Privacy Policy
Last updated November 4, 2026
Divv (“Divv”, “we”) is divv.ca, a dividend data website, API and spreadsheet integrations operated by 13970671 Canada Inc., based in Saint-Lin-Laurentides, Quebec, Canada. This policy explains what personal information we collect, why, who we share it with, and the choices you have. It follows Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector.
What we collect
When you sign in
You sign in with Google. Google tells us your name, email address, profile picture and Google account ID. We turn the account ID into your Divv user ID. We never see your Google password.
Cookies
- divv_session keeps you signed in for up to 7 days. Signing out deletes it.
- divv_oauth_state protects the sign-in step against forgery and expires after 10 minutes.
We do not use advertising or cross-site tracking cookies.
Billing
Paid plans are billed by Stripe. Stripe collects your card details; we never see or store card numbers. We keep your Stripe customer and subscription IDs, your plan, its status and its billing dates.
API use
We store API keys only in hashed form, with a request count per key and a monthly total of API calls per account, to enforce plan quotas and rate limits.
Google Sheets integration (optional)
If you connect Google Sheets, we store the Google access tokens that let us install the Divv script in the spreadsheets you choose, encrypted (AES-256-GCM), along with your Google email address and the IDs and names of those spreadsheets. You can disconnect at any time, which revokes the tokens with Google and deletes them.
Divv’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that information only to provide the integration, and we do not sell it, use it for advertising, or let people read it except as needed for security or the law.
Brokerage connections (optional)
If you connect a brokerage account, the connection runs through SnapTrade, under SnapTrade’s own privacy policy. We receive the account and holdings data needed to show your dividends; we never receive your brokerage password.
Site analytics
We count visits without cookies. For each page view we record the page, the referring site, browser, operating system, device type and country (from Cloudflare). To count unique visits we use a hash of your IP address and browser that changes every day; we do not store your IP address. We may also use Cloudflare Web Analytics, which does not use cookies.
How we use it
- To run your account, sign you in and keep it secure.
- To provide the API, enforce plan limits and bill paid plans.
- To provide the integrations you turn on.
- To understand how the site is used and improve it.
- To answer you and to meet our legal obligations.
We do not sell or rent personal information.
Who we share it with
Only with the service providers that run Divv, each limited to what it needs:
- Cloudflare: hosting and database.
- Stripe: payments.
- Google: sign-in and the Sheets integration.
- SnapTrade: brokerage connections, if you use them.
We may also disclose information when the law requires it.
Where it is stored
Our database runs on Cloudflare in eastern North America. Our providers may process information in the United States or other countries, where it is protected by contract but subject to local law.
How long we keep it
Account information stays while your account is open and is deleted or anonymized after you close it. Billing records are kept as long as tax law requires (in Canada, generally six years). Usage counts and analytics are kept only as long as they are useful for the purposes above.
Your rights
You can ask to see the personal information we hold about you, have it corrected, have it deleted, or withdraw consent for optional processing. Email privacy@divv.ca and we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
Our person in charge of the protection of personal information can be reached at privacy@divv.ca.
Security
We use HTTPS everywhere, sign sessions, hash API keys and encrypt stored Google tokens. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the authorities as the law requires.
Children
Divv is not meant for anyone under 16, and we do not knowingly collect their information.
Changes
We will post changes here and update the date above. If a change is significant, we will tell signed-in users before it takes effect.
Contact
Questions about privacy: privacy@divv.ca. See also our Terms of Service.