← FlipSift

Privacy Policy

Effective date: 22 October 2026

1. Who we are

FlipSift is operated by FlipSift (“we”, “us”). We are responsible for the personal information described in this policy (in UK/EU terms, the “controller”). This policy explains what we collect when you use the FlipSift website, dashboard, emails, Discord alerts and API (the “Service”), and what we do with it. Words not defined here have the meaning given in our Terms of Service.

2. What we collect

Information you give us, or that you create using the Service

• Account details: your name or business name, your email address, and the email addresses of any teammates you add as seats.
• Monitor settings: what you search for, the markets or locations you search, price ranges, keywords you include or exclude, and how often each monitor runs.
• Your deal pipeline: listings you save, dismiss, mark as bought or sold, the buy and sell prices you enter, and which teammate a deal is assigned to.
• Integrations: the Discord webhook URL you connect, and API keys you create. We store API keys only in hashed form, so we can’t read them back.
• Messages to us: what you send when you email support, including refund requests.
• Waitlist: if you join the waitlist before launch, your email address and when you joined. We use it only to tell you when FlipSift opens. Until launch, the waitlist form is run by our website host, Netlify, Inc., which stores the addresses for us.

Information from our payment processor

Subscriptions are paid through Whop, a third-party payment platform. It tells us your membership’s identifier, plan, status (such as trialing, active, cancelled or refunded), the email address used at checkout, the amount of each payment and when it was made, and the link to your membership page, so we can give you the right plan and send the notices renewal laws require. We never receive or store your full card number or other payment credentials; the processor handles those under its own privacy policy.

Free-trial checks

To keep free trials to one per person, when you start a trial we record your email address in a normalized form (for example, ignoring letter case and “+tags”), your payment processor account ID, and a card fingerprint — a code the payment processor generates that is the same each time the same card is used, but from which the card number cannot be worked out. If these match an earlier trial, the new trial doesn’t start and your plan begins when your first payment goes through. We keep these records for as long as we offer trials, so the check keeps working.

Information collected automatically

• Google sign-in: you sign in with your Google account. We ask Google only for your email address; Google tells us that address, whether Google has verified it, a Google account ID and when you last signed in to Google. We store the account ID and email to recognize you, and use the sign-in time to decide when to ask you to confirm it’s you before changing where alerts go. We don’t ask for your name or profile picture, never see your Google password, and receive nothing else from your Google account.
• Session data: when you sign in we create a session and store a hashed version of your session token, when it was created and last used, and when it expires.
• Purchase-link confirmations: if you sign in with a Google account whose email differs from the one you bought with, we email a one-time confirmation to the purchase address and store a hashed version of its token and which Google account asked.
• Your agreement to our terms: when you agree to the Terms of Service and this policy, we record which version you agreed to, when, and the IP address and browser it came from, so we can show the agreement was made.
• Abuse protection: we count purchase-link requests per IP address and per Google account, in memory, to stop them being used to flood an inbox.
• Delivery records: when alert emails and Discord posts were sent, how many matches they contained, and whether delivery failed.
• Server logs: like most websites, our servers and hosting provider record technical information about requests, including IP address, browser type, the page requested and the time. Our application logs can also include your email address — for example when an email to you fails to send. We use these logs to keep the Service running and secure.

We don’t use advertising trackers, third-party analytics services, tracking pixels in emails, or browser fingerprinting.

3. Marketplace listings

To run your monitors we collect listings that are publicly visible on marketplaces such as Facebook Marketplace, OfferUp, Craigslist and eBay: the title, price, general location, link, image link and when we saw it. We don’t log in to marketplaces, and we don’t collect private messages or information that isn’t publicly shown. We don’t store sellers’ names, profile pictures or profile links. A listing’s own text can contain personal information a seller chose to publish (for example a first name or neighborhood). Listing photos are shown to you straight from the marketplace’s own servers; on plans with AI identification, a listing’s title, price and photo are sent to Google (see section 6), with an instruction not to identify any person shown. We use listings only to show them to the customers whose monitors matched them, and we delete them once they are no longer needed (see section 9). If you are a seller and want us to remove a listing of yours, email flipsift@gmail.com with its link: we delete it from the Service and don’t collect it again.

