Privacy Policy
Last updated: 27 October 2026
This policy explains what personal data Dipper collects and what we do with it. Dipper is run by an individual based in Singapore, who is the controller of this data. We follow Singapore's Personal Data Protection Act and, for users in the EU and UK, the GDPR.
What we collect
| Data | Why |
|---|---|
| From GitHub when you sign in: user ID, username, name, verified email, the date your GitHub account was created | To create and sign in to your account, and to decide which free credit you get |
| API keys | We store only a one-way hash and the first few characters, never the full key |
| Usage: for each call, the tool, whether it was cached, the price, the key used and the time; daily totals | Billing, your dashboard, fraud prevention |
| Balance, top-ups and credits | Billing and accounting |
| Payment details (once card payments are on) | Handled by Stripe. We receive the amount, status and country, never your full card number |
| IP address | Rate limiting and abuse prevention. The free endpoint keeps a salted, one-way hash for about two hours |
| Technical logs (request path, status, timing, errors) | Running and debugging the service; kept by Cloudflare for a short period |
Your queries and URLs
To answer a call that isn't cached, we send the query or URL to an upstream search or fetch provider. The result is stored in a shared cache under a one-way hash of the normalized query or URL. The cache isn't linked to your account, and other users who send the same query or URL get the same result. We don't keep the text of your queries with your account. Don't put personal or confidential information in queries or URLs.
Cookies
We use only the cookies the site needs: a session cookie that keeps you signed in (30 days), a cookie that tells the homepage you're signed in, and a short-lived cookie that protects the GitHub sign-in. No advertising or tracking cookies, and no third-party analytics.
Who processes your data
- Cloudflare: hosting, storage and logs.
- GitHub: sign-in.
- Stripe: payments, once card payments are on.
- Upstream search and fetch providers: they receive queries and URLs only, never your account details.
These services may process data outside Singapore, including in the United States and, for uncached queries, in mainland China. We don't sell personal data.
How long we keep it
Account data is kept while your account is open. When you close it, we delete your personal data within 30 days, except billing records, which we keep for as long as tax and accounting law requires (generally 5 years in Singapore).
Your rights
You can ask to see, correct or delete your personal data, or to get a copy of it. Email us from your account's address and we'll reply within 30 days. If you're in the EU or UK, you can also complain to your local data protection authority.
Security
Traffic is encrypted with TLS. API keys and session tokens are stored only as hashes. Admin access is limited to the operator.
Changes
We'll post changes here and update the date above. For changes that matter, we'll email you first.