Skip to content

Privacy

Updated October 24, 2026

Dibs is a sign-up sheet. This page says what we keep, why, who sees it and how to have it deleted. The short version: we keep what a sheet needs, we show no ads, and we never sell anyone's data.

Who we are

Dibs is run by Steamata LLC, a Wyoming company in the United States. Steamata LLC is responsible for the personal data described here. Questions about privacy go to hello@dibs.page. A person reads that inbox.

If you make a sheet

  • Your email address and name, if you give them. Your email is how you sign in (we send a link; there are no passwords), how your sheets follow you to other devices, and where we send news about your sheets. We note when you confirmed it by using a sign-in link.
  • What you put on your sheets: the title, description, place, dates, slots, questions and settings. If you paste your group's list (names, and emails if you have them), only you and your co-organizers see it.
  • Co-organizers' email addresses, so we can invite them.
  • Your sign-ins: a cookie on each device you use, and on our side a hash of its token (never the token itself), when it was made and last used, and the browser it came from, so you can recognize your sessions. API keys are stored only as hashes.
  • If you buy Plus: your plan, its status and renewal date, and the customer and subscription IDs Stripe gives us. Stripe takes the payment; we never see your card.

If you sign up to a sheet

You don't make an account. We keep what the organizer's sheet asks for:

  • Your name, shown on the sheet the way the organizer chose: full name, first name and initial, or just "taken".
  • Your email address, for your confirmation, reminders, waitlist news and the private link to change or cancel. Other people signing up don't see it.
  • Your phone number, only if the sheet asks for it.
  • Your answers and comment. Comments are public on the sheet or private to the organizer, depending on how the sheet is set up.
  • Your sign-up's history: when you signed up, changed, swapped or cancelled, whether you were checked in on the day, and whether it came from you, from an assistant using an organizer's API key, or without our bot check.

The organizer and co-organizers see everything you give their sheet, including your email address, and can export it. They decide how they use it, and our terms require them to use it only for the sheet.

Anyone with a sheet's link can open it, so treat a sheet like one pinned to a noticeboard and keep private details off it. Sheets are marked so search engines don't list them.

Email

We email people only about sheets they made or signed up to, or were added to by an organizer: confirmations, reminders, waitlist news, changes, messages and nudges from the organizer, and sign-in links. We never send marketing to people on someone else's sheet.

To do that we keep a record of each email we send or hold back (who, which kind, when, and why it was held back), delivery reports from our email provider (delivered, bounced, marked as spam), and the addresses that asked to stop email from a sheet or from Dibs, so we keep honoring that.

Keeping Dibs safe

  • Rate limits count requests by IP address (some as a hash). The counters expire within a day.
  • The bot check is a small puzzle your browser solves. It runs on our own server; there's no third-party captcha.
  • Reports: if you report a sheet, we keep the reason, your note and email if you give them, and a keyed hash of your IP address, so we can count separate reports without keeping the address.
  • Server logs: the server keeps a line for each request (time, page, status, IP address and browser) for 30 days, and a copy of each email it sends for 7 days. We read them only to keep Dibs running, to answer a question you ask us, or to look into abuse.

Visit counts

Our server counts visits without cookies or scripts, from the request itself. A visitor is a hash of the IP address and browser with a salt that changes daily and is deleted after 48 hours. The IP address and browser aren't stored with the count.

Cookies

Dibs sets only its own cookies, all needed for it to work:

  • The sign-in cookie for organizers, for up to 90 days.
  • "Your spots": the private links you used on this device (up to 10), for up to 180 days, so the sheet can highlight your spots without asking you to sign in.
  • A short-lived note for 10 minutes after you sign up, so the confirmation page can show it.

The sheet editor keeps your unpublished draft in your browser's storage until you publish it. We use no advertising cookies, trackers or third-party analytics.

Who helps us run it

These companies process data for us, only as far as their part needs:

  • Hetzner: the server Dibs runs on, in the European Union. The database lives there.
  • SendGrid (Twilio): delivers our email, and tells us when a message bounces or is marked as spam.
  • Stripe: takes payment for Plus and sends receipts, under its own privacy policy.
  • Cloudflare: DNS for Dibs, and forwarding mail sent to our address to our inbox.

SendGrid and Stripe may process data in the United States. We may also disclose information when the law requires it. Nobody else gets it: we don't sell or rent data, and we don't share it with advertisers.

How long we keep it

  • A sheet and everything on it (slots, sign-ups including cancelled ones, waitlists, answers, your group's list): until the organizer deletes the sheet. Deleting it removes all of that at once.
  • An organizer's account (email, name, plan): until you ask us to delete it.
  • Sign-in sessions: up to 90 days. Sign-in links stop working after 30 minutes (the one in your welcome email after 7 days).
  • Server logs: 30 days. Copies of sent email on the server: 7 days.
  • Visit counts: a year. They hold no IP addresses and no cookies.
  • Stop-email requests and delivery reports: kept, so we keep honoring them and can pause senders whose mail bounces or is reported as spam.
  • Billing records: Stripe keeps them as long as the law requires.

Your choices

  • Change or cancel your sign-up from the private link in your confirmation email. A cancelled sign-up stays in the sheet's history, seen only by its organizers, until the sheet is deleted.
  • Stop email with "Stop emails from this sheet" or "Stop all Dibs email" at the bottom of any email we send you about someone's sheet. It never takes away your spot.
  • Have your details erased from a sheet by writing to us. When an organizer removes you, you're off the sheet, but the entry stays in its history like a cancellation.
  • Delete a sheet you made from its settings. It's for good, and it doesn't email the people on it.
  • Cancel Plus in Manage billing, in your settings.
  • See, correct, export or delete what we hold about you, including your whole organizer account: email hello@dibs.page from that address. We reply within 30 days, usually much sooner.

Depending on where you live, for example the EU, UK or California, you may have further rights, including to complain to your data protection authority. We'll help you use them.

Security

Traffic is HTTPS only, and the database isn't reachable from the internet. Sign-in tokens, private links and API keys are stored only as hashes, and organizers sign in with one-time links instead of passwords. No system is perfectly secure: if we learn of a breach that affects your data, we'll tell you promptly. To report a security problem, write to hello@dibs.page.

Children

Dibs isn't meant for children under 13 to use on their own. When a child takes part in something, such as a class activity, a parent or carer should sign up for them. If you believe a child has given us personal data, write to us and we'll delete it.

Changes

When we change this page, we update the date at the top. If a change matters, such as a new provider or a new use of your data, we email organizers before it takes effect.