Your data & privacy.

Mac & Windows apps

The apps have no advertising trackers or usage analytics. Ball settings, keyboard shortcuts, language and records stay on your computer and are not sent to us or synced between devices. License data is protected by macOS Keychain or encryption tied to your Windows user profile. Technical diagnostic files may be stored locally; the apps do not upload them automatically.

Bop does not record the screen, microphone or typed text. To hide the ball in games and full-screen apps, it checks the active app and window geometry locally, without sending this information to us. On Mac, bouncing off the Dock uses optional Accessibility permission to read the Dock’s position and geometry.

License checks & updates

For activation, license checks and deactivation, the app sends your key and activation ID over HTTPS to Lemon Squeezy or, for lava.top keys, the Bop server on Amvera. Activation sends a randomly generated instance name, not your computer’s name or your username. These requests are needed to maintain the two-computer license limit.

Update files and version information are hosted in our official GitHub Releases. Earlier Mac versions check for updates through bop.toys. Servers process connection information, including the IP address, to deliver files and protect the service. Your settings and records are not included in these requests.

Website

On bop.toys, PostHog measures page visits, purchase-button clicks, checkout openings and the first interaction with the ball demo, without cookies or browser storage. We do not record sessions or send form contents, email, license keys, settings or scores. Query parameters and fragments are removed from page and referrer URLs. Daily visitor estimates do not link a visitor across days. Do Not Track and Global Privacy Control disable browser analytics. Separately, our server sends confirmed purchases, refunds and first license activations, with the payment provider, currency and amount when applicable. These events use hashed order identifiers and are not linked to a website visitor profile.

The browser stores your best demo streak and manually chosen website language. Current scores and demo settings last only for the page session. Amvera hosts the site and the Bop license services. Servers process connection information. Regional pricing determines the country from the connection IP using a local database on Amvera, without sending the IP to a geolocation service, requesting device location or storing the country for later visits.

Purchases & key delivery

Lemon Squeezy and lava.top process payments; Bop does not receive full payment-card details. Lemon Squeezy handles its receipts and licenses. For lava.top orders, Bop stores the order reference, purchase email, amount, currency, encrypted key and activation records in Supabase, and sends the key using Resend. We use these records to deliver and maintain your license, recover keys and resolve purchase issues.

Key recovery uses the purchase email to send the existing license. Hashed email and IP counters protect recovery from abuse and are removed after 72 hours of inactivity. Delivery records include email, license references, language and sending status. Recovering a key does not subscribe you to marketing.

Emails & support

News emails are optional and sent through Resend only after explicit consent. We keep the email, consent time, language and consent version; buyer subscriptions also include the order ID. Buying or installing Bop does not subscribe you. Each marketing email has an unsubscribe link. License and support emails are separate. If you contact support, we use your email and the information you provide to answer your request.

Retention & your rights

Purchase and activation records are kept while needed to maintain your license and meet legal obligations. Support correspondence is kept while needed to resolve requests and related disputes. Subscription records are kept while subscribed; consent and unsubscribe records may be retained to honour your choice and document consent. We do not sell personal data or use purchase records for advertising.

Purchase and license processing is needed to fulfil your purchase. Marketing is based on consent. Security, support and limited website measurement serve our legitimate interests in maintaining and improving Bop, subject to applicable law. Providers may process data in other countries under their privacy policies.

Email ig.bogdan.dev@gmail.com to request access, correction, deletion or a copy of your data, or to object to or restrict processing where applicable. Some records may need to be retained for an active license or legal obligations. You can withdraw marketing consent at any time and complain to your local data-protection authority.

Service providers

These providers process data for hosting, payments, licensing, email delivery, downloads and website measurement. Their policies describe their own processing and retention.

Vercel · PostHog · Lemon Squeezy · lava.top · Supabase · Resend · GitHub

Last updated October 7, 2026