Privacy Policy

1. Who We Are and How This Policy Applies

HIKORA TECHNOLOGIES INC., based in British Columbia, Canada, operates Hikora — a technology platform, available worldwide through our website, web application, and mobile applications (collectively, the "Platform"), that connects people interested in hiking, kayaking, other outdoor activities, and community events. Hikora provides software tools; events are organized independently by users and tours are offered independently by third-party tour agencies.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. "Personal information" means information about an identifiable individual, as defined by applicable privacy law. This Policy applies to personal information processed through the Platform. It does not apply to the privacy practices of independent organizers, tour agencies, or third-party websites and services, which have their own policies.

Hikora is accountable for the personal information under its control. We have designated responsibility for privacy compliance within our organization; you may contact our Privacy Officer at hello@hikora.co with any question, request, or complaint about this Policy or our handling of your personal information.

2. Personal Information We Collect

We collect only the personal information reasonably needed to operate the Platform. Depending on how you use Hikora, this includes:

Account and profile information.

• Your email address, which is also your sign-in identifier;
• Your first name and last name, or permitted initials, where you provide them to complete your profile;
• An optional profile picture, if you upload one;
• Optional general location information you provide, such as city, province or state, and country;
• Outdoor interests you select, such as hiking and kayaking; and
• Authentication credentials. If you register with a password, it is stored only in hashed (one-way scrambled) form using bcrypt; we never store your password in readable form. If you use Google Sign-In, we receive your email address, given name, family name, and profile picture from Google, and link your Google identity to your Hikora account; we do not receive your Google password.

Activity and community information.

• Groups you belong to, create, or help manage, and events you create;
• Event registrations, invitations, and attendance information, including events you join or have attended;
• Tour-agency profiles and tour listings you create, including business contact and booking information you choose to publish;
• Carpool offers and requests you make or respond to;
• Content you submit, such as event and group descriptions, comments, ratings, and photographs; and
• Responses you give to organizer registration questions, and any organizer form or waiver acceptance recorded for an event.

Communications and safety information.

• Event-related messages you send and receive through the Platform (see Section 6);
• Blocking records (who you have blocked) and reports you submit about messages, content, or users, including the reported material; and
• Correspondence you send us, for example by email to hello@hikora.co.

Subscription and billing-related information.

• Your subscription plan and tier, billing interval, subscription status, trial and billing period dates, and cancellation status; and
• Limited transaction records provided through our payment processor, Stripe — such as Stripe customer and subscription identifiers and payment status. We do not collect or store your full credit card number or card security code; Stripe collects and stores payment card details directly.

Technical and security information.

• Information necessary for authentication, security, and operation of the Platform, such as session and sign-in records, device and browser information, Internet Protocol (IP) address, and logs of requests and security events; and
• Cookie and similar-technology information, as described in Section 10.

We do not require you to provide sensitive personal information such as government identification, health records, or precise real-time location in order to use the Platform, and you should not send such information through the Platform. If you voluntarily include sensitive information in content you publish or in messages, you do so at your own discretion and risk.

3. Why We Use Your Personal Information, and Our Lawful Grounds

We use personal information for the following purposes:

• Providing the Platform: creating and securing your account; authenticating you, including through Google Sign-In; displaying your profile as you have configured it; enabling groups, events, tours, carpools, and event messaging; and recording registrations, attendance, and organizer-form acceptances.
• Subscriptions and payments: administering trials, billing, renewals, plan changes, and cancellations through Stripe, and maintaining billing records.
• Safety and integrity: operating blocking and reporting tools, investigating reports, moderating content, enforcing our Terms & Conditions, preventing fraud and abuse — including anti-abuse verification at sign-up — and protecting users and the Platform.
• Communications: sending transactional and service communications, such as email verification, password resets, event and carpool notifications, subscription notices, and important changes to our services or policies.
• Support: responding to your questions and troubleshooting problems.
• Improvement: understanding how the Platform is used, maintaining and improving its performance, security, and features, including through the limited analytics described in Section 10.
• Legal compliance: complying with applicable laws, lawful requests, and our accounting, tax, and record-keeping obligations.

