Privacy Policy

1. Notice at collection

We collect the categories of personal information described below. Not every category applies to every person. For example, we collect seller verification and payout information only if you become a seller.

Account and identifiers

This includes your email address, internal user ID, username, authentication provider ID, profile photo, bio, city and state, account status, and authentication or session records. We use it to create and secure accounts, sign you in, display profiles, prevent abuse, and provide support. We may disclose it to cloud hosting, database, authentication, security, and support providers, and to Apple or Google when you choose their sign-in service.

Contact and address information

This includes recipient or sender name, U.S. street address, city, state, postal code, phone number, saved-address label, and address-verification status. We use it to calculate shipping and tax, create labels, deliver and return packages, prevent fraud, and resolve support claims. We may disclose it to transaction counterparties as needed, Stripe, Shippo, USPS or another carrier, Google Places when used, and support providers.

Commercial and transaction information

This includes listings, prices, favorites and bag contents, purchases and sales, fees, taxes, payment and payout status, order history, shipping quotes, tracking events, returns, refunds, disputes, support claims, and seller reviews. We use it to operate the marketplace, process orders, provide buyer protection and support, maintain accounting records, prevent fraud, and enforce our rules. We may disclose it to buyers or sellers involved in an order, Stripe, Shippo, carriers, hosting and email providers, and professional advisers.

Payment, payout, tax, and seller-verification information

This includes Stripe customer and connected-account identifiers, payment status, limited payment details, bank name and last four digits, payout balances and history, verification status, and requirements. Stripe may collect legal name, birth date, tax ID, government ID, business details, and full bank information in its embedded interfaces. We use this information to process charges, refunds, taxes, seller verification, bank setup, payouts, and chargebacks and to meet financial and legal obligations. We may disclose it to Stripe and its financial partners and to authorities or advisers where required. FlippyDisc receives limited status and account details from Stripe, not full card or bank account numbers.

Content and visual information

This includes profile images, listing photographs and descriptions, evidence you send to support, reviews, ratings, report details, and other content you submit. We use it to publish listings and profiles, document support claims, moderate content, respond to reports, and operate and promote the marketplace. Depending on the content, we may disclose it to other users, storage and hosting providers, transaction participants, and support or moderation personnel.

Communications

This includes transactional emails, notification history, support requests, privacy requests, and our responses. We use it to authenticate users, provide order and seller updates, respond to requests, and keep necessary records. We may disclose it to Supabase, Resend or other email delivery providers, hosting providers, and support personnel.

Internet, device, and security information

This includes IP address, browser or app and operating-system details, device and request identifiers, timestamps, deep-link activity, crash or error information, security events, and server logs. We use it to deliver and troubleshoot the Services, maintain security, detect fraud or abuse, measure reliability, and enforce rate limits. We may disclose it to Supabase, Vercel, network, security, and infrastructure providers and to authorities when required for safety or law.

General location information

This includes city and state associated with a profile or listing and locations in addresses or carrier tracking events. We use it to show a listing’s general area, calculate shipping and tax, track packages, and prevent fraud. We may disclose it to other users for city or state displays and to Stripe, Shippo, Google Places, carriers, and infrastructure providers for transactions.

We do not request device GPS location, contacts, microphone access, health data, or advertising identifiers. The app requests camera or photo-library access only when you choose to create a profile image or listing photo. You can instead choose an existing photo or decline the permission, though the related image feature may then be unavailable.

Some information above may be considered “sensitive personal information” under certain laws, including account credentials, financial information, government identifiers, and exact transaction addresses. We use sensitive information only to provide requested marketplace services, secure accounts, process payments and payouts, prevent fraud, and meet legal obligations—not to infer characteristics or deliver advertising.

2. Where information comes from

We collect personal information from:

• You, when you create an account or profile, save an address, publish a listing, buy or sell, upload a photo, write a review, report content, submit a buyer-protection claim to support, complete seller setup, or contact us.
• Your device and use of the Services, through necessary app storage, network requests, logs, security tools, and similar operational technologies.
• Service providers, including Stripe for payment, tax, seller-verification and payout status; Shippo and carriers for quotes and tracking; Google Places for address results you request; Apple or Google for authentication you choose; and email or hosting providers for delivery and security events.
• Other marketplace users, such as when a buyer or seller participates in your transaction, submits a review, or reports an order, listing, or account.
• Authorities and fraud-prevention sources where permitted or required by law.

3. Stripe payment and seller data

Payments, seller identity verification, bank connection, and payouts are provided through Stripe. Card and wallet credentials are submitted through Stripe’s payment interfaces. Seller identity, tax, government-ID, and bank details are submitted through Stripe’s embedded Connect components. Stripe processes this information under its own terms and privacy notice.

