This policy explains what City of Hats can see, what remains encrypted, when a feature sends data to another provider, and how to exercise your privacy rights.
Ordinary Hat-to-Hat content is designed to be client-side encrypted. Features that must interpret content—such as CHECK, Agent, translation, venue workflows or external integrations—have different boundaries that we identify below.
You can use a pseudonymous Hat without giving contacts a carrier number. Account and social-sign-in options may still involve a username, email address, provider identifier or device data.
We do not sell personal information or use message content for targeted advertising. The public website currently uses Google Analytics to understand visits and performance.
Depending on where you live, you may ask to access, correct, delete, restrict, object to or export personal information, and may withdraw consent where consent is the basis.
City of Hats Inc. is an Ontario, Canada corporation. It is responsible for personal information it controls through cityofhats.com, the City of Hats web, iOS, Android and Windows experiences, APIs, secure communication features, CHECK Intelligence, paid plans, support channels, venue products and integrations (together, the Services).
For most direct-to-user Services, City of Hats determines why and how personal information is processed. When an organization uses a venue, clinic, school, hospitality, law-firm, intake or unified-inbox product to handle information about its own users, patients, students, guests, clients or contacts, that organization may be the controller or accountable organization and City of Hats may process the information for it. Contact that organization first for requests about records it controls.
Back to top ↑The categories depend on how you use the Services. You do not need to use every feature or provide every category.
We receive information directly from you; automatically from your browser, app, device and use of the Services; from the organization that gives you access; from Apple, Google, app stores and payment providers; from communication or venue integrations you enable; and from security-intelligence sources when you submit a CHECK query.
CHECK can query third-party cyber-intelligence and breach-data services using an email, username, domain, address, name, password or other indicator you submit. Do not submit someone else's personal information unless you have a lawful reason and appropriate authority.
Back to top ↑We use personal information only for identified, reasonable purposes connected to the Services, including the purposes below.
Depending on the law and context, we rely on performance of a contract, your consent, compliance with legal obligations, and legitimate interests such as securing, operating and improving the Services, preventing abuse and supporting users. We assess legitimate interests against the impact on individuals.
Where consent is required, you may withdraw it, subject to legal or contractual limits and reasonable notice. Withdrawing a required permission may prevent the associated feature from working. An organization using City of Hats for its own workflows is responsible for establishing an appropriate legal basis for the personal information it asks us to process.
Back to top ↑Ordinary Hat-to-Hat messages and files are designed to be encrypted on the user's device so our servers store and route ciphertext rather than readable content. Cryptographic claims, current audit status and known limitations are described in our Security Evidence Center and Technical Transparency page; those pages form the most current technical explanation.
End-to-end encryption does not hide everything. We may still process Hat and channel identifiers, public keys, delivery and expiration state, timestamps, notification tokens, call signaling, IP or security logs and other operational metadata. A recipient can copy, photograph, record or otherwise preserve content after receiving it, even when a feature limits viewing or retention.
A feature cannot remain opaque to City of Hats if it asks our server or another provider to interpret, search, translate, moderate, automate or deliver the content outside the encrypted Hat-to-Hat path. This includes CHECK queries, Agent interactions, optional translation, some system and venue messages, public pages, contact forms and third-party inbox integrations. The interface and this policy describe those exceptions; do not use them for content you do not want processed within that feature's stated boundary.
Back to top ↑If you request message translation, the text and target language are sent transiently through our server to OpenAI for translation. Our application is designed not to store the submitted translation text in its translation endpoint, but OpenAI's processing is governed by our provider arrangement and its applicable terms. You can choose not to use translation.
CHECK sends the indicator needed for your requested search to relevant intelligence providers, such as breach-data services, and returns an automated report. Results may be incomplete, outdated, false-positive or about a different person. CHECK and Agent outputs are informational and should not be the sole basis for a legal, employment, credit, insurance, housing, medical or similarly significant decision.
City of Hats does not currently use solely automated processing of your personal information to make a decision that produces legal or similarly significant effects about you.
Back to top ↑We do not sell personal information and do not share personal information for cross-context behavioural or targeted advertising. We disclose only what is reasonably needed for the purpose. Depending on the feature, recipients may include:
The public website uses essential browser storage for functions such as language or session state and currently uses Google Analytics through Google Site Kit to measure page visits, referrals, device and browser characteristics and site performance. Google may set or read analytics identifiers and process IP-derived information according to its services and our configuration.
