Back to Dibber

Privacy Policy

Version effective: October 20, 2026

1. Controller and contact

Dibber is operated by Jérôme Pirotte as an individual. I determine how the service processes personal data. For privacy requests, contact info@dibber.pro. This policy describes the current service, including the optional paid Dibber Plus subscription; it is not consent to processing. The Terms of Service and Cookie Policy apply alongside it.

2. Data, purpose, and legal basis

DataPurposeBasis
Email, account identifiers, authentication and security eventsCreate accounts, sign in, recover access, prevent abuse, and secure sessions.Contract or steps requested before contract; legitimate interests in security
Routes, GPS coordinates, elevation, timestamps, derived metrics, maps, images, project settings and exportsProvide route analysis, storage, collaboration, and exports you request.Contract or requested service
Club posts, comments, memberships, event and leaderboard entriesShow content to the club audience you choose and operate club features.Contract and your sharing action
OCR images, extracted text, and task statusExtract map metadata and classify map information.Your request; provider processing is required for that feature
Encrypted connection credentials (an API key for an activity service you connect, e.g. Intervals.icu) and the activities you explicitly import from itImport single activities you choose from your own account on the connected service. The key is stored encrypted and is deleted on disconnect or account deletion; only the activities you import are kept — there is no sync or history backfill.Contract or requested service
Anonymous usage events and a pseudonymous browser identifier (PostHog EU cloud)Count visits, page categories and feature usage to understand what to build and fix. No advertising, no cross-site tracking, no session recording; Do Not Track/GPC browsers are not measured.Legitimate interests in running and improving the service; you may object at any time (see §7)
Optional analytics events and feedback form fieldsMeasure consented product usage and respond to feedback.Analytics consent; legitimate interests or your voluntary submission for feedback
Billing customer identifier, subscription status and paid-period dates, plan entitlement and allowance usage, and refund or cancellation request stateGrant and enforce the plan you hold, show your usage and renewal dates, and process cancellations, refunds and billing support.Contract for the paid subscription; legitimate interests in operating and securing the service

3. Sources and recipients

Data comes from you, your browser, the activity service you choose to connect (Intervals.icu receives only your key-authenticated requests for the activity list and the files of activities you import), and normal service logs. Dibber uses Supabase and its hosting/storage infrastructure, application hosting, PostHog EU cloud for cookieless usage measurement, Plausible when opted in, hCaptcha during enabled authentication challenges, Tally for feedback, mapping/elevation providers, Google Cloud Vision, and OpenAI for enabled OCR/classification flows. Paid subscriptions are additionally processed by Paddle.com Market Ltd as merchant of record, which handles checkout, payment methods, tax calculation and remittance, invoicing and payment support under its own terms and privacy notice; Dibber receives only the subscription, entitlement and usage records described above, never your payment credentials. Tally feedback retains the fields you submit and a coarse page category; Dibber does not retain Tally's provider respondent identifier. Providers receive only the data needed for the feature. Their roles, locations, safeguards, and retention depend on the deployed account and contract; I will update this notice when those arrangements are confirmed. Do not upload material to OCR that you do not want sent to those providers.

4. Sharing and public surfaces

Private projects are restricted by account access. A club share, developer grant, post, leaderboard entry, or other explicit share can expose the selected data to its intended recipients. Profile avatars and content deliberately published in a public club may be visible more broadly. Revoking a grant stops future access where supported, but cannot recall downloaded or cloned copies.

5. Retention and deletion

  • Registered account data is retained while the account is active or as needed for the stated purpose.
  • Guest data is eligible for automated deletion after 24 hours. The hourly cleanup removes database records and queues exact Storage API paths; the cleanup worker retries failed physical deletions.
  • Deleted projects remain in trash for 30 days before permanent database deletion and queued file deletion.
  • Pending route/image files in browser IndexedDB expire after 24 hours and are cleared on logout or account change.
  • Imported tracks are yours and remain until you delete them.
  • Billing records are kept while the account exists. Payment card and bank details are never stored by Dibber: Paddle is the merchant of record and holds them under its own notice. After account deletion a minimal billing tombstone is retained so a delayed payment event cannot recreate the account or restart charging; provider tax and accounting retention may require longer periods.
  • Security, legal, backup, and provider retention may require longer periods.
  • Usage-measurement data (PostHog EU cloud) is pseudonymous and kept only as long as it serves the measurement purpose above; it is not linked to route or account content, and an objection (§7) removes it from future collection.

6. Security

I use access controls, private storage for project files and thumbnails, encrypted provider connections where offered, and bounded integrations. No online service is risk-free. Report suspected unauthorized access promptly at info@dibber.pro.

7. Your rights and requests

Subject to legal limits, you can request access, correction, deletion, restriction, objection, and portability, or withdraw optional analytics consent. You can object to the legitimate-interest usage measurement at any time by enabling Do Not Track or Global Privacy Control in your browser (which Dibber honours, so no measurement happens) or by asking me at info@dibber.pro. Contact info@dibber.pro with the account email and request scope. I may verify identity without asking for a password or recovery code. The in-app project backup is not a complete data export; support will process a broader request without disclosing other users' data. I normally respond within one month and will explain a lawful extension where needed.

8. Cookies and browser storage

Authentication cookies and browser storage support login, preferences, and pending files. Optional Plausible analytics requests are sent only after an explicit choice and use an allowlisted page category. Anonymous usage measurement (PostHog) is cookieless — it keeps only a pseudonymous identifier in browser storage and honours Do Not Track/GPC. See the Cookie Policy for the inventory and settings controls.

9. Children

Dibber is not intended for children under 16. If you believe a child has provided personal data, contact support so it can be reviewed and deleted where appropriate.

10. Complaints and changes

Contact me first so I can investigate. You may also complain to the Luxembourg National Commission for Data Protection (CNPD) or another competent supervisory authority. I will update this page when processing, providers, retention, or legal requirements materially change.