Depending on your jurisdiction, our lawful grounds for this processing include: performing our contract with you (the Terms & Conditions); your consent, where we rely on it (for example, optional profile information and optional communications), which you may withdraw as described in Section 13; our legitimate interests in operating a safe and functional platform, balanced against your rights; and compliance with our legal obligations. Where a law requires consent for a particular use, we rely on consent for that use.

We do not sell your personal information, and we do not use your personal information for third-party advertising profiling.

4. Profile Visibility and Sharing With Other Users

Hikora is a community platform, so some information is visible to others by design. Public portions of the Platform (including our public website) may display publicly listed groups, events, and tours together with the organizer or tour-agency name and images. Within the Platform, other users can generally see your display name or initials and, where you have provided one, your profile picture, in connection with groups you belong to, events you organize or join, and messages you send.

When you register for an event, the event organizer (and any co-organizers or moderators for that event) receives the information reasonably needed to run the event, which may include your name, attendance status, your answers to the organizer's registration questions, and whether you accepted any organizer-required form or waiver. Organizers are independent of Hikora and are responsible for their own handling of information they receive; we require them, through our Terms & Conditions, to use Platform information lawfully, but we cannot control their independent practices, and you should raise concerns about an organizer's handling of your information with that organizer and with us.

Content you publish — for example photographs, comments, group descriptions, and tour listings — is visible to the audience the Platform provides for that content, which for public listings can be anyone on the internet. Please consider carefully what you publish.

5. Service Providers and Other Disclosures

We share personal information only as reasonably necessary for the purposes in Section 3, with the following categories of recipients:

• Cloud hosting and data storage. We host the Platform and its database (PostgreSQL) using cloud infrastructure provided by Amazon Web Services (AWS), and we use cloud storage services for profile images and other media you upload. These providers process information on our behalf under contract.
• Payment processing. Stripe processes subscription payments and holds payment card information directly; we receive limited billing records as described in Sections 2 and 7.
• Authentication. If you use Google Sign-In, Google authenticates you and provides the information described in Section 2, in accordance with Google's own privacy policy.
• Email and operational services. Service providers that deliver transactional email and support authentication and anti-abuse verification, and help us operate and secure the Platform.
• Analytics. The analytics provider described in Section 10, on our public website.
• Organizers, tour agencies, and other users, as described in Section 4.
• Authorities and legal process. We may disclose personal information where required or permitted by law — for example, in response to a court order or lawful request, to protect the safety of any person, to investigate fraud or security incidents, or to establish, exercise, or defend legal claims.
• Corporate transactions. If Hikora undergoes a reorganization, merger, acquisition, or transfer of the Platform to a successor operator, personal information may be transferred to the successor as part of that transaction, subject to applicable privacy law, contractual safeguards, and, where required, notice to you. Until any such transfer is completed and communicated, your personal information remains under the control of the entity identified in this Policy.

We require service providers that process personal information on our behalf to use it only to provide their services to us and to protect it with appropriate safeguards, through contractual or other means.

6. Event Messages: Storage, Access, Blocking, and Reporting

Platform messaging is event-based: you may communicate only with other members participating in the same event, subject to the Platform's access rules. Message text is stored in our database in encrypted form (encrypted at rest), and our systems decrypt it as needed to deliver and display it to the intended recipients. Messages are not end-to-end encrypted: because Hikora's systems process message content to provide the service, authorized access to message content is technically possible under the controls described below.

Authorized Hikora administrators may access message records and related reporting records only where reasonably necessary for user support, investigating reports of harassment, threats, fraud, or other violations, protecting user safety and Platform integrity, enforcing our Terms & Conditions, or complying with the law. We do not routinely read private event messages, and we do not guarantee that any particular message will be reviewed.

You can block another user at any time; blocking prevents that user from sending you further messages through the Platform, while existing conversation history is retained. You can also report a message; reports, including the reported content, are stored so that our team can investigate and act, and may be retained after the underlying conversation is gone where needed for safety, enforcement, or legal reasons. Do not send sensitive personal information through Platform messages.