We do not use message content for analytics or advertising. You can restrict cookies with browser controls or supported privacy tools, although disabling essential storage may affect language, sign-in or other functions. Where applicable law requires opt-in consent for non-essential analytics, we will seek it before activation.
Back to top ↑Retention depends on the data, feature, user settings, security need and legal obligation. We keep information no longer than reasonably necessary for the purposes described here, then delete, de-identify or isolate it, subject to backup cycles and legal holds.
City of Hats is based in Canada. We and our providers may process information in Canada, the United States and other countries where the Services, integration or provider operates. Those countries may have different privacy laws and may permit lawful access by courts, governments or law-enforcement agencies.
Where required, we use recognized safeguards for restricted transfers, such as adequacy decisions, contractual protections or another lawful mechanism. You may contact us for information about safeguards relevant to your information.
Back to top ↑Rights vary by location and are subject to exceptions. You may have the right to know whether we process your information; access it; learn its sources, uses and recipients; correct it; request deletion; restrict or object to processing; receive portable information; withdraw consent; and complain without retaliation. You may also have rights concerning sensitive information, automated decisions and direct marketing.
Use the in-app deletion controls where available or contact privacy@cityofhats.com. Describe the account, Hat or interaction involved without sending passwords, recovery keys or message plaintext. We may ask for information needed to verify identity and authority. We generally respond within 30 days, or within the period required by applicable law, and will explain any extension or refusal.
You may complain to the Office of the Privacy Commissioner of Canada or the privacy authority where you live. If an organization controls the record, we may direct your request to that organization. Authorized agents must provide proof of authority.
Back to top ↑Canada: City of Hats applies the accountability, identified-purpose, consent, limiting-collection, limiting-use, accuracy, safeguard, openness, access and challenge principles that apply under Canadian private-sector privacy law. Provincial law may also apply.
European Economic Area, United Kingdom and Switzerland: where their privacy laws apply, the legal bases and rights above apply, including the right to lodge a complaint with a supervisory authority. City of Hats is a Canadian company; contact us to identify the appropriate representative or transfer safeguard for your situation.
California and other U.S. states: subject to statutory thresholds and exemptions, residents may have rights to know, access, correct and delete information and to opt out of sale, sharing or targeted advertising. City of Hats does not sell personal information or use it for cross-context behavioural advertising, so we do not offer a sale/share opt-out link. We do not discriminate for exercising applicable rights.
Back to top ↑The general-audience Services are not directed to children under 18, and you must be at least 18 to create an account or buy a plan unless a separate written customer agreement and age-appropriate experience says otherwise. We do not knowingly collect personal information directly from a child through the general-audience Services.
A school, clinic or other organization using a managed venue is responsible for lawful authority, notices, consent and age-appropriate safeguards for records it asks City of Hats to process. If you believe a child has provided information without proper authorization, contact us.
Back to top ↑We use administrative, technical and physical safeguards selected for the sensitivity and risk of the information, including access controls, encryption where appropriate, authentication, monitoring, backups, incident response and software maintenance. Our Security Evidence Center distinguishes implemented, externally evidenced and planned controls.
No system, device, provider or transmission is completely secure. Security features reduce particular risks; they do not guarantee anonymity, confidentiality, delivery, deletion, device integrity or protection from a recipient. If a breach creates a reporting or notification duty, we will act in accordance with applicable law.
Back to top ↑You can choose a pseudonymous Hat, decline optional permissions, avoid social sign-in, disable notifications, choose channel lifecycles, block or allow Hats, stop using translation or CHECK, and delete content or your account where controls are available.
Protect your passphrase, recovery key, devices and Hat identifiers. City of Hats cannot protect content after it is displayed on a compromised device or captured by a recipient. Do not include unnecessary sensitive information in support, public profiles, event forms, CHECK queries or third-party integrations.
Back to top ↑We may update this policy as the Services, providers or law change. We will post the new version and effective date. For a material change, we will provide additional notice reasonably suited to the change, such as an in-app, website or account notice, and seek consent where required. Earlier versions may be requested from us.
Back to top ↑The Privacy Officer at City of Hats Inc. is accountable for this policy. Email privacy@cityofhats.com or use our guided contact form and choose Security & privacy. You may also write to City of Hats Inc., Ottawa, Ontario, Canada. Please do not send passwords, recovery keys or confidential message content.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or the competent authority where you live.
Back to top ↑Use our guided contact form for legal, privacy, security or account questions. We may need to verify your identity before completing a rights request.
