Privacy Policy — FlipFlow

Last updated: February 2026

FlipFlow is a Chrome extension developed by VintageLab ("we", "us", "our"). This privacy policy explains what data FlipFlow accesses, how it is used, and how it is stored. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and the Chrome Web Store Developer Program Policies.

This policy applies exclusively to the FlipFlow Chrome extension. For our website and Discord bot privacy policy, see Datenschutzerklärung.

1. What Data We Access

FlipFlow accesses the following data solely to provide its core functionality:

a) Marketplace Listing Data

When you are logged into Vinted, the extension reads your wardrobe listings, item details, prices, and photos via Vinted's API. This data is used to display your listings in the FlipFlow dashboard, enable bumping, and facilitate cross-listing to other platforms (eBay, Depop, Kleinanzeigen).

b) Session Cookies

FlipFlow reads Vinted session cookies (such as anonymous identifiers and CSRF tokens) to authenticate API requests on your behalf. These cookies are used exclusively within your browser to communicate with Vinted. Cookies are never sent to any external server.

c) Locally Stored Data

The extension uses Chrome's local storage and IndexedDB to store: user preferences (theme, settings), listing drafts, wardrobe cache, sales history, cost and profit data, and operation history. All of this data stays 100% on your device and is never transmitted anywhere.

d) License Key

To verify your subscription, FlipFlow sends your license key string to our API at vintagelab.org. Only the license key is transmitted — no personal data, browsing history, listing data, or any other user content is sent with it.

e) Debugger Permission

FlipFlow uses Chrome's debugger permission solely to intercept network requests for downloading listing photos during cross-listing (e.g., downloading images from Vinted to re-upload on another platform). This permission is not used for any tracking, monitoring, or data collection purpose.

2. How We Use Your Data

All data accessed by FlipFlow is used exclusively to provide the extension's features:

• Displaying your listings in the FlipFlow dashboard
• Bumping listings on Vinted
• Cross-listing items between Vinted, eBay, Depop, and Kleinanzeigen
• Syncing your wardrobe and displaying sales analytics
• Verifying your subscription via license key validation

Legal basis for processing: Art. 6(1)(b) GDPR — the processing is necessary for the performance of the service you have chosen to use.

3. Data Storage

All wardrobe data, sales data, profit calculations, listing drafts, preferences, and operation history are stored entirely on your local device using Chrome's built-in storage mechanisms (chrome.storage.local and IndexedDB). We do not operate any database or server that stores your personal or listing data.

The only data that leaves your device is your license key, which is sent to our API server (vintagelab.org) over an encrypted HTTPS connection for subscription verification.

4. What We Do NOT Do

• We do not collect, transmit, or sell any personal data
• We do not track your browsing history or online behavior
• We do not send listing data, sales data, or any user content to our servers
• We do not use analytics, tracking scripts, or telemetry
• We do not share any data with third parties

5. Third-Party Sharing

We do not share, sell, rent, or otherwise disclose any user data to third parties. The only external communication FlipFlow makes is the license key validation request to our own API server (vintagelab.org). No third-party services, advertising networks, or analytics providers receive any data from FlipFlow.

6. Data Retention

Since all user data is stored locally on your device, you have full control over its retention. You can clear all extension data at any time by:

• Removing the FlipFlow extension from Chrome
• Clearing the extension's storage via Chrome Settings → Extensions → FlipFlow → Details → Clear data

License key records on our server are retained only for the duration of your active subscription and are deleted upon request or account cancellation.

7. Your Rights (GDPR)

As a user in the European Union, you have the following rights:

• Right of access (Art. 15 GDPR) — request information about what data we hold about you
• Right to rectification (Art. 16 GDPR) — request correction of inaccurate data
• Right to erasure (Art. 17 GDPR) — request deletion of your data
• Right to restriction (Art. 18 GDPR) — request restriction of processing
• Right to data portability (Art. 20 GDPR) — receive your data in a machine-readable format
• Right to object (Art. 21 GDPR) — object to data processing
• Right to lodge a complaint — with your local data protection authority

To exercise any of these rights, contact us at vintagelab@outlook.com.

Supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

8. Security

All communication between FlipFlow and our API server is encrypted using HTTPS/TLS. Since user data is stored locally on your device, it is protected by your operating system's security and your Chrome browser profile.

9. Children's Privacy

FlipFlow is not directed at children under the age of 16. We do not knowingly collect any data from children. If you believe a child has provided data to us, please contact us at vintagelab@outlook.com and we will take steps to remove it.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

11. Contact