Privacy policy

Last updated: 22 October 2026

This policy applies to the open-hpa.com website and to the Open-HPA project apps, in particular HPA Commander for iOS, iPadOS, watchOS and Android (the “app”). In short: no accounts, we don't sell data and your device is controlled locally.

1. Data controller

Data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Owner: Anton Sychev (Sychev-Lab)
Address: Barcelona, Spain
Contact email: anton@sychev.xyz
Websites: https://open-hpa.com and https://lab.sychev.xyz

2. Data the app handles

The app requires no sign-up or account and collects no name, email, phone number, location or advertising identifiers. What it stores stays on your device:

Paired devices, their settings, JSON profiles, usage history and maintenance reminders.
WiFi or access passwords for your FCUs, in the iOS Keychain or Android's encrypted store (AndroidKeyStore).
Temporary Bluetooth and local network identifiers, only to connect to your devices.

3. App network traffic

With your devices: over Bluetooth LE or the WiFi network the device creates (REST and WebSocket). That traffic never leaves the local network.
Catalog and firmware: the app downloads the device catalog, its images and firmware binaries from our content server. As with any download, the hosting provider logs the IP address and time of the request in its technical logs; we don't combine them with any other data.
Community and error reports (optional): only if you turn them on in Settings. Then an anonymous install identifier, app version, device model, OS version and language are sent; diagnostic logs are only sent when you tap “Send”.

4. Analytics

Website: only if you accept it in the cookie notice, open-hpa.com loads Cloudflare Web Analytics (aggregated statistics, no cookies or profiling) and, when enabled, Google Analytics 4 with anonymized IP and no advertising purposes. If you reject it, no analytics script is loaded. You can change your choice at any time from “Cookie settings” in the footer. Details are in the Cookie policy.

App: we use the aggregated, anonymous statistics provided by App Store Connect and Google Play Console (installs, versions, crashes), which Apple and Google only share if you allowed it in your device settings. The app includes no advertising or tracking SDK. If in-app analytics are added in the future, they will be anonymous, described here before being enabled and declared in the store listings.

5. Purposes and legal basis

Providing the app and website features (performance of the service you request).
Security and abuse prevention (legitimate interest).
Web analytics, only with your consent, which you can withdraw at any time without affecting the lawfulness of prior processing (Art. 6(1)(a) GDPR).
Answering your questions when you write to us (consent and, where applicable, legitimate interest).
Complying with legal obligations.

6. Providers

Some providers may process data outside the European Economic Area with the safeguards set out in the GDPR: Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework and apply standard contractual clauses. We don't sell or share data with third parties for commercial purposes.

Cloudflare, Inc.: open-hpa.com hosting, CDN, security and web analytics (with consent).
Google Ireland Ltd. / Google LLC: Google Analytics 4, only if enabled and accepted.
Amazon Web Services: hosting of the catalog and firmware.
Apple and Google: app distribution and store statistics, under their own policies.

7. Retention

Data stored by the app stays on your device until you delete it or uninstall the app. Providers' technical logs are kept for the period set in their policies. Your cookie choice is stored in your browser for 12 months. Emails you send us are kept for the duration of the request and the applicable legal periods.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to anton@sychev.xyz. Since the app has no accounts, uninstalling it deletes its local data. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local authority.

9. Children

The app and website are not aimed at children under 14 and we don't knowingly collect their data. Use of airsoft replicas is subject to the minimum ages set by the law of each country.

10. Changes

We may update this policy. The last update date is shown above; if a change is significant, we'll announce it on the website or in the app.