What Diver stores, and what never leaves your device.

Last updated 11 September 2026. This policy covers the Diver apps (iOS, Android, macOS and the browser build at app.usediver.com) and the two services behind them.

The short version. The URIs you build and open stay on your device. Diver has no analytics, no advertising, no third-party trackers and no crash reporting. An account exists so a team can share deeplink templates and so your devices can reach each other — and if you never sign in, nothing at all is sent to a Diver server.

1. Who this is about

Diver builds deeplinks and opens them on devices. It is used by the people who build and test apps, and this policy describes what the software does with their data.

Controller: TBD. The entity operating this deployment, and its postal address, are to be filled in before this page is published. Until then, direct any question to whoever gave you access to app.usediver.com.

2. What stays on your device

Most of what Diver knows about you never goes anywhere. Held locally, in the device's own storage — a SQLite database on a phone or desktop, the browser's storage in a tab:

History. The last 50 URIs this device opened, each with its scheme and the time it was opened.
Favourites. The URIs you starred, and when you starred them.
Preferences. The URI you were last editing and the tabs you had open, this device's name and generated id, whether each transport is switched on, and your light/dark choice.
Your session. If you sign in, the access and refresh tokens, in the platform keychain (Keychain on Apple platforms, the Keystore-backed store on Android) or the browser's storage on the web.

None of this is uploaded, backed up to us, or readable by us. Clearing the history in the app, or clearing site data in a browser, deletes it outright; deleting the app takes the rest with it.

3. What your account holds

An account is optional. It exists so that a team can share deeplink templates and so your own devices can send links to each other. Signing in creates a record on the Diver services; everything below is what those records contain.

Your identity

Your email address, an optional display name and optional photo URL.
A password hash (bcrypt) if you signed up with a password. The password itself is never stored, and the hash never leaves the authentication service.
Microsoft's stable account identifier (oid) if you use Sign in with Microsoft — see §6.
When the account was created, and when it last signed in.
Refresh tokens, stored hashed. Each refresh replaces the previous one, and presenting an already-used token revokes the whole chain — so a stolen token is usable at most once, and the theft is what ends the session.

Your team's data

Organizations you belong to, and your role in each.
Memberships and invitations — for an invitation, the invited email address, the role, who sent it, when it expires, and a hash of the invitation token.
Apps, environments and deeplink templates your organization registers: names, schemes, hosts, paths, query parameters and their types, link domains, Android package names and certificate fingerprints, iOS team and bundle ids.
CI keys used to import routes from a build, stored hashed, with the time each was last used.

This is configuration about apps rather than about people, but it is listed here because your name sits beside it: the member roster carries the email address and display name of everyone in the organization, so the people you share an organization with can see yours.

Your devices

A device that is reachable from your account registers itself: an id, the name you gave it, its platform (ios, android or macos — it picks an icon), when it was registered and when it was last seen. Nothing about the hardware, and no advertising identifier.

4. Sending a URI to another device

When you send a URI to one of your devices through your account, the URI travels over an authenticated connection to that device and the device answers with what it did — opened, queued, or nothing here can open it. The URI is not written to a database on the way through. It exists in the service's memory for as long as the delivery takes, and the record of it is the history entry on the two devices.

Ordinary server logs may record that a request happened, with its time and the device it was addressed to.

5. The local network

With Discoverable on this network switched on, the app advertises itself over mDNS under the name you gave the device, so other copies of Diver on the same Wi-Fi can list it and send it a URI. There is no pairing step — anyone running Diver on that network can send to it — which is why the app says so next to the switch, and why the switch is there. Turn it off on networks you do not trust. Nothing about this passes through a Diver server; the two devices talk to each other directly.

6. Sign in with Microsoft

If you choose it, Microsoft authenticates you and returns an ID token, which Diver verifies and reads three things from: the stable account identifier (oid), your email address, and your display name. Those are stored as in §3. Diver receives no password, and no access to anything else in your Microsoft account. Microsoft's own handling of the sign-in is covered by Microsoft's privacy statement, not by this one.

7. What Diver does not do

No analytics or telemetry. The apps ship with no analytics SDK, no crash reporter and no usage tracking.
No advertising, no advertising identifiers, and no profiling.
No third-party trackers on this website, and no cookies set for tracking. The website is static files; the browser build of the app stores its data in your browser, for your browser.
No sale or sharing of personal data with anyone, for any purpose.
No reading of your history. The URIs you build and open are not sent to a Diver server at all — see §2 and §4.

8. How long any of it is kept

Data	Kept
History and favourites	On your device until you clear them, or until the 50-entry history rolls over.
Account record	Until the account is deleted.
Refresh tokens	Until they expire, are rotated, or are revoked by signing out.
Organizations, apps, deeplinks	Until deleted by someone with the role to delete them.
Invitations	Until accepted, revoked or expired.
Devices	Until you remove the device from your account.
URIs sent between devices	Not stored — see §4.

9. Your rights, and how to exercise them

Where the GDPR or a comparable law applies to you, you have the right to access a copy of your data, to have it corrected, to have it deleted, to take it elsewhere, and to object to or restrict its processing. You also have the right to complain to your local data protection authority.

Much of it you can do in the app: rename or remove a device, leave or delete an organization, delete a deeplink, sign out to revoke a session. For deleting the account itself, or for a copy of everything held about you, write to us.

Contact: TBD. A monitored address for privacy requests is to be filled in before this page is published.

10. Security

Traffic between the apps and the services runs over HTTPS; release builds refuse cleartext outright.
Passwords are stored as bcrypt hashes. Refresh tokens, invitation tokens and CI keys are stored hashed, and the readable value exists only in the client that was handed it.
Access tokens are short-lived, scoped to the service they are for, and signed with a key whose public half is published for verification.
Every request for an organization's data is checked against your membership and role.
Session tokens are held in the platform keychain rather than in ordinary app storage.

Where the servers run: TBD, along with whether any data leaves your region. No third party processes your data on our behalf beyond the hosting provider and, if you use it, Microsoft's sign-in.

11. Children

Diver is a developer tool and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

If this changes, the date at the top of the page changes with it, and a material change will be announced in the app before it takes effect. Previous versions are in the repository's history.