Privacy Policy

Data we process

Account data: your email address, name, nickname and avatar image, stored with our database provider (Supabase) when you sign up.

Your content: tasks, notes, brain-dump items, routines, countdowns and widget layout. On the free plan this content lives in your browser's local storage on your device; where cloud sync is enabled, it is stored in our database linked to your account.

Connected services (optional, only if you connect them): Google Calendar via Google OAuth — we store an encrypted refresh token to act on your behalf and never your Google password; email accounts over IMAP, including Gmail — the server settings and an AES-256-GCM-encrypted app password; internal messages you exchange with other users.

Feedback you submit through the in-app feedback button, together with technical context (widget, page, browser user agent, viewport size).

Waitlist and early-access data: the email address you submit to join the waitlist.

Why we process it (legal basis)

To provide the service you signed up for (contract): accounts, your content, connected services, messaging.

To improve the product (legitimate interest): privacy-friendly, cookieless usage analytics (Vercel Analytics) and the feedback you choose to send.

With your consent, where you opt in: the weekly recap email (you can turn it off anytime from your profile) and each third-party connection (Google, IMAP), which you can disconnect at any time.

AI features

When you use an AI feature (such as "chunk it"), the text you submit for that action is sent to our AI provider (Anthropic) to generate the result. It is not used to train their models under our API terms. If no AI key is configured, a local heuristic runs instead and nothing leaves the app.

Where your data lives and who processes it

Hosting and serverless functions: Vercel. Database, authentication, realtime and file storage: Supabase. Transactional email (only if you opt in to email features): Resend. AI processing (only when you invoke an AI action): Anthropic. These providers act as processors on our behalf.

We do not sell your data, and we do not share it with anyone beyond the processors listed above.

International data transfers

Divergify serves users worldwide; Limitless Origin LLC is based in the United States and our providers process data primarily in the US. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of your data outside those regions rely on appropriate safeguards: the EU Standard Contractual Clauses in our providers' data-processing agreements and, where a provider is certified, the EU–U.S. Data Privacy Framework.

Google user data

Divergify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We read and write your Calendar events only to display and operate the widgets you enabled, never for advertising, and we do not transfer this data to third parties. We do not request access to your Gmail: if you read Gmail in Divergify it is over IMAP, with an app password you generate yourself.

Retention and deletion

We keep your data for as long as your account exists. You can delete your account yourself from Profile → Danger zone: this permanently removes your profile, content stored on our servers, connected-service credentials, messages and avatar, and deletes your login. Data stored only in your browser can be cleared by clearing the site's data in your browser.

Feedback you sent may be kept in anonymized form (no longer linked to you) to preserve bug history.

Your rights

Wherever you live, you can access, correct, export and delete your data, and withdraw any consent, at any time — through the app (Profile → Danger zone for deletion) or by writing to hello@divergify.io; we respond within 30 days and never discriminate against you for exercising a right.

If you are in the EEA, the UK or Switzerland (GDPR): you additionally have the rights to restrict or object to processing and to data portability, and you may lodge a complaint with your supervisory authority (in Italy: the Garante per la protezione dei dati personali).

If you are a California resident (CCPA/CPRA): you have the rights to know, delete and correct your personal information and to opt out of its sale or sharing — we do not sell or share personal information as defined by the CCPA, and we collect no sensitive personal information beyond what you choose to store in the app.

Changes

We will update this policy as the product evolves and change the date above. For significant changes we will notify you in the app.