Privacy Policy

What we collect

To match you with coworkers who share your commute, we collect:

• Account basics: the email address you sign up with (we recommend a personal one), your first name and last initial, and a securely hashed password.
• Work email verification: we confirm your work email belongs to an eligible organization. That is the only thing we use it for. The address itself is cryptographically hashed before it's stored — we never keep or log your work email in plain text, even internally.
• Commute details: your postal code, the building or address you commute to, your schedule (days and times), and your role (driver, rider, or willing to rotate).
• Ride preferences: things like smoking, scent-free, winter tires, and how chatty you'd like your ride to be.
• Profile photo: optional. If you upload one, it's stored on our own server and shown to other members alongside your name.
• Messages: messages you send to people you've connected with through the app.
• Ratings and feedback: the star rating and optional written comment you leave about someone you've ridden with, and ride outcomes (on time, late, cancelled, no-show) used to calculate a reliability score.
• Safety information: reports you file or that are filed about you, and users you've blocked.
• Notification settings: your preferences for email and push notifications, and a device token if you enable push notifications.
• How you found us: if you arrive through a link with campaign tags, or from another website, we record that source once, on the visit you sign up. We keep the website's name, never the full address of the page you came from.
• Basic technical logs: standard web server information like IP address and browser type, kept briefly for security and troubleshooting.

How we use it

We use your information to verify you're eligible to use iHopOn, match you with people on a similar commute, let you message people you're connected with, run our safety and reliability features (reports, blocks, ratings, reliability scores), and send you service notifications you've asked for.

We don't use your information for advertising or marketing beyond service notifications you control, and we don't sell your personal information to anyone. iHopOn may show sponsor messages to help cover running costs, but they are chosen by commute corridor or shown to everyone — never selected using your profile, matches, or messages.

Where your location goes

This is the part we care most about getting right. We ask for your postal code — never your street address — and convert it once into a point on a map. That point is what works out which broad “commute corridor” you belong to, measures how far out of someone's way a pickup would be, and, if you turn them on, decides whether a nearby-ride alert applies to you.

What another member can see depends on where they meet you. On a match card and on the day board you appear as your postal-code area — the first three characters, shown like “K2J · Barrhaven” — which covers a whole neighbourhood. Open the page for a single match and the map goes further: it shows a point on the postal code you entered, so the two of you can judge whether you are genuinely on each other's way. A Canadian postal code is small, often one side of one block, so treat that as sharing your immediate area with the people you are matched with. It works the same way in both directions — you can see exactly this much about them. Nobody ever sees your street address, your phone number or your live location, and none of it is visible outside the app.

Nearby-ride alerts compare your saved point against the saved point of whoever posted the ride. Neither of you learns anything about the other's location: the alert only says that someone near you posted.

The map on your dashboard can show how many members are available in an area. Those numbers are grouped and never identify anyone: an area is only ever shown when at least three people are available there, and the map is not told which postal codes the groups came from.

We never track your live location. There is no GPS tracking anywhere in iHopOn.

Use a personal email to sign up

We recommend creating your account with a personal email address and using your work email only to verify where you work. Signing up with a work address is still allowed, and it saves one step because the same code can confirm your workplace, but for most people a personal address is the better choice.

The two addresses are handled differently. The work email you verify is hashed the moment you verify it and is never stored in readable form, so once you've verified, iHopOn has no way to write to it again. The email you sign up with is different: we have to be able to reach it — for a confirmation code, a password reset, or a notice that a ride was cancelled — so it is stored in readable form, like the address in any account you hold anywhere.

A personal address also keeps reaching you on evenings and weekends, and stays yours if you change jobs. If you already signed up with a work address, you can move your account to a personal one at any time under You → Name and sign-in email. Your verified work email badge isn't affected.

Who we share it with

Other users you're matched or connected with see only your first name, last initial, profile photo if you've added one, destination building, postal-code area, schedule overlap, role, reliability score, and average star rating — and, on the page for a single match, a point on your postal code, as described above. They never see your email address.

