Privacy

FlipSonar — Inhaber: Nikita Moos, Frauenberger Str. 119, 53879 Euskirchen, Germany. Reach us at info@flipsonar.com — that address is read by a person.

• Your account: email address, an optional name, and your password as a hash — never the password itself. Plus a verification code while you confirm the address.
• Your plan: whether a plan is active, which one, and the membership id Whop gives us. We never see or store card details.
• What you do with the product: the scans you save, the finds you favourite, the products you track, the searches you save with their price limits, and how you arranged your dashboard.
• Photos you upload: the picture you scan is kept with your account so the scan can be opened again later, and a profile picture if you set one. Both are stored by us, both go when the account goes.
• Support messages: what you wrote and the address to answer on.
• A scan counter: one row per scan you run — your account, whether it was a photo, a link, a name or a bulk row, and the time. Nothing about the product or the result. It measures your plan's monthly allowance and goes when the account goes.
• Server logs: our host records the usual request data — IP address, time, the page requested, browser and referrer. We do not build profiles from it; it exists so that attacks and outages can be traced.

• To give you what you signed up for (Art. 6(1)(b) GDPR): your account, your scans, your saved finds, your plan. Without this data there is no product to deliver.
• Because we have a fair interest (Art. 6(1)(f) GDPR): keeping the service secure and available, tracing abuse in the server logs, and answering support messages. Our interest is running a service that works; we think yours points the same way, and you can object at any time.
• Because the law requires it (Art. 6(1)(c) GDPR): billing records have to be kept for as long as tax and commercial law says.
• Not consent (Art. 6(1)(a) GDPR): there is nothing here you would have to consent to, because we run no advertising, no analytics and no tracking. If that ever changes, you will be asked properly first — with a refusal that is exactly as easy as an agreement.

No advertising cookies, no analytics, no tracking pixels, no profiling, and we do not sell or share anything for marketing. There is no third-party script on this site that follows you.

All of them are necessary for the site to work, and none of them track you across other sites: one keeps you signed in, one remembers whether you read prices in dollars or euros, one holds the short-lived state while you sign in with Whop, and one remembers when the next search run is due. Admins have two more that only change what an admin sees.

• Google (Gemini and Vision): when you scan something, the photo or link you give us is sent to Google's models — one to identify the product, one to search the web for the same picture. A profile picture you upload is sent once as well, to check it is not something it should not be. This is the place where something you upload leaves our systems, so it is named first.
• Whop: payments and subscriptions. They handle the payment itself; we receive only that a membership is active.
• YouTube (Google): our film on the front page is hosted there. Nothing reaches Google until you press play — until then you see a still image served from our own servers. Press play and YouTube receives your IP address and can set cookies, like on any embedded video. The player we load is the one that sets no advertising cookies before playback.
• Notion: when you send a support message that reads like a real fault report, a copy of it is filed in our internal task database so the people who fix things see it the same hour instead of the next morning. Your email address is not part of that copy.
• Vercel (hosting) and Neon (database) run the site and store the data above.
• Resend: sends your verification and account emails, and therefore sees your address.
• eBay, StockX, KicksDB and other marketplaces: we ask them about products and prices, and those requests carry nothing about you. Product photos are a different matter: they are hosted by the marketplace and loaded by your browser straight from there, so that marketplace sees your IP address the moment a page with their pictures on it opens.

Google, Vercel, Whop, Resend and Notion are United States companies, so some of the data above is processed outside the EU. Each of them is either certified under the EU–US Data Privacy Framework or bound by the European Commission's Standard Contractual Clauses, which is what makes the transfer lawful. US authorities can, under their own law, demand access to data held by US providers, and no contract fully removes that — we would rather say so than leave you to find out.

FlipSonar scores products, not people. The judgement you read — the profit, the score, the buy-or-pass — is about a sneaker or a card, and it has no legal effect on you and nothing similar to one. We do not profile you, we do not rank you, and nothing you do here feeds a decision about you.

• Your account and everything in it for as long as the account exists. Delete the account and it goes, along with your saved scans, favourites and tracked products.
• Photos you uploaded live exactly as long as the account does. Deleting the account deletes them; there is no copy kept anywhere else.
• Support messages stay so we can look up what was already answered — the message itself, without your address, which goes with the account.
• A withdrawal from the contract is kept as proof that it reached us and when — without that record it would be our word against yours. If you sent it from the address on your account, deleting the account takes your name and contact details out of it and leaves the date behind. Sent from any other address, or without an account, it stays as you wrote it.
• Verification and password codes are short lived by design and expire on their own, usually within the hour.
• Billing records are the exception: tax and commercial law require them to be kept for up to ten years, and deleting your account does not shorten that. They are locked away for that purpose and used for nothing else.
• Server logs are kept only as long as they are useful for security and diagnosis, and then they roll off.

Everything travels over an encrypted connection. Passwords are stored as a hash and never in readable form — not even we can look yours up, which is why a forgotten password is reset rather than sent to you. Verification codes are hashed the same way and expire. Payment card details never reach us at all; Whop handles them.

No law obliges you to. But an email address and a password are what an account is made of, so without them there is no account and nothing to sign in to. Everything beyond that — your name, what you scan, what you save — is yours to leave empty.

• A copy of everything we hold about you (Art. 15).
• Correction of anything wrong (Art. 16).
• Deletion — of your account and what belongs to it (Art. 17).
• Restriction: we keep it but stop using it while something is disputed (Art. 18).
• Portability: your data in a machine-readable file, or sent straight to another provider (Art. 20).
• Objection to anything we do on the grounds of our own interest (Art. 21). Say so and we stop, unless we can show reasons that outweigh yours.
• Withdrawal: where anything ever rests on your consent, you can take it back at any time, and what happened before stays lawful (Art. 7(3)).

Write to info@flipsonar.com — one address, all of the above, and no form to fill in. We answer within a month.

You can also complain to a data protection authority (Art. 77), in the EU country where you live, where you work, or where you think something went wrong.

FlipSonar is a paid tool for people running a resale business, and it is not meant for children. Do not open an account if you are under 18.

When we change something that matters, we update this page and show the notice at the bottom of the site again, so a change cannot slip past you quietly.

Last updated: 2026-09-08.