Privacy Policy
Last updated: October 11, 2026 (version 2026-10-11)
iHopOn is a free carpool-matching service for federal public servants and Crown corporation employees in Ottawa and Gatineau. It is run independently of any employer or government body.
This page explains what personal information we collect, why, who can see it, where it goes, how long we keep it, and what you can do about it. If anything here is unclear, write to privacy@ihopon.com and we will explain.
At a glance
- We ask for your postal code, never your street address. There is no GPS tracking.
- Until you and a match both accept, they see your postal-code area, like "K2J, Barrhaven", and a point rounded to about 1 km. After you both accept, they see the point on your postal code. If you start from a meeting point instead of home, they see only that lot: no postal-code area and no point near your home.
- Your work email only confirms where you work. We keep a scrambled fingerprint of it and the name of your employer's email domain, not the address.
- We don't sell your information, show targeted ads or process payments.
- Your data is stored in Beauharnois, Quebec. Five services outside Canada handle limited parts of it; we name each one below.
- We delete what we no longer need on a set schedule, listed below.
- You can download or delete your data at any time from You, then Privacy & data.
- Questions or requests: privacy@ihopon.com.
Who is responsible
iHopOn's founder runs the service and is its privacy officer, accountable for how your information is handled. Contact the privacy officer at privacy@ihopon.com.
iHopOn is not run by, or on behalf of, any employer or government body. Your employer is never told that you joined.
What we collect
What you give us:
- Account: the personal email address you sign up with (a work address can't be used), your first name and last initial, and your password, which we store only as a secure hash.
- Work email: used to confirm you work for an eligible employer. See "Work email verification" below.
- Commute: your postal code, the workplace or two you go to and on which days, your arrival and departure times, whether you drive, ride or rotate, seats, parking, and, if you turn it on, how far you'd drive to a meeting point, or the one or two meeting points you start from instead of home.
- Ride preferences: smoking, scent-free, winter tires, whether your car is gas, hybrid or electric (optional), and how chatty you like a ride.
- Gender: optional. Woman, man, non-binary, or prefer not to say. Used only to offer women-only matching. Never shown to other members; administrators can see it.
- Profile photo: optional, or pick one of our drawn cars instead. We re-encode a photo on upload, which removes hidden location and camera details.
- Messages you send, feedback you send us, safety reports, blocks, ratings and ride outcomes.
- Workplaces you add to the shared list. Their name and address become visible to every member, so please add office buildings only, never a home.
What is created as you use iHopOn:
Your matches (your top 25, recalculated nightly) and the date each pair first matched, so we don't announce a returning match as new.
Connection requests and their answers; pods and their details (days, meeting point, who usually drives, cost split), and your answer when Today asks once a month whether you're still carpooling; changes proposed, weekly drivers logged and snow-day plans written before October 19, 2026; your day board posts, any note you add, and who responded.
The notification list in your app, which can name other members and places.
Your verification attempts: the email domain you tried, the result and the time.
Your star average (see "Matching and ratings").
Your language (English or French), so we write to you in the right one.
How you found us: campaign tags or the referring website's name, from a first visit up to 30 days before you signed up.
When you agreed to our Terms and read this policy, which versions, and the language of the Terms you agreed to.
Screen-use records, if they are on for you (see "Screen-use records").
From every visitor, signed in or not: how many times each page is viewed (see "Screen-use records"). These totals carry no name, account, cookie or IP address.
What other members can see
Match card, and a match's page before you both accept
- What they see
- First name, last initial, photo (if added), destination building, postal-code area and a point rounded to about 1 km, shared days and hours, role, ride preferences, star average, and how many minutes the pickup adds.
After you both accept
- What they see
- All of the above, with the point on your postal code instead of the rounded one (or the meeting point, if you meet at a park-and-ride or carpool lot), and your messages to each other.
A day board ride you post
- What they see
- The above, with your point rounded to about 1 km. It is the same rounded point every time.
Your pod
- What they see
- The agreed days, meeting point, driver rotation and cost split.
