We only collect the minimum information needed to run your account:

• Email & password (email signup). When you sign up with email, we store your email address and a one-way bcrypt hash of your password. We never see, log, or store your plain-text password.
• Google profile (Google sign-in). When you sign in with Google, we receive only your email address, display name, and profile picture URL from Google. We never see your Google password.
• App data you create. Anything you save inside DiviDrip — your watchlist, positions, transactions, monthly income goal, account preferences, and any optional public-share slug you create.
• Standard server logs. Basic request data (IP address, timestamp, requested URL) kept short-term for security, brute-force protection, and debugging.

We use your information for one purpose: making the app work for you.

• Authenticating your account and keeping you signed in.
• Saving your watchlist, portfolio positions, transactions, and goals so they reload when you return.
• Generating your private dashboard, calendar, summaries, and downloadable spreadsheet.
• Detecting and blocking abuse (failed-login spam, brute-force attempts).

We do not use your information to email you marketing messages, send promotional notifications, or contact you for any reason other than direct support replies if you email us first.

We never sell, rent, lease, license, or otherwise share your personal information with advertisers, data brokers, marketers, or any other third parties. Your data is yours.

The only third parties that ever touch your data are the service providers we strictly need to run the website (see Section 5 below), and we only share the bare minimum needed for them to do their job.

We use only the cookies needed to keep you signed in. No advertising cookies, no analytics cookies, no tracking pixels.

• Session / auth cookies — issued when you log in. They tell our server it's still you on each request. Cleared automatically when you log out.
• Local browser storage — we save lightweight preferences (selected theme, last viewed view) in your browser's localStorage. This never leaves your device.

DiviDrip is hosted on infrastructure provided by Emergent (emergentagent.com). Emergent acts as our hosting and authentication provider:

• The MongoDB database storing your account and portfolio is hosted on Emergent's infrastructure.
• The Google sign-in flow is bridged through Emergent's OAuth service before reaching us.

Emergent processes data on our behalf as a technical sub-processor and does not use your data for its own commercial purposes. If you sign in with Google, Google also processes the authentication request under Google's own privacy policy.

Public stock data shown in the app comes from Massive, Yahoo Finance, Finnhub, and Finimpulse. Those providers see only the ticker symbols we look up — never your account, name, or email.

You can permanently delete your account at any time. When you do, we hard-delete everything we have associated with you:

• Login credentials (email, password hash, or Google profile data)
• Display name and profile picture
• Watchlist entries
• Portfolio positions and full transaction history
• Monthly income goal and any saved preferences
• Any public-share slug you created (the share link stops working)
• Active session tokens (you'll be signed out everywhere)

To delete your account, email us at dividrip@twylightcrow.com from the email address on file. You may also request a copy of the data we hold on you, or ask us to correct anything inaccurate, at the same address.

While your account is active, we keep your account and app data so the Service works for you. If you delete your account, all of it is removed immediately as described in Section 6 above. Server access logs are kept short-term for security and debugging, then rotated out.

DiviDrip is intended for adults 18 years of age or older. Most U.S. brokerages require investors to be 18+ to open self-directed accounts, and our content assumes the reader can legally invest. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us at dividrip@twylightcrow.com and we'll delete it.

Passwords are stored only as one-way bcrypt hashes — even we cannot read them. Sessions are issued as HTTP-only, secure cookies (so they can't be read by JavaScript or sent over plain HTTP). All traffic to and from the site is served over HTTPS. We follow standard practices to keep your data safe, but no system on the internet is 100% secure, so we encourage you to use a unique password and log out from shared devices.

DiviDrip is operated from Michigan, USA. If you access the Service from outside the United States, you understand and agree that your information will be processed in the U.S., which may have data-protection laws different from those of your home country.

If we materially change this policy we'll update the "Last updated" date at the top of this page. For substantive changes that affect how we use your data, we'll post a notice in the app the next time you log in.

Questions, deletion requests, or anything else privacy-related:

dividrip@twylightcrow.com

Twylight Crow · Michigan, USA