Privacy policy

Written against flipper v6.2.33. It describes what the extension actually does; when the code changes, this changes with it.

Last updated: 24 October 2026 (the shared price pool section now describes how it will work when it is switched on: which account a row is tied to, that only a pooled figure from at least three different people is ever given back, and how to ask for your rows to be deleted. The pool is still not running and nothing has ever been sent from it.) Earlier: 12 October 2026, later the same day (synced scans carry the sold listings sidekick read, for the extension's prices; flipper sidekick, the flipper phone app, in testing, and end-to-end encrypted phone sync, from extension v6.2.25; stock on your phone, from extension v6.2.26)

The short version

• flipper runs in your browser. Everything it learns - prices, deals, drafts, photos, settings - is stored on your own computer, in the browser's extension storage. The one exception is optional: an encrypted copy of your stock for the phone app, described below.
• Signing in to a flipper account is optional. If you sign in, we hold your email address and an account ID, and flipper checks your sign-in with our server about once a day. Our server never receives anything about listings, prices, deals or what you browse.
• If you use flipper sidekick, the flipper phone app, and turn on sync, the scans you save on your phone are stored on our server so your extension can show them. They are encrypted on your phone first, with a sync code only your own devices hold, so our server cannot read them. If you also switch on "Show my stock on my phone" in the extension, a slim copy of your Bought and Listed deals is sent the same encrypted way, so the phone can show what you own.
• About once a week flipper downloads a list of manual and support links from gear-flipper.com. Nothing about you, your listings or your deals is sent with it.
• Apart from that, data leaves your browser in exactly two cases, both optional and both switched on by you: when you use AI features (photo inspection or reading a guitar's serial) with your own AI key, and when you use live eBay price lookups with your own eBay keys. In each case it goes directly from your browser to that provider, not through us.
• There are no analytics, no tracking, no advertising and no sale of data.
• If you join the tester list on gear-flipper.com, we hold your email address to send you an invite and, at most, one launch message, plus occasional updates only if you tick the box and confirm from the email we send. This website sets no cookies and runs no analytics. It only counts, per day, how many visits arrive through our tagged links, as a plain number.

Who we are

flipper is made by a sole trader based in the United Kingdom. Contact: support@gear-flipper.com. Our full registered details are given on request, and to any regulator or court that asks for them.

For the purposes of UK data protection law, we are the data controller for the account details described under "Your flipper account" below. We do not act as a data controller for what flipper stores on your device, because it is not sent to us. Where you choose to send data to an AI provider or to eBay, that provider handles it under its own terms and privacy policy.

What flipper reads

flipper only reads pages you open yourself. It never opens, navigates, searches, scrolls through or refreshes pages on its own, with one exception you start deliberately: Scan whole page scrolls the Facebook Marketplace search page you are on so that Facebook loads more listings, and stops when you press Stop, when the page ends or after about 80 screens.

On those pages it reads what is already displayed:

flipper does not read your messages, your profile, your friends, your browsing history or any page outside Facebook, eBay UK and eBay Seller Hub.

What flipper stores on your computer

All of this is kept in the browser's extension storage (chrome.storage.local) on your device only:

• Learned prices: asking and sold prices seen on pages you opened, grouped by model, with the date where known, and any price range you verify yourself.
• Deals you track: title, link, asking price, the listing's description and cover-photo address, the status you set, any notes you write, and what you paid, spent on repair and sold for, with dates.
• Files you attach to a deal: receipts, photos, PDFs or text files you add to a tracked deal (up to 8 MB each).
• Guitar serials: serial numbers you type in or that flipper reads from a listing's photos, and what they decode to.
• Listing drafts and photos: titles, prices, descriptions and conditions you write in the Sell pane, and photos you add (shrunk to 1600 pixels).
• Recent scans: the last 50 listings you opened, with their assessment.
• Seen listings: which listings you have opened and when, so they can be marked as seen, and the price each had when you last opened it, so flipper can tell you if it has dropped.
• Price reports: when you use "Price looks wrong?", a copy of what you reported. The report itself only goes anywhere if you send the email it opens.
• Phone scans (only if you turn on phone sync): your sync code, the scans downloaded from flipper sidekick, opened (decrypted) on your computer so you can see them, and, if stock on your phone is on, a list of which stock copies were sent.
• Settings, including any AI or eBay keys you enter.
• Housekeeping: tutorial progress, a week's cache of eBay lookups, your daily eBay lookup count, sold eBay listings it could not yet identify, the list of manual and support links and when it was last refreshed, where you put flipper's panels, and counts of pages it could or could not read (used to warn you if Facebook or eBay change their layout).

