Privacy policy

1. Controller

Ingo Schildt · DipCatcher by KAWUMS
Ernststr. 1a
56249 Herschbach, Germany
Email: info@kawums.de
Phone: +49 151 72177448

We have not appointed a data protection officer; the owner answers your requests himself.

2. Overview

This policy explains which personal data we process when you use dipcatcher.de or the DipCatcher app, why, on what legal basis, with which service providers and for how long. Personal data is any data that can identify you. Some of it you give us yourself (for example when you sign up); some our systems record automatically when you visit (for example your IP address and browser identification). We do not sell data, show no ads and use no tracking or advertising cookies.

3. Server and security

DipCatcher runs on its own virtual server at IONOS SE in Germany, behind the nginx web server. For every request nginx processes the IP address, date and time, the address requested, status code, amount of data, referrer and browser identification, and writes them to server log files. Log files are deleted after 30 days.

To protect against overload and attacks, nginx limits the number of requests per IP address, drops requests for typical attack paths (such as /.env or /wp-admin) at once and blocks some crawlers by their browser identification. From the IP address nginx looks up country and approximate city in the DB-IP databases (stored on our server, no request to DB-IP) and passes them to the application only for the live overview and the statistics (sections 4 and 5). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). All connections are TLS-encrypted.

4. Live overview “Online now”

While you have a DipCatcher page open, your browser sends a sign of life about once a minute with a random session ID kept in your browser’s local storage (dc-sid). From this we show every visitor how many people are online. DipCatcher administrators also see, per session: device type, operating system and browser (from the browser identification), country and approximate city (from your IP address via DB-IP; the IP address itself is not stored for this), the page currently open, for visitors who are not signed in the website they came from, and for signed-in members the email address. This information is held only in the server’s memory, never written to a database, never combined into profiles, and deleted at the latest 150 seconds after the last sign of life. The purpose is running the website and helping with problems; the legal basis is Art. 6(1)(f) GDPR.

5. Usage statistics without cookies

To improve DipCatcher we count which pages are viewed, which website visitors come from, from which country, and with which device type, operating system, browser and plan (guest, Free, Pro). So that a visitor counts only once a day, we compute a hash from IP address and browser identification with a key that changes daily; the hash lives only in memory and cannot be linked to anything the next day. We store daily totals and single page views without any identifier (time, page, referrer, country, device type, operating system, browser, plan); these are deleted after 13 months. We count clicks on two versions of an element on the start page (A/B comparison) the same way. We store neither IP addresses nor hashes nor any history per person. Administrators are not counted.

Also without any personal reference we count how often a stock page is viewed per day (“trending”) and store search terms for which the search found nothing – only the term, not who searched. The legal basis is our legitimate interest in shaping the service to what people need (Art. 6(1)(f) GDPR).

6. Cookies and local storage

We only set cookies and entries needed to run the service or to keep a setting you chose:

• Supabase sign-in cookies (sb-…): keep you signed in until you sign out.
• lang: your chosen language, 1 year.
• dc_consent: that you confirmed the notice on cookies and “not investment advice”, 1 year.
• dc_flash: a short message after an action, 2 minutes.
• dc_first_off: that you hid the welcome note, 1 year.
• dc_promo: a promo code from an invitation link until you sign up, 14 days.
• dc_app: that the page is running inside the DipCatcher app.
• Browser local storage: the live overview’s random session ID (dc-sid), the layout of your desk and whether the side bar or menu is collapsed; for the current session also whether you hid the install hint.

The legal basis for storing and reading this on your device is § 25(2) no. 2 TDDDG (strictly necessary for the service you asked for); for the processing that follows, Art. 6(1)(b) or (f) GDPR.

7. Account and member features

For an account we record your email address and a password, stored only as a hash. You may add your name, country, experience, focus, preferred markets and your brokers. Depending on which features you use, we also store: watchlist, price alerts, your trades with buy and sell details, notes and chart drawings, your decisions and reactions to ratings (“bought”, “passed”, “agree” …), your calendar, your own rules, the practice portfolio (no real money), notifications, settings for the morning briefing, weekly mail and push, which stocks you opened in detail on a given day, and stocks you asked us to add. You can subscribe to your calendar through a private address with a random key; anyone who knows that address can read the calendar.

From all members’ decisions and reactions we only show totals per stock, such as “5 members bought”; “most bought” appears only from two members up. We also show the number of members and the most common countries. Names and individual trades are never published.

The purpose is providing DipCatcher; the legal basis is the user agreement (Art. 6(1)(b) GDPR), and for the anonymous totals our legitimate interest (point (f)). You can delete your account at any time under “My profile”.