Nobody, ever
- What they see
- Your street address, email addresses, phone number, gender, live location, or written rating comments about you.
It works the same way in both directions: you see this much about them.
If you meet a driver at a park-and-ride or carpool lot, your home is never shown to them, even after you accept; they see the lot.
If you start from a meeting point instead of home, matches and the day board are shown that lot in place of your postal-code area and point, before and after you accept. We keep your postal code to check you're in our area, and show it to no one.
If you choose women-only matching, you stop appearing in some members' lists. Someone could guess at your choice from that.
Your location
We ask for your postal code and turn it once into a point on a map. We use that point to work out your commute corridor, how far out of someone's way a pickup would be, and, if you turn them on, whether a nearby-ride alert applies to you.
A Canadian postal code is small, often one side of one block. That is why the point on it is shown only to a match you have both accepted. Before that, and on the day board, your point is rounded to about 1 km: the same rounded point every time, so reloading a page can't narrow it down.
Nearby-ride alerts compare saved points only. The alert says someone near you posted a ride; it never says where.
The map on your dashboard can show how many members are available in an area. An area is shown only when at least three people are there.
We never track your live location.
Work email verification
We use your work email to confirm you work for an eligible employer, and to make sure one work address opens only one account. We send a code to that address, then store only a keyed fingerprint of it: a scrambled value made with a secret key kept separately from our database. Nobody, including us, can turn it back into your address.
We also keep the name of your employer's email domain (the part after the @). That is how we decide eligibility and show your verified badge. Other members never see your employer.
The code email passes through our email provider, Resend, in the United States. Resend keeps a delivery log, including the address, for up to 30 days. We never write your work address to our own logs.
If your domain is refused, that decision was made automatically, by a computer. The screen says so and lets you ask a person to review it in one tap.
You sign up with a personal email and use your work email only to verify; a work address can't be used to sign up or to sign in. A personal address keeps reaching you after hours and stays yours if you change jobs. If your account still uses a work address, we ask you to change it under You, then Name and sign-in email.
Matching and ratings
How matching works. A computer scores each possible pairing every night. The biggest factor is how many extra minutes of driving a pickup adds, measured on real roads. Then come shared office days, how close your times are, and whether your roles fit. A pickup that adds more than 35 minutes is not suggested (up to 50 for very long commutes). If you want to know why you aren't seeing someone, ask us and a person will explain.
If you remove a match with Not for me, we remember that you did, so the two of you aren't matched again. The other person isn't told. It's deleted when either of you deletes your account, and it's in your data download.
Ride outcomes. Until October 19, 2026, pod members could record how a ride went (on time, late, cancelled or a no-show), and a reliability score was worked out from those records every night. Both have stopped: nothing is recorded any more, and the reliability scores were deleted. Outcomes recorded before then stay with your pod history; to see the ones about you, or to dispute one, write to privacy@ihopon.com.
Ratings. People you have ridden with — a week in the same pod, or a day board ride you both took — can give you a star rating and add a private comment. Only the average is shown. Comments are not shown to you in the app; if you make a formal access request, we review comments about you and release them, removing details that would identify the writer where the law allows.
Messages and safety reports
Messages are visible to the people in the conversation. There is no administrator screen for reading chats. We look at a conversation only when a report is filed about it, and we record every such look in our administrator log.
Reports are read by a person, who may warn, suspend or close an account. If an account is closed for safety, we keep its work-email fingerprint so the same address can't be used to rejoin (see "How long we keep it").
Screen-use records
If this is on, we record which screens you open in iHopOn, counted by the hour, and whether you opened it from the iHopOn icon on your phone. We use it only to find where the app is confusing, so we can fix it. We never record what you type. When it is on, we also note how many matches your list showed when you opened it, and for a match you open, its detour range and how many days you share, never who it was.
It is on by default for Ontario postal codes and off by default for Quebec ones, as Quebec law asks. You can turn it on or off at any time under You, then Privacy & data. Turning it off also deletes what was recorded.