7. Payments and Stripe

Subscription payments on the web are processed by Stripe, Inc. and its affiliates. When you subscribe, your payment card details are collected by Stripe directly; Hikora does not store full card numbers or card security codes on its systems. We process and retain limited billing-related information: your subscription plan, tier, billing interval, subscription status, trial and current billing period dates, cancellation status, invoices and payment status, and Stripe customer and subscription identifiers. We use this information to provide paid features, administer renewals and cancellations (including keeping paid access available until the end of a paid period after cancellation), prevent fraud, and meet accounting and tax obligations. Stripe's handling of your information is governed by Stripe's privacy policy. Tour bookings are made directly with tour agencies through their own channels and are not processed by Hikora; we receive no tour booking payment information.

8. Cross-Border Storage and Processing

Hikora is a Canadian company offering a service that is accessible worldwide. Our cloud infrastructure and service providers may store or process personal information in Canada, the United States, or other countries where they operate. Personal information processed in another country is subject to that country's laws and may be accessible to that country's courts, law enforcement, and national security authorities. We use contractual and organizational measures intended to protect personal information wherever it is processed, and this Policy continues to apply to information we transfer for processing on our behalf.

9. How Long We Keep Personal Information, and Account Deletion

We retain personal information only for as long as reasonably necessary for the purposes in Section 3, unless a longer retention is required or permitted by law. In general: account and profile information is kept while your account is active; subscription and transaction records are kept as required for accounting, tax, dispute, and legal purposes, including records held by Stripe under its own policies; blocking and reporting records may be kept while reasonably needed for safety and enforcement; and server and security logs are kept for a limited period for security and operational purposes. Backup copies of data are retained for a limited period and then overwritten in the ordinary course of our backup processes, so deleted information may persist in backups until those processes run.

Deleting your account. You can initiate account deletion from your account settings on the Hikora website or in our mobile applications. Deletion is permanent. Under the current workflow, if your subscription is still set to renew you must cancel renewal first, and if you own community or tour-agency groups you must first remove those groups and their events, because group ownership cannot presently be transferred. When deletion is completed:

• Your account record is anonymized: your name, email address, profile photograph, location, and interests are erased from it, your stored avatar image is deleted on a best-effort basis, and the account can no longer be signed into;
• Your group memberships, upcoming event registrations, moderator and invitation relationships, and linked sign-in identities (such as Google) are removed;
• Historical records — such as past event attendance, comments, and ratings — are retained but attributed only to a "Deleted User", with no name or profile information attached;
• A minimal deletion record is retained for security and abuse prevention, consisting of a one-way hashed (HMAC) form of your email address, the date of deletion, and any deletion reason you chose to provide. We cannot recover your email address from this record; and
• Records that Stripe or other processors hold, backup copies, and information we must retain to meet legal obligations are retained in accordance with those obligations and then removed as described above.

If you cannot complete deletion through the Platform — for example, because of the organizer steps described above — or you wish to make any other request about your personal information, contact our Privacy Officer at hello@hikora.co and we will assist you as required by applicable law. Account deletion does not delete information you provided directly to independent organizers, tour agencies, or other third parties outside the Platform.

10. Cookies, Authentication Technologies, and Analytics

We use cookies and similar technologies that are necessary to operate the Platform — for example, to keep you signed in, maintain your session securely, remember preferences such as language, and protect against abuse. These are required for account features to function.

On our public website (www.hikora.co), we use Google Analytics to understand aggregate usage and improve the site. Google Analytics uses cookies and similar technologies to collect information about pages visited and interactions, which is processed by Google in accordance with its policies. We do not use advertising cookies or sell personal information. Where applicable law requires your consent for analytics cookies, we will rely on that consent. You can also control cookies through your browser settings and, for Google Analytics, through Google's available opt-out tools; blocking necessary cookies may prevent sign-in and other features from working.

11. How We Protect Personal Information

We apply technical and organizational safeguards appropriate to the sensitivity of the information, including: encrypting stored event-message content; storing passwords only in bcrypt-hashed form; encrypting data in transit using HTTPS; restricting access to personal information to authorized personnel who need it for the purposes in this Policy; and maintaining logging and account-security measures designed to detect and prevent unauthorized access. No system is completely secure, and we cannot guarantee absolute security. You also protect your information by keeping your password confidential and signing out of shared devices.

