Privacy Policy

What we collect

To match you with coworkers who share your commute, we collect:

• Account basics: your email address, first name, and last initial, and a securely hashed password.
• Work email verification: we confirm your work email belongs to an eligible organization. The address itself is cryptographically hashed before it's stored — we never keep or log your work email in plain text, even internally.
• Commute details: your postal code, the building or address you commute to, your schedule (days and times), and your role (driver, rider, or willing to rotate).
• Ride preferences: things like smoking, scent-free, winter tires, and how chatty you'd like your ride to be.
• Profile photo: optional. If you upload one, it's stored on our own server and shown to other members alongside your name.
• Messages: messages you send to people you've connected with through the app.
• Ratings and feedback: the star rating and optional written comment you leave about someone you've ridden with, and ride outcomes (on time, late, cancelled, no-show) used to calculate a reliability score.
• Safety information: reports you file or that are filed about you, and users you've blocked.
• Notification settings: your preferences for email and push notifications, and a device token if you enable push notifications.
• How you found us: if you arrive through a link with campaign tags, or from another website, we record that source once, on the visit you sign up. We keep the website's name, never the full address of the page you came from.
• Basic technical logs: standard web server information like IP address and browser type, kept briefly for security and troubleshooting.

How we use it

We use your information to verify you're eligible to use iHopOn, match you with people on a similar commute, let you message people you're connected with, run our safety and reliability features (reports, blocks, ratings, reliability scores), and send you service notifications you've asked for.

We don't use your information for advertising or marketing beyond service notifications you control, and we don't sell your personal information to anyone. iHopOn may show sponsor messages to help cover running costs, but they are chosen by commute corridor or shown to everyone — never selected using your profile, matches, or messages.

Your exact location stays private

This is the part we care most about getting right. We ask for your postal code — never your street address — and convert it once into a point on a map. That point stays on our server. It is used to work out which broad "commute corridor" you belong to, to measure how far out of someone's way a pickup would be, and, if you turn them on, to decide whether a nearby-ride alert applies to you.

Other users never see that point, your postal code, or your home address. They only ever see the broad corridor you're in — a neighbourhood-sized area like "Kanata" or "Orléans" — and, if relevant, the building you're heading to.

Nearby-ride alerts compare your saved point against the saved point of whoever posted the ride. Neither of you learns anything about the other's location: the alert only says that someone near you posted.

The map on your dashboard can show how many members are available in an area. Those numbers are grouped and never identify anyone: an area is only ever shown when at least three people are available there, and the map is not told which postal codes the groups came from.

We never track your live location. There is no GPS tracking anywhere in iHopOn.

If you sign up with a work email

You can use either a personal or a work email address to create your account, and using a work address saves you a step — we can verify your workplace from the same confirmation code.

It's worth knowing the trade-off, because it's your choice to make. The work email you enter for verification is hashed and never stored in readable form. The email you sign up with is different: we have to be able to write to it — to send you a confirmation code, a password reset, or a notice that a ride was cancelled — so it is stored in readable form, like the address in any account you hold anywhere.

If you'd rather we didn't hold your work address that way, sign up with a personal email and verify your work email separately. Both routes get you to the same place.

Who we share it with

Other users you're matched or connected with see only your first name, last initial, profile photo if you've added one, destination building, broad commute corridor, schedule overlap, role, reliability score, and average star rating. They never see your postal code, precise location, or email address.

Written rating comments are never shown to the person they're about. They are visible only to you and to administrators reviewing a safety concern.

We use a small number of service providers to run iHopOn — for hosting, email delivery, map data, and analytics. They only ever handle your information to provide that specific service, never for their own purposes. See "Where your information is stored" below for which of these are outside Canada.

We may disclose information if we're required to by law, or if we reasonably believe it's necessary to protect the safety of our users.

We do not sell your personal information, and we don't share it with advertisers.

Analytics, cookies, and browser storage

We use Google Analytics to understand overall traffic and usage patterns — how many people visit, which pages they look at, and roughly where visitors are located (city or region, based on IP address, never a precise location).

It is off until you say yes. We ask once, and not on your first visit: nothing analytics-related loads, and no analytics cookie is set, unless and until you choose "Allow". Declining is remembered and we don't ask again. iHopOn works exactly the same either way, and we never combine analytics data with your commute profile, matches, or messages.

Separately from analytics, iHopOn stores a few small items in your own browser to remember things about your visit: whether you answered the analytics question, whether you've seen the introductory tour, how many times you've visited, and — if you arrived through a campaign link — where you came from. These stay on your device. You can clear them at any time through your browser, without affecting your ability to use iHopOn.

Where your information is stored

Your account, your commute profile, your messages, and everything else in your iHopOn account are stored on servers located in Canada. Our backups are encrypted and also kept in Canada.

Three things do leave the country, and we'd rather name them than leave you to assume otherwise:

When you enter a postal code, we send it to MapTiler, a mapping provider, to turn it into a point on a map. Only the postal code is sent — never your name, email, or anything else about you. Map images shown in the app are also loaded from MapTiler, which means it sees your IP address, as any website you load an image from would.

Emails we send you — confirmation codes, password resets, ride notifications — are delivered through Resend, whose sending infrastructure is in the United States. Your email address and the content of that message pass through it.

Google Analytics, if and only if you've allowed it, processes usage data in the United States.

Information held in the United States may be accessible to authorities there under their own laws. If you would rather not have your email address handled outside Canada, iHopOn is unfortunately not able to offer that today, because sending you a confirmation code is required to create an account at all.

How long we keep it, and deleting your account

You can export a copy of your own data, or permanently delete your account, at any time from Profile → Privacy inside the app.

Deleting your account removes your commute profile, notification settings, registered devices, and work-email verification record outright.

A few things are kept in a de-identified form rather than deleted outright, and this is deliberate, not an oversight: if we erased your account entirely, it would corrupt the ride-reliability history and reports of other people you rode with. Instead, your name and email are wiped and your account is anonymized, while the historical record other users depend on stays intact. Ratings you left about other people are kept for the same reason — removing them would silently change someone else's average. Messages and safety reports are retained for a period to support any ongoing safety investigations.

Your rights

Under Canadian privacy law (PIPEDA), you have the right to access the personal information we hold about you, ask us to correct it, and withdraw your consent to our using it (by deleting your account).

If you believe we've mishandled your personal information, please contact us first at support@ihopon.com so we can try to resolve it directly. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

Security

We use industry-standard password hashing, cryptographic hashing for work email addresses, encrypted connections between your browser and our servers, encrypted backups, rate limiting on sensitive actions, and internal audit logging of administrator actions.

No system is perfectly secure. What we can tell you is what we deliberately never hold: we never ask for or store your street address, and we cannot read your work email address even internally, because only a hashed version of it is ever written down.

Children

iHopOn is intended for adults commuting to work in the National Capital Region. It is not directed at children, and we don't knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us at support@ihopon.com and we'll remove it.

Changes to this policy

If we make meaningful changes to this policy, we'll update the date at the top of this page and let you know in the app.

Contact us

Questions about this policy or your personal information? Email us at support@ihopon.com.