FlippyDisc receives the identifiers, statuses, requirements, balances, payout history, bank name and last four digits, and other limited information needed to operate the marketplace. We do not store full payment-card numbers, bank account numbers, government-ID images, or full Social Security numbers in our application database. Stripe may provide or make limited verification information available to us where needed for support, fraud prevention, or legal compliance.

4. Public and transaction-participant information

Your username, profile photo, bio, city/state, active listings, listing photos and descriptions, seller rating, and published reviews may be visible to other users or visitors. Do not include a street address, phone number, payment information, or other sensitive information in public text or images.

We disclose order information between the buyer and seller only as reasonably needed to complete or support the transaction. For example, a shipping or return label necessarily includes names and addresses. Listing and review records may remain in an anonymized form after an account is deleted when needed to preserve transaction integrity.

5. How we use personal information

• Provide, personalize, maintain, and improve the Services.
• Create accounts, authenticate users, and secure sessions.
• Publish profiles, listings, photographs, and eligible buyer reviews.
• Calculate totals, marketplace fees, shipping, and applicable taxes.
• Process payments, refunds, seller verification, transfers, and payouts.
• Create outbound shipping labels, provide carrier tracking, and manually coordinate return instructions or labels through support.
• Manually review buyer-protection claims submitted through support, returns, disputes, and chargebacks.
• Send authentication, order, delivery, seller-verification, security, and support communications.
• Detect and prevent fraud, account abuse, prohibited listings, security incidents, and violations of our Terms.
• Debug, audit, analyze reliability, and protect the integrity of the Services.
• Comply with tax, accounting, payment-network, legal, and regulatory requirements and enforce our agreements.

We do not use your personal information for third-party targeted advertising or train third-party advertising profiles. We may use aggregated or deidentified information that cannot reasonably be linked to you and will not attempt to reidentify it except to test whether deidentification is effective.

6. How we disclose personal information

We may disclose personal information to the following categories of recipients:

• Marketplace participants. Buyers, sellers, reviewers, and other users as described above and as needed to complete transactions.
• Payment and financial providers. Stripe, payment networks, banks, wallet providers, tax services, and fraud-prevention partners.
• Shipping and address providers. Shippo, USPS or other carriers, and Google Places when you request address assistance.
• Technology and communications providers. Supabase for database, authentication, functions, and storage; Vercel for website hosting; Resend and configured mail providers for transactional email; and security, networking, and support vendors.
• Authentication and platform providers. Apple or Google when you choose their sign-in service, and Apple or Google in connection with distributing the app.
• Professional advisers. Lawyers, accountants, auditors, insurers, and consultants subject to appropriate confidentiality obligations.
• Legal, safety, and integrity recipients. Courts, regulators, law enforcement, rights holders, or other parties when we reasonably believe disclosure is required by law or needed to protect people, rights, property, payments, or the Services.
• Business transaction recipients. A potential or actual buyer, investor, lender, or successor in connection with a merger, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate safeguards.

We require service providers that process personal information for us to use it only for authorized purposes and to protect it consistently with this Policy and applicable law.

No sale, sharing, or targeted advertising

We do not sell personal information for money or other valuable consideration. We do not “share” personal information for cross-context behavioral advertising, and we do not process personal information for targeted advertising as those terms are defined by applicable U.S. state privacy laws. We have not done so in the preceding 12 months. We also do not knowingly sell or share personal information of anyone under 16.

7. App storage, cookies, and analytics

The native app uses encrypted device storage where available for authentication sessions and device storage for environment preferences and account-scoped bag contents. The web version may use local browser storage for the same necessary functions. Our website and authentication pages may use essential cookies or similar request mechanisms supplied by hosting and security providers. We do not currently use advertising cookies, third-party ad SDKs, or cross-site behavioral analytics.

Browser “Do Not Track” signals are not governed by a single standard. Because we do not sell or share data for targeted advertising, there is no advertising opt-out to apply. Where applicable law requires recognition of a universal opt-out signal such as Global Privacy Control, we treat it as a request to opt out of sale, sharing, or targeted advertising; our practices are already set to no sale, no sharing, and no targeted advertising.

8. Retention and deletion

We keep each category only for as long as reasonably necessary for the purposes described in this Policy. We consider the account or transaction lifecycle, the sensitivity of the information, fraud and security risks, applicable limitation periods, and tax, accounting, payment-network, dispute, and legal obligations.

Account and profile records are kept for the life of the account. A request submitted in the app is queued for manual review, signs the requester out, and is normally completed within 30 days. An administrator reviews outstanding orders, refunds, payouts, claims, and legal-retention requirements before deleting authentication access and removing or anonymizing public profile information.

Listings and uploaded images are kept while needed to publish or administer the listing. When a manual account deletion is completed, active listings are removed and listing and avatar image files associated with the account are deleted, subject to security backups and legal preservation.

