Privacy Policy

This Privacy Policy explains what Instant Flipper ("we", "us") collects, how we use it, and who we share it with. By using the Service you agree to this policy. See also our Terms of Service.

1. What we collect

• Account information. Email address, display name (if provided), authentication identifiers from Google when you sign in with Google.
• Uploaded content. Photos and short videos of items you scan, along with descriptions, notes, and flip project data (status, costs, sale price, timeline).
• AI-derived data. Analysis outputs generated from your uploads (identifications, flip directions, condition notes, rendered images, listing drafts).
• Usage events. Feature usage, page views, and product events used to improve the Service.
• Device identifiers. For anonymous trial sessions we store a locally generated device identifier to associate scans with your browser until you sign up.
• Payment data. Payment card information is collected and processed directly by Stripe. We receive limited metadata such as your customer ID, purchase amount, currency, timestamp, and last four digits of the card. We never store full card numbers.
• Technical logs. IP address, browser and device type, timestamps, and error logs.

2. How we use it

• To provide, operate, and improve the Service.
• To run AI analyses on your uploads via third-party AI providers.
• To send transactional email (receipts, security notifications, important account or service messages).
• To enforce usage quotas, prevent abuse, and secure the Service.
• To comply with legal obligations.

We do not sell your personal information. We do not use Your Content to train third-party foundation models beyond what is required to process a specific request; we rely on providers' non-training or zero-retention configurations where available.

3. Third-party processors

We use these processors to operate the Service:

• Supabase — authentication, database, and file storage.
• Stripe — payment processing and subscription / one-time purchase management.
• Resend — transactional email delivery.
• AI model providers via the Lovable AI gateway (which routes to providers such as Google and OpenAI) — image analysis, text generation, and rendering.
• eBay Browse API — public marketplace listing data used to compute value ranges. We send anonymized queries derived from your item identification; we do not send your uploaded photos.
• Meta Pixel — advertising and conversion analytics on our marketing pages.
• Hosting infrastructure — Lovable / Cloudflare edge runtime.

4. Cookies and local storage

• We use cookies and browser localStorage to keep you signed in, remember your preferences, cache scan data offline, and maintain anonymous trial sessions.
• Meta Pixel uses cookies for advertising and conversion tracking on our public marketing pages. You can disable third-party cookies in your browser or use a tracker-blocking extension.

5. Data retention

• Account data and Your Content are retained while your account is active.
• When you delete a flip or photo, we remove it from active storage; backups may retain copies for up to 30 days.
• Purchase and receipt records are retained as required by tax and accounting laws (typically 7 years).
• Anonymous trial scans that are not claimed by a signed-up account may be purged after 90 days.

6. Your rights

You have the right to access, correct, export, or delete your personal information. To exercise these rights, email support@instantflipper.com from the address on your account. We will respond within a reasonable time (and within any period required by applicable law).

If you are in the EEA, UK, or a US state with a comprehensive privacy law (e.g., California, Colorado, Virginia), you may have additional rights, including the right to object to processing or to lodge a complaint with your local supervisory authority.

7. Security

We use industry-standard measures including TLS in transit, encryption at rest for stored files, row-level access controls in the database, and least-privilege access for staff. No system is perfectly secure; you use the Service at your own risk.

8. Children

Instant Flipper is not directed to children under 13 (or 16 in the EEA/UK). We do not knowingly collect information from children.

9. International transfers

We and our processors are based in the United States and may transfer, store, and process your information in the US and other countries with different data protection laws.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date and, where appropriate, by email or in-app notice.

11. Contact

Privacy questions? Email support@instantflipper.com.