None of it is sent anywhere, except as described under "What leaves your browser" below. Removing the extension deletes all of it.

Backups. The backup button in the popup saves a copy of your data to a file in your Downloads folder. Your AI and eBay keys, your sign-in, your phone-sync code, your listing photos and some temporary data are deliberately left out of backups. Files you attached to deals are included, so treat a backup file as private.

Your flipper account (optional)

flipper works without an account. If you choose to sign in:

• What we hold: your email address, an account ID, your plan and the dates the account was created and last checked in. Sign-in links work for 15 minutes and codes for 10. Both are deleted a day after they expire, and links are only ever stored in a scrambled (hashed) form. To stop abuse, we also keep a short-lived record of sign-in attempts per IP address, deleted after an hour.
• What is sent: to sign in, your email address, plus a random request ID that ties the sign-in to your browser. The link we email you opens a page on our server; pressing its button shows a code, which you type in. About once a day, flipper sends its sign-in token (which contains only your account ID, plan and dates) to renew it.
• What is never sent: listings, titles, prices, photos, your deals, your drafts or what you browse.
• Where: our service runs on Cloudflare (Workers and D1). Sign-in emails are sent through Resend. Both process this data on our behalf.
• Why: to provide the account (the lawful basis is performance of our agreement with you).
• How long: until you ask us to delete your account. Signing out removes the sign-in from your browser but leaves your account; to delete it, email support@gear-flipper.com.
• Your rights: you can ask for a copy of, correction of, or deletion of your account data, and you can complain to the Information Commissioner's Office (ico.org.uk).

Signing out, or an account lapsing, never deletes anything stored on your computer.

flipper sidekick: the phone app and sync (optional, in testing)

flipper sidekick, the flipper phone app, prices items you find in person, for example at a car boot sale. It works without an account, and everything it saves stays on your phone unless you turn on phone sync.

Phone sync

If you sign in on both flipper sidekick and the extension and turn on sync:

• End-to-end encrypted: each scan is encrypted on your phone before it leaves, with a 20-character sync code made on one of your devices and typed into the other. The code never leaves your devices. Our server stores scans only in that encrypted form and cannot read them: not the item, the prices, the photo thumbnail or what you decided.
• What a scan contains: the item, the asking price, the verdict, what you decided and paid, a small photo thumbnail, and the eBay sold listings flipper sidekick read for it (each one's title, price and sale date). The extension adds those sales to the sold prices it keeps on your computer, exactly as it does when you look at a sold search on eBay yourself. All of it is inside the encryption.
• What we hold: your encrypted scans (and encrypted stock copies, if you switch stock on), a fingerprint of your sync code (which lets a device check the code it was given, and cannot be turned back into the code), and for each scan an ID, when it was last changed and whether it was deleted. From these we can see how many scans you have and when they changed, but not what they are.
• What is sent: your sign-in token, the encrypted scans, and the code's fingerprint when you pair a device. The extension mostly downloads: it sends the code's fingerprint when you pair it; when you delete a scan in the extension, that scan's ID and a note that it was deleted; and, only if you switch on stock on your phone, the encrypted stock copies described below. Nothing about your listings or browsing is ever sent, and nothing about your deals unless you switch stock on.
• Deleting: deleting a scan on either device removes it from our server, leaving only its ID and a note that it was deleted, so your other device can remove it too. Starting sync again with a new code deletes every stored scan. Turning sync off stops it on that device; to remove everything, email support@gear-flipper.com and we will delete your stored scans with your account.
• Where, why and how long: the same Cloudflare service as your account, to provide the feature you turned on (performance of our agreement with you), kept until you delete the scans or your account. Up to 3,000 scans per account, with stock copies counted in that.
• Stock on your phone (optional, off by default): if you switch on "Show my stock on my phone" in the extension, each deal you have marked Bought or Listed is sealed with the same sync code and sent, so flipper sidekick can show it. What goes: the title, the cover photo thumbnail, the status, what you paid, repair costs, your list price, the likely resale, the asking price, the dates you tracked and bought it, where it came from (Facebook, eBay or in person) and, for a commission item, the owner's name you entered. What never goes: descriptions, notes, attachments, listing links, or deals you are only watching or have passed on or sold. A copy is sent again only when the deal changes, and removed when it leaves stock. Switching it off removes every copy from our server and, at its next sync, from your phone. The phone only shows stock; it never changes it.
• Keep the code private: anyone with your sync code and access to your signed-in account could read your scans.