12. Privacy Incidents

We maintain processes to assess and respond to privacy and security incidents. Where a breach of our safeguards creates a real risk of significant harm to you, or where notification is otherwise required by applicable law, we will notify affected individuals and the relevant privacy regulator(s) as required, and we will keep records of breaches as the law requires. If you believe your account or information has been compromised, contact hello@hikora.co immediately.

13. Your Rights and Choices

Subject to applicable law and to certain legal exceptions, you have rights in relation to your personal information. Depending on where you live, these may include:

• Access: request confirmation of whether we hold your personal information and request a copy of it;
• Correction: update much of your profile directly in your account, and request correction of inaccurate or incomplete information;
• Deletion: delete your account as described in Section 9 and request deletion of personal information where the law provides;
• Withdrawal of consent: where we rely on your consent, withdraw it at any time (for example, by removing optional profile information or unsubscribing from optional emails). Withdrawal does not affect the lawfulness of prior processing and may limit features that need that information;
• Objection and restriction: object to, or request restriction of, certain processing where your law provides;
• Portability: request your information in a structured, commonly used format where your law provides; and
• Complaint: complain to us, and to your local privacy regulator (in Canada, the Office of the Privacy Commissioner of Canada or the applicable provincial commissioner, including in British Columbia).

To make a request, contact our Privacy Officer at hello@hikora.co. We may need to verify your identity before responding, we will respond within the time required by applicable law (generally 30 days for access requests under Canadian federal law, subject to lawful extensions), and there is generally no fee unless the law permits one for exceptional requests. If we decline a request, we will explain why, subject to legal restrictions.

Marketing communications. Transactional messages (verification, security, event, and billing notices) are necessary for the service. Where we send optional promotional communications, they will include an unsubscribe mechanism, and you may opt out at any time; opting out does not stop transactional messages.

14. Regional Privacy Information

Canada. We are a British Columbia company. Our handling of personal information is governed, as applicable, by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws, including British Columbia's Personal Information Protection Act. You have the rights described in Section 13, including access and correction, and the right to challenge our compliance with our Privacy Officer and, if unresolved, with the applicable privacy commissioner.

European Economic Area and United Kingdom. If you are in the EEA or the UK, HIKORA TECHNOLOGIES INC. is the controller of your personal information. Section 3 identifies our lawful bases (contract, consent, legitimate interests, and legal obligation). In addition to the rights in Section 13, you have the rights to data portability and to lodge a complaint with your local supervisory authority. Where we transfer personal information outside the EEA or UK, we do so using a lawful transfer mechanism, such as an adequacy decision or standard contractual clauses, as applicable.

Other regions. If privacy law in your country, state, or province grants you rights in addition to those described here (for example, rights to know, correct, delete, or opt out of certain uses), we will honour those rights where they apply to us. We do not claim to be subject to, or compliant with, every privacy law in every jurisdiction; the specific rights available to you are those provided by the law that applies to you and to us. Contact hello@hikora.co to exercise any right you believe you have, and we will assess and respond in accordance with applicable law.

Data minimization. Across all regions, we aim to collect the minimum personal information reasonably needed for the purposes in this Policy, and we do not collect a date of birth: our 18-and-over rule is confirmed by users at registration, as described in the Terms & Conditions.

15. Children's Privacy

Hikora accounts are for persons aged 18 and over. The Platform is not directed at children, and we do not knowingly collect personal information from persons under 18 through account registration. If we become aware that a person under 18 has created an account, we will suspend or terminate the account and remove the associated personal information as described in Section 9. If you believe a person under 18 has provided us personal information, contact hello@hikora.co.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will post the updated Policy on this page with a revised effective date and will provide additional notice through the Platform or by email where required by law. Where a change would use your personal information for a new purpose that requires consent under applicable law, we will obtain that consent. We encourage you to review this Policy periodically.

17. Contact — Privacy Officer

Questions, requests, and complaints about this Policy or our handling of personal information may be directed to our Privacy Officer:

Privacy Officer
HIKORA TECHNOLOGIES INC.
British Columbia, Canada
Email: hello@hikora.co
Website: https://www.hikora.co

If our response does not resolve your concern, you may contact the privacy regulator in your jurisdiction — in Canada, the Office of the Privacy Commissioner of Canada, or the Information and Privacy Commissioner for British Columbia where provincial law applies.