We keep it for 90 days, then combine it into daily totals that identify no one.
Separately from that switch, we note when you were last on the site, which we need to time reminder emails, and when you last opened your matches, for the "new" badge.
Separately from that switch, if an email we send you bounces or is marked as spam, our email provider tells us and we note it against your account for 90 days, so we can stop mail that isn't reaching you. We keep your account, never the address.
When you leave a pod or delete your account, we may ask why. Answering is optional, and the answer is kept with no name or account: only the reason, the pod's size or how long the account existed.
Page-view totals are separate from all of this, and kept for every visitor, signed in or not: for each day and page, how many times it was viewed, in which language, and how many visits began there. They carry no name, account, cookie or IP address, and pages about a particular member, ride, pod or conversation are counted together, so no total can be traced to anyone. We use them to see which pages people use and how much of the site a visit covers. We also count, with no name, account or IP address, how many emails of each kind we send and how many visits arrive from them, clicks on sponsor placements, and how fast pages load, measured on 1 in 10 page views.
Service providers and where your data goes
Your account and everything in it are stored on servers at OVHcloud in Beauharnois, Quebec, and so are our encrypted backups. Five services outside Canada handle limited parts of your information:
OVHcloud
- Why
- Servers, database, backups
- What they receive
- Everything in your account
- Where
- Beauharnois, Quebec
Resend
- Why
- Sending email
- What they receive
- Your email address and the full message, which can name other members and workplaces. Delivery logs kept up to 30 days.
- Where
- United States
MapTiler
- Why
- Turning a postal code or workplace address into a map point
- What they receive
- Only the text you typed, never who typed it
- Where
- Outside Canada (a Swiss company)
ImprovMX and Google (Gmail)
- Why
- Receiving email you send to support@ or privacy@, or a reply to one of our emails
- What they receive
- What you write to us, and your address
- Where
- United States
Your browser's push service (for example Google, Apple, Mozilla or Microsoft)
- Why
- Delivering phone notifications, if you turn them on
- What they receive
- A device address and an encrypted message that names no one
- Where
- Mostly United States
Anthropic (Claude)
- Why
- AI help building and maintaining the site
- What they receive
- Database records with personal content removed: no names, emails, messages, comments, gender or home locations. Live data only for a specific support or safety case, which we log.
- Where
- United States
Each provider handles your information only to provide its service to us. Information held outside Canada may be accessible to authorities there under their laws.
The maps you see in iHopOn come from our own server, built from OpenStreetMap data. Viewing a map contacts no one else.
We do not use Google Analytics or any other outside analytics, advertising or tracking service.
How long we keep it
We delete what we no longer need every night, on the schedule below. Before deleting, we keep monthly totals that identify no one (for example, how many rides were posted in March), so our statistics stay accurate.
Account and commute profile
- How long
- Until you delete your account.
Work-email fingerprint and employer's domain
- How long
- Until you delete your account. After an account is closed for safety reasons, the fingerprint is kept 5 years, then a person decides whether to keep it longer.
Verification attempts
- How long
- 90 days once you are verified. While you are still waiting for your employer's domain to be approved, up to 12 months. Deleted when you delete your account.
Messages
- How long
- As long as the conversation exists. If you delete your account, 90 days, then deleted.
Day board posts and responses
- How long
- 90 days after the trip date.
Connection requests
- How long
- Declined, withdrawn or closed requests: 12 months. Accepted connections are kept as the record of who carpools with whom. If you delete your account, your pending and closed requests go after 90 days.
Match history
- How long
- Your current matches, until they change. The date a pair first matched: 12 months, once the pair is no longer matched.
In-app notifications
- How long
- 90 days.
Feedback you send us
- How long
- Your name is removed after 12 months. The words and our reply stay.
Screen-use records
- How long
- 90 days, then combined into daily totals that identify no one.
Analytics events linked to your account
- How long
- 90 days, then daily totals that identify no one. Views are deleted when you turn screen-use recording off; all of it when you delete your account.