What flipper sidekick sends, and to whom

• eBay sold listings: when you check a price, the app opens eBay's public sold listings for the item in a browser inside the app and reads the sales on screen. It always does this signed out: it clears the in-app browser's cookies before every check, so price checks are never linked to your eBay account. eBay sees an ordinary visit to its website, and eBay's privacy policy applies. The app limits itself to one check every 20 seconds and 30 an hour.
• AI photo identification (optional): if you add your own AI key (Google Gemini, Anthropic or OpenRouter) and identify an item from photos, the app sends that provider the photos you took, reduced in size, directly from your phone using your key. The key is stored only on your phone.
• Camera and photos: used only when you tap Take photo or Choose photo. Photos stay on your phone, apart from the AI identification above and, with phone sync on, a small encrypted thumbnail.
• Nothing else: no analytics, no tracking and no advertising.

What leaves your browser, and only if you choose

AI photo inspection (optional)

If you add your own API key for an AI provider (Google Gemini, Anthropic or OpenRouter, whichever you choose) and run a photo inspection, flipper sends that provider:

• the listing's photos (fetched from Facebook's image servers and reduced in size),
• the listing's title, description and asking price,
• flipper's own first read of the listing: its model guess, estimated range, and any faults and warning signs it spotted.

It goes directly from your browser to the provider using your key. flipper never includes prices it learned from eBay in what it sends.

If you ask flipper to read a guitar's serial number from the photos, it sends the same provider the listing's photos and title, with your key, and nothing else. The provider's own privacy policy applies to that data, and some providers may use API traffic to improve their services depending on your plan with them.

Live eBay lookups (optional)

If you add your own eBay developer keys and press "Check live listing prices", flipper sends eBay's official Browse API a search for the model (for example "Korg Minilogue XD"). It goes directly to eBay using your keys. eBay's privacy policy applies.

The manual and support link list (automatic)

About once a week, flipper downloads a list of manual and support links (links only, no manuals) from gear-flipper.com, so the Research tab's links stay current. The request carries nothing about you, your listings or your deals and sets no cookies. Like any web request it reaches our host, Cloudflare, with your IP address; we don't store it.

Nothing else

No other data leaves your browser. The extension contacts our server only for the account described above, phone sync if you turn it on, and the link list, does not use analytics or crash reporting, and loads no remote code. The link list is data, never code.

The tester list and this website

What we store when you join

If you enter your email address in the "Join the testers" form on gear-flipper.com, we store:

• your email address and the date you joined,
• which form you used,
• the country your sign-up came from, as our host Cloudflare sees it (we don't store your IP address),
• the link tag of the page you joined from, if it had one (for example ?ref=beta),
• whether you ticked "Also email me occasional flipper updates".

What we email you

• Everyone in the UK: a confirmation when you join, your tester invite, and at most one message when flipper becomes publicly available.
• Outside the UK: no tester invite, because flipper doesn't work there yet. We email you once when it works in your country, and use the country counts to decide where it goes next.
• Updates, only if you ticked the box: the confirmation email has a button to confirm it was you. Only once you press it do we send occasional news about flipper, starting with two short tips in your first week. The box is unticked unless you tick it. Stop these emails any time with the one-click link in each one, by replying, or by emailing support@gear-flipper.com.