Written rating comments are never shown to the person they're about. They are visible only to you and to administrators reviewing a safety concern.

We use a small number of service providers to run iHopOn — for hosting, email delivery, and map data. They only ever handle your information to provide that specific service, never for their own purposes. See “Where your information is stored” below for which of these are outside Canada.

We may disclose information if we're required to by law, or if we reasonably believe it's necessary to protect the safety of our users.

We do not sell your personal information, and we don't share it with advertisers.

How we learn what to improve

We record which screens you open inside iHopOn — that you opened your matches, say, or a ride on the day board — and when you were last active. It is linked to your account, and we use it for exactly one thing: finding the places where the app is confusing or unhelpful, so we can fix them. We never record what you write, and we never combine it to build a profile of you for anybody else.

We keep that detail for 90 days. After that it is collapsed into daily totals — how many people opened a given screen on a given day — and what remains cannot identify anyone.

We do not use Google Analytics, or any other third-party analytics service. There is no advertising or tracking code anywhere on this site, and nothing about what you do here is sent to another company. We removed Google Analytics in September 2026 when we built our own: it tells us more, and it keeps your activity on our own servers in Canada. iHopOn does keep two small items in your own browser — whether you have seen the introductory tour, and, if you arrived through a campaign link, where you came from. Those stay on your device, and you can clear them at any time through your browser without affecting your ability to use iHopOn.

Where your information is stored

Your account, your commute profile, your messages, and everything else in your iHopOn account are stored on servers located in Canada. Our backups are encrypted and also kept in Canada.

Two things do leave the country, and we would rather name them than leave you to assume otherwise:

When you enter a postal code, we send it to MapTiler, a mapping provider, to turn it into a point on a map. Only the postal code is sent — never your name, email, or anything else about you. Map images shown in the app are also loaded from MapTiler, which means it sees your IP address, as any website you load an image from would.

Emails we send you — confirmation codes, password resets, ride notifications — are delivered through Resend, whose sending infrastructure is in the United States. Your email address and the content of that message pass through it.

Information held in the United States may be accessible to authorities there under their own laws. If you would rather not have your email address handled outside Canada, iHopOn is unfortunately not able to offer that today, because sending you a confirmation code is required to create an account at all.

How long we keep it, and deleting your account

You can export a copy of your own data, or permanently delete your account, at any time from Profile → Privacy inside the app.

Deleting your account removes your commute profile, notification settings, registered devices, and work-email verification record outright.

A few things are kept in a de-identified form rather than deleted outright, and this is deliberate, not an oversight: if we erased your account entirely, it would corrupt the ride-reliability history and reports of other people you rode with. Instead, your name and email are wiped and your account is anonymized, while the historical record other users depend on stays intact. Ratings you left about other people are kept for the same reason — removing them would silently change someone else's average. Messages and safety reports are retained for a period to support any ongoing safety investigations.

Your rights

Under Canadian privacy law (PIPEDA), you have the right to access the personal information we hold about you, ask us to correct it, and withdraw your consent to our using it (by deleting your account).

If you believe we've mishandled your personal information, please contact us first at support@ihopon.com so we can try to resolve it directly. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

Security

We use industry-standard password hashing, cryptographic hashing for work email addresses, encrypted connections between your browser and our servers, encrypted backups, rate limiting on sensitive actions, and internal audit logging of administrator actions.

No system is perfectly secure. What we can tell you is what we deliberately never hold: we never ask for or store your street address, and we cannot read your work email address even internally, because only a hashed version of it is ever written down.

Children

iHopOn is intended for adults commuting to work in the National Capital Region. It is not directed at children, and we don't knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us at support@ihopon.com and we'll remove it.

Changes to this policy

If we make meaningful changes to this policy, we'll update the date at the top of this page and let you know in the app.

Contact us

Questions about this policy or your personal information? Email us at support@ihopon.com.