A copy may stay in a device backup or a backup file you made, until you delete that too.
• On our servers. Hopewall v1 has no “delete my data” button, because our database holds so little: a random id, a purchase record and your suggestions posts. Write to hello@luxxatlabs.dev. To find your records, tell us what you bought and when (and, if you have it, the order number from your store receipt), and the title of any post you made. We then delete the purchase record and plan status, your posts, your votes, your reports, your hidden and blocked lists, the purchase-check counter, and the random account id behind them. We answer within 30 days. We cannot find a record without one of these details, because the id is not shown in the app.
• What stays after that.
  • Crash reports, for up to 90 days, and usage events, for the retention period above.
  • Request logs that Google Cloud keeps for our Cloud Function, for up to 30 days by default.
  • Copies in Google’s own backup systems. For Firebase Authentication, Google says it removes deleted data from live and backup systems within 180 days. For Cloud Firestore, Google gives no fixed period.
  • The store’s own record of your purchases. Deleting your records with us does not cancel a subscription. Cancel it in the App Store or Google Play.
  • A post that other people have already seen and copied elsewhere.
• Usage statistics stop when you turn the switch off. The switch also asks Google to clear the analytics data that the SDK keeps on your phone.

Before you delete anything, use the free backup file in Settings → Backup. Your boards are never locked inside Hopewall.

Your rights

You can ask us for access to your data, to correct it, to erase it, to receive it in a portable form, and to object to how we use it. You can object to usage statistics at any time with the Settings switch. You can also complain to the data protection authority in your country.

To use a right, write to hello@luxxatlabs.dev. We answer within 30 days.

Children

Hopewall is for people aged 16 and over. It is not made for children. It has no kids mode, and we do not knowingly collect data from a child. If you think a child’s data is in Hopewall, write to hello@luxxatlabs.dev and we will delete it.

Changes to this policy

If what we collect changes, this page changes with it and the date at the top moves.

Contact

Luxxat Labs, IP — sole proprietor, Republic of Kazakhstan
Privacy and general questions: hello@luxxatlabs.dev