Matches you removed (Not for me)
- How long
- Until either of you deletes your account.
Page-view totals
- How long
- Kept. They identify no one.
Ride outcomes and ratings you gave
- How long
- Kept after you leave, with your name and email removed, so other members' scores stay correct.
Safety reports and the administrator log
- How long
- Kept for safety and accountability. We have not yet set an end date; when we do, we will publish it here.
Backups
- How long
- Encrypted copies of the database, kept 14 days. Something you delete is gone from backups within 14 days.
Server logs
- How long
- Rotated automatically as they fill, usually within a few days, and used only to fix problems. They identify members by account number; when something fails, they can include details of what was being saved.
Deleting your account
Delete your account at any time from You, then Privacy & data. Right away, we delete your commute profile, gender answer, photo, notification settings and history, devices, work-email verification and attempts, matches, screen-use records, and the note on any ride you posted, and we remove your language and how you found us.
Your name and email are wiped from what remains. Some records stay in that de-identified form, for the reasons and periods listed in "How long we keep it": mainly ride outcomes and ratings, so other members' scores stay correct, and safety reports.
Security and breaches
We protect your information with strong password hashing, keyed fingerprints for work emails, encrypted connections, encrypted backups, rate limits on sign-in and sign-up, and a log of every administrator action. Administrators look at a member's information only to handle a report or a support request.
We don't keep IP addresses. They exist only briefly, for up to an hour, to slow down repeated sign-in attempts.
If a breach of our safeguards creates a real risk of significant harm to you, we will tell you as soon as we can, explain what happened and what you can do, and report it to the Office of the Privacy Commissioner of Canada. For Quebec residents, we will also notify the Commission d'accès à l'information when the law requires it. We keep a record of every incident, big or small, for at least 24 months.
Your rights
Under Canadian privacy law, and Quebec's if you live there, you can:
- See your information. Download it from You, then Privacy & data, or ask us at privacy@ihopon.com for anything the download doesn't include, such as written comments about you.
- Correct it. Most of it is editable in the app. For anything else, write to us.
- Change your mind. Turn off optional features (gender, photo, nearby alerts, push, screen-use records) at any time without closing your account.
- Delete your account, from You, then Privacy & data.
- Ask about an automated decision: what information was used, the main reasons, and have a person review it.
- Get your data in a portable format: the download is a structured file you can reuse.
We answer requests within 30 days.
Complaints
Write to the privacy officer at privacy@ihopon.com first. We acknowledge within 5 business days and answer within 30 days.
If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, if you live in Quebec, the Commission d'accès à l'information du Québec.
Children
iHopOn is for adults commuting to work. We don't knowingly collect information from anyone under 18. If you believe a child has an account, write to privacy@ihopon.com and we will remove it.
Changes to this policy
When we change this policy, we update the date and version at the top and tell you in the app. A new purpose, or a new service that receives your information, is announced before it starts.
- October 11, 2026: we note which matches you view (only the detour range and shared days, under the screen-use switch), emails to you that bounce or are marked as spam, and optional reasons when you leave a pod or delete your account; we count, with no name, email volume, sponsor clicks and page speed. New: Not for me, to remove a match for good.
- October 8, 2026: you can start from a meeting point instead of home, whether you drive or ride. Matches and the day board then see only that lot, never your postal-code area or a point near your home.
- October 4, 2026: rewritten after an independent privacy review. Before you and a match both accept, they see your point rounded to about 1 km; the point on your postal code only after. New: retention periods and nightly deletion, a full provider list (adding Gmail, push services and Anthropic), a screen-use switch, separate agreement to the Terms and this policy at sign-up, a privacy officer, Quebec rights and breach handling. Corrected: what we log, the cookies we use, and how backups are protected.
- September 30, 2026: gender is named among what we collect; deleting an account clears it and the profile photo.
- September 28, 2026: the home-screen app open is recorded.
Contact
Privacy officer: privacy@ihopon.com. General support: support@ihopon.com. We aim to reply within 5 business days.