DipGrid Privacy Notice

Last updated: October 23, 2026 · Effective: October 23, 2026

DipGrid LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA · Websites: dipgrid.com, app.dipgrid.com · Privacy contact: support@dipgrid.com

This notice explains what personal information DipGrid collects, why, who else receives it, how long we keep it and what you can do about it.

1. What we collect

Your account: name, email address, US phone number, and the version and time of the Terms and Risk Disclosure you accepted. Your password is stored only as a one-way hash; we cannot read it. If you turn on Face ID or a passkey, we store only its public key.
Sign-in records: when you signed in, whether with a password, a code or Face ID, and which of your devices is recognized. Two cookies keep you signed in (section 4).
Your broker connection (when you connect a supported broker): a list of your broker accounts shown with the last 4 digits, and for the account you choose — cash, buying power, positions, open orders and fills; and, for the Portfolio page, what that account was worth at each market close. The access pass the broker gives us is stored encrypted. We use it only for the account you choose, to read it and to place and cancel orders there; it cannot withdraw or move money. We never see your broker password.
Your bots: settings, commands, orders, your broker's responses, results and the bot's journal.
Messages: what you send to support and the service emails we send you.
Early-access sign-up (dipgrid.com): your email address; whether and when you asked for build updates; and, if the link that brought you had one, a short label such as "yt" that says where the link was posted. We use the label only to count sign-ups per link; the count keeps no email address. Right after you join, we email you the date of your invite.
Questions to Dipper (the chat on dipgrid.com): the question you type, Dipper's answer, which of our pages it pointed to, the time, and a short fingerprint of the earlier messages in that chat. Before anything is stored or sent to our AI provider, email addresses and long numbers are replaced with placeholders. We do not store your IP address with your questions or link them to an account.
Ideas: ideas you suggest and your votes on our list of ideas. Other users see only how many votes an idea has, never who voted or who suggested it.
Payments (when paid plans start): Stripe processes your card; we never see or store your full card number. We receive what Stripe reports about your subscription and payments, such as plan, status, amounts, and card brand and last 4 digits.
Technical data: our servers use your IP address in memory to limit repeated sign-in attempts; we do not write it to our logs or database. To limit how many questions one visitor can ask Dipper, we keep a one-way, keyed fingerprint of your IP address for 7 days; without our secret key it cannot be turned back into the address. The network provider that carries traffic to our websites also processes IP addresses (section 3). We do not use analytics, advertising or tracking tools.

2. Why we use it

To run the Service you asked for: create and secure your account, run your bots, show your results, send service emails (the date of your invite after you join the early-access list, invitations, sign-in codes, getting-started tips in your first three weeks, notices about changes and commands for your bots, as you choose in Account → Notifications), bill paid plans, investigate errors, prevent abuse, keep records we may need to resolve a dispute, and meet legal obligations. We do not send marketing emails without your consent: build updates go only to people who ticked the box when signing up for early access, and stop when you press Unsubscribe at the bottom of any of them, use your email app's Unsubscribe button, or reply "unsubscribe". The early-access emails and the tips have the same Unsubscribe link: it stops those emails, and before your invite is sent it also removes your email from the list. We do not use your personal or trading data to train AI models, and we use AI services only with settings that do not allow the provider to train on your data.

3. Who else receives it

We share data only with providers that help us run the Service, and only for that purpose:

Who	What for
Hosting provider in the United States	hosts the Service and its database
Network and storage provider	delivers our websites, secures the connection to our server and stores encrypted backups and chat questions
Email provider	sends our service emails and receives your emails to us
Messaging service	internal alerts to our team about the Service; they include only our internal client and account numbers, the kind of event, the stock and a short reason — never your name, email, broker account numbers, balances or amounts
AI service provider	AI tools that help us operate the Service and answer questions in the Dipper chat; they may process account and trading data while doing so
Your connected broker	your account data and orders, under your connection
Stripe	payments, when paid plans start

A current list of our providers is available on request at support@dipgrid.com.

Your broker and Stripe also process data for their own legal and regulatory purposes under their own privacy policies. We may disclose information when the law requires it, to protect our legal rights, or as part of a sale or merger of the company, with the same protections. We do not sell your personal information, share it for cross-context advertising, or use targeted advertising.

4. Cookies

We set only two cookies, both essential:

a session cookie that keeps you signed in, for up to 30 days;
a device cookie that recognizes a device you have verified, for up to 400 days, so we do not ask for an email code every time.

We do not use analytics, advertising or tracking cookies and do not track you across websites. Because we do no tracking, we do not change anything in response to "Do Not Track" or Global Privacy Control signals; no further action from you is needed.

5. How long we keep it

We keep each kind of record only as long as its purpose needs:

Your profile — name, email address, phone number, password hash, passkeys, sign-in records and recognized devices: while your account is open; deleted from our live systems within 30 days after you close it.
Trading and consent records — bot settings, commands, orders, your broker's responses, results, and the version and time of each document you accepted: 5 years after you close your account, so that we can show what the Service did on your instructions and resolve claims. Five years is the time limit for claims on written contracts in Florida.
Emails we sent you and your support messages: 5 years after you close your account, for the same reason. They contain your email address and may contain your name or other details written in them; we keep them unchanged, except that one-time sign-in links and codes are removed, and use them only for that purpose.
Your ideas and votes: while your account is open; deleted from our live systems within 30 days after you close it. The email that passes an idea you suggest to our team is kept like a support message (above).
Your account value by day (what your broker account was worth at each market close, for the Portfolio page): while your account is open; deleted from our live systems within 30 days after you close it.
Billing records (when paid plans start): as long as tax and accounting rules require.
Your broker access pass: deleted from our live systems when you disconnect your broker or close your account.
Backups: encrypted copies of our database contain the data above as it was on the day of the copy. Each copy expires within 35 days and cannot be changed before then.
Early-access sign-up emails: up to 12 months, or until you register or ask us to delete them.
Dipper questions and answers: 30 days, then deleted automatically within a day. The IP fingerprint used to limit questions: 7 days, then deleted the same way.

We keep a record longer only while it is needed for a pending dispute or a legal requirement.

6. How we protect it

We protect your data with encrypted connections, encrypted backups, limited and strongly protected access for our team, and regular security updates. Passwords are stored only as one-way hashes; broker access passes are encrypted, with the key kept apart from the database. No system is perfectly secure; if a breach affects you, we will tell you as the law requires. Report concerns to security@dipgrid.com.

7. Your choices and rights

You can change your email and password in Account, choose which emails you get in Account → Notifications (emails about risky changes are on from the start, and turning one off sends you an email), disconnect your broker in Account → Brokers, and ask us to change your name or to access, correct, copy or delete your information by writing to support@dipgrid.com. When you ask us to delete your information, we delete it unless the law allows or requires us to keep it, and we tell you what we keep and why. Depending on your state, you may have further rights; we will not treat you differently for using them. We may ask you to confirm your identity, but never for your broker password or codes.

8. Age

The Service is for adults 18 and over. We do not knowingly collect information from children.

9. Changes

We will email you about material changes before they take effect and show the new "Last updated" and "Effective" dates at the top of this notice.