Order, payment, tax, shipping, payout, refund, and dispute recordsare kept for the transaction lifecycle and afterward for the period reasonably needed for tax, accounting, payment disputes, fraud prevention, legal claims, and regulatory duties. Our baseline for core financial records is generally seven years after the transaction closes, unless a longer or shorter period is required.

Reviews, reports, moderation, and support records are kept while the account or content is active and afterward as needed to preserve marketplace integrity, document decisions, prevent repeat abuse, resolve claims, or comply with law. Public attribution is anonymized where appropriate after deletion.

Security and technical logs are kept for the shortest period reasonably necessary to operate, troubleshoot, secure, and audit the Services. Exact periods vary with the log’s purpose, risk, and provider configuration.

Deletion from active systems may not immediately remove information from encrypted backups. Backup copies are isolated from ordinary use and removed or overwritten on the normal backup cycle. We may preserve specific records longer when required by law, court order, an active dispute, fraud investigation, or a legal hold.

For step-by-step instructions, see our Account Deletion page.

9. Security

We use administrative, technical, and physical safeguards designed for the nature of the information we handle. These include access controls, row-level database security, private storage with time-limited access links, encrypted transport, device secure storage for native sessions, short-lived email verification codes for sensitive bank-account changes, provider key separation, audit records, and payment interfaces that avoid storing full card and bank numbers in our database. No system is completely secure, so we cannot guarantee absolute security.

Protect your device and email account, do not share authentication links or codes, and contact us immediately at support@flippydisc.app if you believe your account or personal information has been compromised.

10. Your choices and privacy rights

Account controls

• Update available profile and address information in the app.
• Remove profile or listing images using the related app controls where available.
• Decline camera or photo-library permission in device settings.
• Sign out to remove the active session from the app.
• Request account deletion under Settings → Account management → Delete account. Requests are reviewed manually and normally completed within 30 days.

U.S. state privacy rights

Depending on where you live and whether the relevant law applies to FlippyDisc, you may have the right to confirm whether we process your personal information; access, correct, delete, or obtain a portable copy of it; opt out of sale, targeted advertising, sharing, or certain profiling; limit certain uses of sensitive information; withdraw consent; and appeal a denied request. We will not discriminate against you for exercising a privacy right.

Submit a request by emailing support@flippydisc.app from the address associated with your account and describe the right you want to exercise. We may ask for information reasonably necessary to verify your identity and authority. If we deny a request, reply with “Privacy Appeal” in the subject line and explain why you believe the decision should be reconsidered.

An authorized agent may submit a request where allowed by law. We may require proof of the agent’s authority and may ask you to verify your identity directly. We respond within the period required by applicable law. Certain information may be exempt—for example, records needed to complete a transaction, detect fraud, comply with law, protect legal rights, or exercise another person’s rights.

11. Additional U.S. state notices

California

The categories listed in Section 1 correspond to California categories of identifiers; customer records; commercial information; internet or other electronic activity; general geolocation data; audio, electronic, visual, or similar information; professional or employment-related information where a seller provides business details; and sensitive personal information. We do not intentionally create profiles that infer sensitive characteristics.

During the preceding 12 months, we collected and disclosed these categories for the business purposes and to the recipient categories described in Sections 1, 5, and 6. We did not sell or share them for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a “Limit the Use of My Sensitive Personal Information” link. We do not offer a financial incentive or price difference in exchange for personal information.

California residents may request the categories or specific pieces of personal information we collected, sources, purposes, recipient categories, correction, or deletion, subject to legal exceptions. California’s “Shine the Light” law also permits certain requests about disclosure for third parties’ direct marketing; we do not make those disclosures.

Colorado and other comprehensive state laws

Residents of Colorado and other states with applicable comprehensive privacy laws may exercise the access, correction, deletion, portability, opt-out, consent, and appeal rights described in Section 10. FlippyDisc does not currently sell personal data, use it for targeted advertising, or use it to make decisions that produce legal or similarly significant effects through profiling.

12. Children

The Services are for adults and are not directed to children. You must be at least 18 years old and able to enter a binding contract to create an account, buy, or sell. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate.

13. Third-party services and U.S. processing

The Services may link to or integrate services operated by Stripe, Apple, Google, USPS, and others. Their own privacy notices govern information they collect for their independent purposes. FlippyDisc is currently offered only for U.S. marketplace transactions, and information is processed and stored in the United States or other locations used by our providers, subject to applicable safeguards.

14. Changes to this Policy

We may update this Policy as the Services, providers, or law changes. We will post the revised version here and update the date above. If a change materially affects how we use information already collected, we will provide additional notice or seek consent when required by law.

15. Contact us

FlippyDisc is the controller or business responsible for the personal information described in this Policy. For privacy questions, rights requests, accessibility help, or an alternative-format copy, email support@flippydisc.app.