Privacy policy

1. Who is responsible

Divitica is run by Samir Caus, who is the controller for the personal data described here:

Samir Caus
c/o POSTFLEX PFX-744-129
Emsdettener Straße 10
48268 Greven
Germany
Email: hello@divitica.com

Write to this address for anything about your data, including the requests in section 11.

2. In short

• We store what you put into Divitica so you can use it on the web and from AI assistants you connect.
• We don’t sell your data, show ads, or use your content to train AI models.
• An AI assistant only gets access when you connect it, only to the areas you approve, and you can disconnect it at any time.
• Analytics on the website are cookieless and don’t build a profile of you.

3. Data we process

Account

Your name, email address and a hashed password, or, if you sign in with Google, the name, email address and profile picture Google shares with us. We also keep your timezone and week-start setting, and the sessions you are signed in with (including the IP address and browser that started each session) so we can keep your account secure.

Your content

Everything you add: tasks and subtasks, habits and check-ins, recharges, journal entries and moods, weekly reflections and life-area ratings, goals, and their notes. We also keep a history of changes so they can be undone.

Journal entries and moods can contain sensitive information, for example about your health. You decide what to write; we process it only to store it and show it back to you (and to assistants you connect).

Google Calendar (optional)

If you connect Google Calendar, Divitica reads your events to show them in the Day and Week views. Events are fetched when you look at them and are not stored. The access tokens Google issues are stored encrypted, and you can disconnect at any time.

Weather (optional)

If you set a weather location, we store the place name, its coordinates and daily forecast snapshots collected while the feature is enabled so the Day, Week and Month views can show them. We send your location search, or the saved coordinates and a 15-day date range, to Visual Crossing; we do not send your name, email address or planner content.

AI assistant connections (optional)

When you connect an assistant such as Claude or ChatGPT, we store the connection: which assistant, which areas you allowed (tasks, habits, journal), and hashed access tokens. See section 5.

Billing (Pro only)

If you upgrade, payments are handled by Stripe. We store your Stripe customer ID and your subscription status and dates. Your card details go directly to Stripe and never reach us.

Newsletter (optional)

If you subscribe, we store your email address, when you subscribed and from which page.

Technical data

When you use the site, our hosting provider processes your IP address, browser details and the pages requested. We use IP addresses to limit abuse (for example, too many sign-in attempts) and keep short-lived server logs to fix errors.

4. Why we use it, and the legal basis

• Providing Divitica (account, content, sync, weather and AI or Calendar connections you set up): to perform our contract with you, Art. 6(1)(b) GDPR. Where your journal contains health information, we process it on the basis of your explicit choice to store it, Art. 9(2)(a) GDPR, and you can delete it at any time.
• Payments and records: contract, Art. 6(1)(b), and legal retention duties, Art. 6(1)(c) GDPR.
• Security, abuse prevention and error logs: our legitimate interest in a safe, working service, Art. 6(1)(f) GDPR.
• Cookieless website analytics: our legitimate interest in understanding which pages are useful, Art. 6(1)(f) GDPR.
• Newsletter: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.

5. AI assistants (MCP)

Divitica has an MCP server at https://divitica.com/mcp that lets AI assistants read and change your Divitica data on your behalf.

• You decide. An assistant gets access only after you sign in to Divitica and approve it. You choose the areas (tasks, habits, journal) it may use.
• What we see. We receive the requests the assistant makes to Divitica (for example “list today’s tasks” or “save this journal entry”) and answer them. We don’t receive your conversation with the assistant.
• What the assistant’s provider sees. Whatever Divitica returns to the assistant becomes part of your conversation with it, and the assistant’s provider (for example Anthropic for Claude or OpenAI for ChatGPT) handles it under its own privacy policy and your settings there.
• Changes are recorded. Every change an assistant makes is logged with the rest of your history and can be undone.
• Disconnect any time under Settings → Connected assistants in the app, or by removing Divitica in the assistant. Access tokens expire after one hour, and an unused connection ends after 30 days.

6. Service providers

We use these providers to run Divitica. They process data on our behalf under data processing terms, or, where noted, as independent controllers:

• Cloudflare, Inc.: hosting, database, content delivery, security, logs and email routing.
• Stripe: payments and subscription management (Pro only). Stripe is also an independent controller for payment data.
• Google: optional sign-in and Google Calendar. Fonts are served from divitica.com itself, so opening the site doesn’t contact Google.
• Visual Crossing: location search and forecasts for the optional planner weather feature.
• Umami Software, Inc.: cookieless website analytics. It records page views without cookies or a persistent identifier.
• AI assistants you connect (for example Anthropic or OpenAI): independent controllers for your conversations with them, see section 5.

7. International transfers

Some providers process data outside the European Economic Area, including in the United States. Where they do, transfers rely on an adequacy decision such as the EU–US Data Privacy Framework, or on the European Commission’s Standard Contractual Clauses.

8. Cookies and browser storage

Divitica uses only what it needs to work: a session cookie that keeps you signed in, a cookie that remembers whether the sidebar is open, and browser storage for display preferences such as theme and collapsed sections. We don’t use advertising or tracking cookies, so there is no cookie banner.

9. How long we keep data

• Account and content: until you delete it or ask us to delete your account. Deleting your account removes your content and change history.
• Weather location and saved forecast snapshots: until you remove the location in Settings or delete your account.
• AI connections: until you disconnect, or 30 days after last use.
• Sessions: until you sign out or the session expires.
• Abuse-prevention records and server logs: a few days at most.
• Billing records: as long as tax and commercial law requires (up to 10 years in Germany).
• Newsletter: until you unsubscribe.

10. Security

All traffic uses HTTPS. Passwords are hashed; AI access tokens are stored only as hashes; Google tokens are encrypted. Assistants authenticate with OAuth 2.1 and PKCE, and their access is limited to the areas you approved. If you find a security issue, please email hello@divitica.com.

11. Your rights

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing. Email hello@divitica.com from the address on your account and we’ll respond within one month.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

12. Children

Divitica is not meant for children under 16, and we don’t knowingly collect their data.

13. Changes

We’ll update this policy when Divitica changes how it uses data, and change the date at the top. For significant changes we’ll tell you in the app or by email.