8. Emails

We send emails through the mail server of IONOS SE (Germany) from addresses at dipcatcher.de: confirmation and password emails for sign-up and sign-in, invitations, invoices and credit notes, replies to support requests, feedback on imports by email and – only if you switch them on – alert emails for your watchlist and price alerts, the morning briefing, notices about the stop and target of your trades, and the weekly mail. You can turn optional emails off in your settings or with the link in every email. The legal basis is Art. 6(1)(b) GDPR, and for invoices also point (c).

9. Push notifications

If you allow push in your browser or in the app, we store your device’s push address or device token. Messages (title, short text, link) are delivered through the manufacturer’s push service: in the browser through your browser’s service (for example Google, Apple or Mozilla), in the app through Apple Push Notification service (iOS) or Google’s Firebase Cloud Messaging (Android). We only send push for features you switched on: alerts for your watchlist and price alerts, notices about the stop and target of your trades, results of automatic trades, the morning briefing and the evening note on earnings. You can turn push off at any time in DipCatcher’s settings, your browser or your device. The legal basis is Art. 6(1)(b) GDPR.

10. Broker connection, import and interfaces

Broker access. If you connect a broker or crypto exchange with keys, we store the credentials encrypted with AES-256-GCM; the key for that exists only on our server. We send the credentials only to the provider you chose, to test the connection and – for Trading 212 and Alpaca – to fetch your executed buys and sells. The provider processes your data under its own responsibility and privacy policy; some providers are outside the EU (for example in the US).

Import. We read PDF or CSV statements on our server; the trades found are stored only once you confirm them. If you forward statements to import@dipcatcher.de, we match the email to your account by your sender address; the email stays in the mailbox at IONOS.

Webhooks. If you enter a webhook address (for example for a trading platform or your own bot), we send buy decisions with the stock and price levels there. With a personal token you can send TradingView alerts to DipCatcher; we store the stock and the alert text.

API and MCP. For the programming interface we store only a hash of your personal key. We log every call with account, function and stock.

The legal basis for this section is Art. 6(1)(b) GDPR.

11. Payment and invoices

You pay for Pro through Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. We send Mollie your email address, your name if given, your internal user ID and the plan; you enter card, bank or PayPal details directly with Mollie. From Mollie we receive the status, payment method and the IDs of payment, customer and subscription. For every payment we create an invoice with invoice number, customer number, name, email address, country, period, amount and payment method, and send it by email. When you start Pro we also store your confirmation of the subscription terms with time, version, email address and browser identification as proof. Legal bases: Art. 6(1)(b) GDPR (contract), (c) (tax and commercial retention) and (f) (proof of the confirmation).

12. Support and feedback

We store support requests and our replies with your account to handle them (Art. 6(1)(b) GDPR). If you leave a review and agree to publication, we show the stars, the text, your initials and your country publicly (Art. 6(1)(a) GDPR). You can withdraw that consent by email at any time; we then take the review off the website.

13. Service providers and recipients

• IONOS SE, Germany: server, sending email and mailbox (processor).
• Supabase: database and sign-in, servers in the EU (processor).
• Mollie B.V., the Netherlands: payment processing (own responsibility as a payment service provider).
• Push services of browser and device makers (Apple, Google, Mozilla): delivering push messages; also in the US.
• The broker, crypto exchange or webhook address you chose: only at your request.
• Apple and Google as app store operators, if you download the app there (under their own responsibility).

Our server fetches market data, company data and headlines (Yahoo Finance, Nasdaq, the news feeds); no data about you is sent. Fonts are served from our own server; nothing is loaded from Google Fonts. Your data does not go to any AI provider: “Copy for AI” only puts the text on your clipboard, and what you do with it is up to you.

14. Transfers outside the EU

Push messages may pass through servers of Apple, Google or Mozilla in the US. Where the provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). If you connect a broker or exchange outside the EU, we send your credentials there at your request (Art. 49(1)(b) GDPR).

15. How long we keep data

• Account and member data (sections 7, 9, 10, 12): until you delete your account, then within 30 days.
• Invoices and payment records: as long as statutory retention periods require (up to 10 years).
• Server log files: 30 days.
• Live overview: at most 150 seconds after the last sign of life.
• Single page views in the statistics: 13 months; daily totals without personal reference indefinitely.
• Published reviews: until you withdraw consent or delete your account.

16. No automated individual decisions

Ratings, stars, entry, target and stop are calculated automatically, but about securities, not about people. There is no automated decision that has legal effects on you or similarly significantly affects you (Art. 22 GDPR), and no profiling for advertising.

17. Whether you have to provide data

For an account we need your email address and a password; for Pro also the details for payment and invoice. Everything else is optional. Without an account you can use the public pages.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to info@kawums.de.

Right to object. Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

19. Changes

We update this policy when DipCatcher or the legal requirements change. The version published here applies.

Last updated: November 2026