Privacy
Dipp is an Amazon.ca price tracker, operated from Canada for shoppers in Canada. This page describes every piece of information the site records, why it records it, and who else sees it. It is written to match what the code actually does. Last updated 27 August 2026.
Dipp handles personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you are outside Canada, your information is still stored and processed in the places described below.
What we collect
Your email address
Signing in uses a magic link: you enter an email address, Supabase sends you a one-time link, and clicking it creates a session. There is no password. Supabase stores your email address, an account identifier and sign-in timestamps.
A price alert also stores an email address, alongside the product and the target price you set. You can create an alert without an account. If you do, the email address is stored on its own with no account attached — which also means it will not appear under My alerts, because that page can only show alerts tied to a signed-in account.
What you save
Saving a product stores your account identifier, the product's ASIN and the time you saved it. Submitting a coupon stores your account identifier with the coupon type, code, description and expiry you entered, so a human can verify it before it appears on the site.
Cookies
Three kinds, all first-party. Supabase sets session cookies once you sign in; they keep you signed in and are refreshed on each request. A nd-theme cookie remembers whether you chose the light or dark theme for a year and contains nothing else. An nd-visitor cookie contains a random identifier used to count unique website visitors and expires after one year.
Google Analytics also sets its own _ga cookies, which hold a randomly generated identifier used to recognise a returning browser for up to two years. They carry no email address and no account identifier. Vercel Speed Insights sets no cookies at all. There are no advertising cookies.
Page views and outbound clicks
When you open a public page, Dipp records the page path, referring URL, campaign parameters, a random visitor identifier and the time so website visits and unique visitors can be measured. The identifier is not linked to your account or email address.
When you open a product page, Dipp records the product, your browser's user-agent string, the referring URL and the time. When you click through to Amazon.ca, it records the same four things plus the affiliate tag used. Neither record includes your IP address, your email address or your account identifier, and nothing links the two together or back to you.
These counts are what tell us which tracked products people actually care about, and they are how affiliate performance is measured. Your browser also keeps a dipp:view: entry in sessionStorageso the same product is not counted more than once every 30 minutes. That entry stays on your device, is never sent to us, and disappears when you close the tab.
What we do not collect
No IP addresses in our own tables, no advertising scripts, no fingerprinting, no profiles built across sites.Dipp does not sell personal information and does not share it for advertising. Two third-party measurement scripts do run, both described below: Google Analytics, which counts page views and the same outbound clicks recorded above, and Vercel Speed Insights, which times how fast pages load. Neither is sent your email address or your account identifier.
Where it is stored, and who else sees it
Five companies are involved, each for one job:
- Supabase holds the database and runs authentication — accounts, alerts, saved products, coupon submissions, views and clicks all live there.
- Vercel hosts and serves the site. Like any web host, it processes requests and keeps operational server logs, which include IP addresses. Its Speed Insights script additionally reports how long pages took to load and become interactive, tagged with the page path, country and device type — no cookie, no identifier, nothing that names you.
- Google receives analytics events through Google Analytics: the page you opened, the referring URL, campaign parameters, your approximate location and the
_gaidentifier described above. This is how audience size and which deals get clicked are measured. - Resend sends price-alert emails. It receives the recipient address and the contents of the email.
- Amazon receives you when you follow a link out. Links carry an affiliate tag so qualifying purchases are credited to Dipp; Amazon reports those purchases to us in aggregate, never as named people. Product images on this site are also loaded directly from Amazon's servers, so your browser contacts Amazon whenever a product image is shown. What Amazon does with any of that is governed by Amazon's own privacy notice, not this one.
These providers process data on our instructions. Their infrastructure may be located outside Canada, most likely in the United States, which means the information can be subject to the laws of the country it is stored in, including lawful access by courts and authorities there.
How long we keep it
Honestly: indefinitely, until it is deleted. There is no automatic expiry job. Product views and outbound clicks are kept as rows even though only the last seven days are used for ranking. A triggered price alert is marked inactive rather than removed, so its email address stays on file until deleted. Removing a saved product does delete that row immediately.
We would rather say that plainly than describe a retention schedule the code does not implement. If that changes, this page changes with it.
Your rights
Under PIPEDA you can ask what personal information we hold about you, ask for a copy, ask for corrections, ask us to delete it, and withdraw consent to any of it. You can do some of this yourself: sign in to remove saved products, and sign out to clear your session.
For anything else — a copy of your data, deleting an account, or cancelling a price alert you created without an account — email privacy@dipp.ca from the address in question, or tell us which address to look up. This is handled manually by a person, not by an automated flow. We will respond within 30 days, which is the PIPEDA deadline.
If you are not satisfied with how we handled a request, you can complain to the Office of the Privacy Commissioner of Canada.
Security
Access to the database is restricted by row-level security, so your saved products and alerts are readable only by your own account. Administrative keys are held on the server and never sent to your browser. Sign-in links are single-use and expire. No system is perfectly secure, and we do not claim otherwise.
Children
Dipp is meant for adult shoppers and is not directed at children.
Changes
If this policy changes, the date at the top changes. Material changes to what we collect or who we share it with will be described here rather than quietly folded in.
Contact
Privacy questions and requests: privacy@dipp.ca.