Last updated: 11 September 2026 · Package de.getmad.dipsy
1. Controller
Matthias Hotz, Im Neufeld 9, 76359 Marxzell, Germany. Email: matthias.hotz@gmail.com
2. In short
Dipsy has no user account, no advertising and no analytics or tracking components. There is no registration and no profiling. Your watchlist never leaves your device.
To show prices, however, the app has to fetch data .. and every request on the internet inevitably transmits your IP address to the provider in question. Section 4 lists them. Section 7 describes a feature that loads page content in the background.
3. Stored on your device
The app’s own settings hold the securities on your watchlist (symbol, name, last retrieved price, order) and your preferences (language, haptic feedback, compact view, widget font size).
If you enter price limits, a purchase price or a number of shares for a holding, or set a personal tax rate in the settings, those entries are stored there as well. They are optional: the app works fully without them. They are used for calculations on your device only.
This data stays on the device. It is transmitted neither to us nor to third parties, and it is deleted when you uninstall the app. An Android backup may save it to your Google account; that is outside our control.
4. Requests to third parties
When prices, key figures and logos are fetched, the security symbol and, inevitably, your IP address are transmitted to the following providers:
- Yahoo Finance .. prices, dividends, key figures
- TradingView .. fallback source when Yahoo is unavailable
- multpl.com .. macro indicators, fallback only
- financialmodelingprep.com, companiesmarketcap.com, assets.parqet.com .. company logos
These providers therefore learn which securities you follow. Your name, your contact details or any identifier that would make you recognisable across sessions are not transmitted. The providers process data under their own privacy policies; some of them are based outside the EU.
Legal basis: Art. 6(1)(b) GDPR .. without these requests the app cannot serve its purpose.
5. Requests to our own server
Once a day the app fetches a prepared file of macro indicators from our server (seorch.xyz). This produces the usual web server logs containing IP address, timestamp and the address requested. These logs are deleted after two months and are not combined with any other data.
Legal basis: Art. 6(1)(f) GDPR .. legitimate interest in secure and reliable operation.
6. Reporting failed interfaces
If one of the price sources named in section 4 does not answer, or its answer cannot be parsed, the app reports this to our server. What is transmitted is exclusively: the host name of the source concerned (for example „finance.yahoo.com“), a fixed label for the interface, the kind of error, the HTTP status code, the number of failed attempts and the app version.
The address requested is not transmitted, and therefore neither is the ticker of the security you are looking at. Nor is any device, crash, location or usage data, nor any identifier; two reports from the same device are not recognisable as such to us. Reports are aggregated and sent at most every 15 minutes, and only when an error actually occurred. Their sole purpose is to notice and fix the failure of a third-party interface. You can switch this off in the settings under „Report outages“; nothing is then recorded and nothing transmitted.
Beyond that, the app contains a diagnostics feature that is hard-disabled in the published build and cannot be switched on through the settings either. No analytics, advertising or tracking libraries are included.
Legal basis: Art. 6(1)(f) GDPR .. legitimate interest in noticing the failure of a third-party data source and keeping the app working.
7. Loading web pages in the background
Dipsy contains a feature that loads web pages in the background on your device and transmits their content to our server. This is separate from the price display and serves to collect publicly available financial data.
- The app requests a list of addresses from our server.
- It opens those addresses over your internet connection in an invisible browser window. To the pages being opened, your IP address appears as the sender.
- The loaded page content is sent back to our server. Only the target file name and the page content are transmitted .. no information about your device and none of the data the app stores.
- This consumes data traffic and battery on your device.
The pages opened may set cookies; these live in the app’s own store, separate from your browser, and are deleted when the app is uninstalled.
You can turn this feature off in the app settings under „Background data collection“. No addresses are requested and no content is sent after that. Legal basis: Art. 6(1)(f) GDPR. You may also object to this processing under Art. 21 GDPR; please write to the address given in section 1.
8. Permissions
- Internet .. fetching prices
- Vibration .. haptic feedback when reordering and tapping
No permission for location, contacts, camera, microphone, address book or files.
9. Children
The app is not directed at children under 13 and does not knowingly collect data from them.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please write to the address given in section 1.
You may also lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstrasse 20, 70173 Stuttgart, Germany.
As we keep no accounts and store no identifier, we are generally unable to link a request to an individual (Art. 11 GDPR). You delete the data stored in the app yourself by uninstalling it.
11. Changes
If the way the app works changes, this policy will be updated. The version published at https://www.getmad.de/data-protection-dipsy-en/ is the authoritative one.