4. How we use information

• to provide the Service: run your monitors, match listings, send your alerts, show your dashboard, and operate integrations you connect;
• to manage your account and subscription, including applying your plan and handling cancellations and refunds;
• to send you service messages: alerts, purchase-link confirmations you ask for, and important notices about your account, billing or changes to our terms;
• to provide support and answer your requests;
• to keep the Service secure, prevent fraud and abuse (including limiting free trials to one per person), and enforce our Terms;
• to fix problems and improve the Service, using aggregate usage and performance information; and
• to comply with the law and respond to lawful requests.

We don’t sell your personal information, use it for advertising, or make decisions about you that have legal or similarly significant effects based solely on automated processing.

5. Legal bases (UK and EU users)

Where UK or EU data protection law applies, we rely on:

• Contract — to provide the Service you subscribed to and manage your account;
• Legitimate interests — to keep the Service secure, prevent abuse (including repeat free trials), improve the Service, and process publicly available listings to power monitors. We balance these interests against your rights, and you can object (see section 11);
• Legal obligation — for example, keeping records for tax and accounting; and
• Consent — where we ask for it. You can withdraw consent at any time.

6. Who we share it with

We share personal information only with service providers that help us run the Service, under contracts that limit how they use it, and only as much as they need:

• Hosting provider — runs our servers and stores our database and backups, in the United States.
• Google — signs you in. Google learns that you signed in to FlipSift, under Google’s own privacy policy.
• Email delivery provider — sends alert emails, purchase-link confirmations and account notices to your address.
• Whop — takes payments and manages subscriptions, under its own privacy policy.
• eBay — on plans that search eBay, your monitors’ search terms are sent to eBay’s official API to find listings. Nothing that identifies you is sent.
• Discord — only if you connect a webhook: we post your alerts to your channel.
• Google (Gemini API) — on plans with AI product identification, the public title, price and photo of matched marketplace listings are sent to Google to identify the product. None of your account information is sent, and we use Google’s paid API tier, under which Google does not use the content to improve its products.
• Search infrastructure — to run searches on marketplaces we send requests through proxy network providers and, for some searches, run them on Apify’s platform. They receive your monitors’ search terms and search locations, never your account details.
• SoldComps — on plans with sold prices, the names of products and your monitors’ search terms are sent to SoldComps to look up recent eBay sales. Nothing that identifies you is sent.
• Content delivery networks — our pages load a small script from a public CDN (jsDelivr), and listing images load directly from the marketplace’s own servers. Those providers receive your IP address and browser details when your browser requests the file. We tell browsers not to send them the address of the page you’re on.

We may also disclose information if the law requires it, to protect the rights, safety or property of our customers, the public or us, or as part of a merger, acquisition or sale of the business (in which case we’ll tell you). Teammates on a shared plan can see the account’s monitors and pipeline, and the email addresses of the account’s seats.

7. Cookies

We set three cookies, all strictly necessary, not readable by scripts and only sent to our site. sid keeps you signed in to your dashboard and expires after 14 days (or when you sign out). fs_oauth holds the few values that make a Google sign-in safe and expires after 10 minutes. fs_pending remembers your Google sign-in between Google and the Terms or purchase-linking step, and expires after 15 minutes. We don’t use advertising, analytics or tracking cookies, so there is nothing to opt out of.

Do Not Track. Some browsers send a “Do Not Track” signal. Because we don’t track you across other websites and don’t allow third parties to collect information about your activity on our Service across websites or over time, the Service works the same whether or not the signal is sent. (Listing images and one script load from other servers, which receive your IP address when your browser fetches them — see section 6.)

8. Emails

• Alert emails tell you about new matches. Every one has a “Stop alert emails” link, and you can turn them off or on from your dashboard at any time. Turning them off doesn’t cancel your subscription.
• Service emails — purchase-link confirmations you ask for, billing notices, and important changes to the Service or our terms — are sent even if alert emails are off, because they are needed to run your account.
• We don’t send marketing email unless you have agreed to it, and any we send will include a way to unsubscribe.