Invite-a-friend links

• If you join from the UK, your welcome email includes your own invite link.
• When someone joins through it, we record which link they used, so people who bring friends can be invited sooner.
• That record is used only to order invites. Nobody is told who invited whom, and it is never shared or sold.

Keeping and removing it

• Lawful basis: your consent.
• How long: until you ask us to remove it, or until private testing ends and the launch message has been sent, whichever comes first. If you confirmed updates, until you ask us to stop.
• Removal: email support@gear-flipper.com.
• Where: the same Cloudflare D1 database as accounts.
• Abuse protection: a short-lived record of sign-up attempts per IP address, deleted after an hour, and one place on the list per inbox.

This website

• No cookies, and no analytics, advertising or third-party scripts.
• It may remember whether you chose the light or dark theme, in your own browser.
• Tagged links: when someone opens a link with a tag (such as gear-flipper.com/?ref=beta, so we can see which post people came from), we add one to a count for that tag and that day. The count is only a number: no IP address, cookie, browser detail or anything else about the visit is stored with it.
• Friends' invite links: if you open one (?r=), your browser remembers its code until you close the tab, so it still counts if you sign up from another page.
• Server logs: like any website, our host Cloudflare processes the technical details of each request (IP address, browser type, the page asked for) to deliver the page and protect it from abuse. We use those logs only to keep the service running and secure.

Sharing your deal outcomes (not switched on yet)

Settings has an option, off by default, to contribute to a shared flipper price pool. The option is there now; the pool is not, and nothing has ever been sent from it. Switching the option on sends nothing: the entries it would share are only prepared and kept on your computer, so you can look at exactly what they contain before anything is ever transmitted. The server that would receive them is written and waiting to be deployed. It has never run.

Only rows like this would ever be shared:

• the model, edition and category,
• what you paid, spent on repair and sold for,
• where it sold (eBay or Facebook) and the month,
• the rough condition flipper judged when you tracked it (faulty, worn, used, like new or new),
• whether you repaired it, sold it in working order or sold it with extras,
• flipper's own estimate at the time, but only when it came from flipper's built-in table,
• or, separately, a price range you verified yourself.

Never shared: listing links, listing text, names, photos, exact dates, or any price flipper read from eBay or Facebook. The "See exactly what would be sent" button shows every field of every row.

How it works when it runs, so there are no surprises:

• Your rows are tied to your flipper account number, not to your email address or your name. Sending needs you signed in, and so does reading the pool.
• Nobody ever sees your individual rows. The only thing the pool gives back is a pooled figure for a model and its edition: a median and a low-to-high band, cut so that far-out values don't drag it. That figure appears only once at least three different people have contributed at least three records between them, so one person's deals can never stand as a figure of their own.
• An account can contribute at most 400 records, in small batches, and the rows sent are the same rows the preview shows you, field by field.
• Vague rows are refused twice: a brand-wide or catch-all entry ("Boss RC looper (other)") is dropped on the way out of your browser and refused again by the server.
• Getting your rows out: email support@gear-flipper.com and we delete them. There is no delete button in the app yet, which is one of the things to finish before the pool is switched on.

This policy will be updated again before anything starts being sent.

Permissions flipper asks for

Your choices

• Switch off price recording from eBay, photo inspection, grid badges, tutorial mode, reading your own sales pages and automatic sale recording in Settings.
• Delete individual prices from any model's price breakdown, clear all learned prices from the popup, or delete deals and drafts.
• Remove the extension to delete everything flipper has stored.
• Sign out at any time in Settings; ask us to delete your account by email.
• Turn phone sync off, delete scans from your phone, or switch stock on your phone on or off, under Account, flipper sidekick, in the extension.

Chrome Web Store User Data Policy

flipper's use of information received from web pages complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide flipper's features to you, is not transferred to anyone except the AI provider or eBay when you ask for those features, is not used for advertising, and is not used to determine creditworthiness or for lending purposes.

Children

flipper is not directed at children under 13 and does not knowingly process their data.

Changes to this policy

If flipper's handling of data changes - in particular before any shared price pool goes live - this policy will be updated first, the change will be described in the extension, and the "last updated" date above will change.

Contact

Questions about privacy: support@gear-flipper.com.