9. How long we keep it

• Matches (the listings your monitors found) are kept according to your plan: Lite — 30 days; Starter — 90 days; Pro — 365 days; Power — for as long as your account exists. Older matches are deleted once the listing has also been gone from the marketplace for 30 days.
• Your pipeline — listings you save, mark as bought or mark as sold, with the prices you entered — is kept for as long as your account exists.
• Marketplace listings that no customer’s monitor matched, or whose matches have been deleted, are deleted 30 days after they were last seen on the marketplace.
• Waitlist addresses are kept until we have told you FlipSift is open, or until you ask us to remove yours by emailing flipsift@gmail.com.
• Sessions expire after 14 days, or 7 days without use, and their records are deleted a day after that.
• Server logs are capped in size and overwritten as new ones are written, normally within a few weeks.
• Purchase-link confirmations expire after 30 minutes, and pending Google sign-ins after 15; their records are deleted a day after that.
• Records of your agreement to our terms and to a subscription’s renewal terms are kept for at least three years, even after your account is deleted, because the law requires us to be able to show that you agreed.
• Billing records (your membership, plan, payment amounts and dates) are kept for at least seven years, for tax and accounting, even after your account is deleted; free-trial records (card fingerprints) for as long as we offer trials.
• Usage records of AI identifications are kept for 180 days; stored sold-price lookups hold product names and prices only, not information about you.
• Backups of our database are kept for 14 days and then deleted, so deleted data leaves our backups within that time.
• Your account. If you ask us to delete your account, we delete your account details, monitors, pipeline and integrations within 30 days, apart from anything we must keep by law (for example billing records for tax purposes). If your subscription simply ends, we keep your account so you can come back, and delete it on request.

10. Security

We protect your information with measures including encrypted connections (HTTPS), sign-in through Google, hashed session tokens and API keys, access controls that keep each account’s data separate, protection against cross-site request forgery, and a database that isn’t exposed to the internet. No system is perfectly secure, though. If we become aware of a breach that affects your personal information, we’ll notify you and the authorities where the law requires.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct it if it is wrong;
• delete it;
• export it in a portable format — your dashboard has a CSV export of your matches and pipeline on plans that include it, and we’ll provide a copy on request;
• object to or restrict some processing, including processing based on legitimate interests; and
• withdraw consent where we rely on it.

To use any of these rights, email flipsift@gmail.com from the address on your account; we confirm it’s you by replying to that address. We respond within 30 days, and in any case within the time the law where you live allows (for US state laws, 45 days), and we won’t treat you differently for using your rights. Someone you authorize can make a request for you; we’ll ask them for your signed permission and may check with you directly. If we refuse a request, we’ll say why, and you can appeal by replying to that email; we answer appeals within 45 days. If you are in the UK or EU, you can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office), though we’d appreciate the chance to help first.

12. US state privacy rights

If you live in a US state with a consumer privacy law (such as California), you have the rights in section 11 as those laws provide them, and the right to know the categories of information we collect and why (set out in sections 2 and 4). We do not sell personal information and do not share it for cross-context behavioral advertising, and we don’t use or disclose sensitive personal information for purposes that would require an opt-out. An authorized agent may make a request for you with proof of authorization.

Nevada residents: we don’t sell covered information as Nevada law (NRS 603A) defines it. You can send a request about it to our designated address, flipsift@gmail.com.

13. Where your information is

FlipSift is offered to users in the United States, and your information is stored and processed in the United States. Some of our service providers may process it elsewhere; where the law requires, we use appropriate safeguards for those transfers.

14. Children

The Service is for adults aged 18 and over, and is not directed to children. We don’t knowingly collect personal information from anyone under 18 (or under 13, as the US Children’s Online Privacy Protection Act addresses). If you believe a child has given us information, email flipsift@gmail.com and we’ll delete it.

15. Changes to this policy

We may update this policy. We’ll change the effective date above, and for material changes we’ll email you before they take effect and ask you to agree again when you next sign in. We won’t apply a material change to information we already hold without telling you first.

16. Contact

Privacy questions and requests: flipsift@gmail.com.