Privacy Policy

Last updated 23 October 2026 · Version 1

This explains what FlipPilot does with your information. We have tried to write it so you can actually read it. Where it says "we", it means FlipPilot (see section 1). Where it says "the app", it means the FlipPilot mobile app and the pages on flippilot.co.uk.

The short version

To make an account we ask for your email address and nothing else. There is no password, and we don't send marketing emails.
A photo you scan is sent to an AI service (OpenAI) to work out what the item is. We don't keep it.
Your saved scans, photos and history stay on your phone, not on our servers.
What you choose to put on the Marketplace (listings, photos, your display name, reviews) is public. Messages are private between you and the other person.
We don't sell your information, we don't use it for advertising profiles, and we don't track you across other apps or websites.
In the app, Settings lets you download everything we hold about you, or delete your account.

1. Who we are

FlipPilot is run by Andrew Bean, trading as FlipPilot, a sole trader in the United Kingdom. We are the "controller" of the personal information described here, which means we decide how and why it is used.

You can contact us at support@flippilot.co.uk about anything in this policy, including to ask about your information or to use any of your rights (section 8).

2. What we collect, why, and how long we keep it

This table lists what we keep on our servers. Your saved scans, photos and history are kept only on your phone and are not in it. (If your phone's own backup is switched on, Android may copy them to your Google account. That is between you and Google.)

Information	What we use it for	Who else sees or handles it	How long we keep it
Your email address, account ID, and when you made the account, last signed in and last used the app	To make your account and sign you in; to keep your listings, messages and credits with you if you change phone; to stop fake and repeat accounts. We never use it for marketing.	Resend, our email provider, sends the sign-in email (section 4).	Until you delete your account, or 24 months after you last signed in or used the app, whichever is first. When an account is deleted we keep one scrambled, one-way fingerprint of its ID. It can't be turned back into the ID, and we keep nothing that connects it to you. It stops the same ID being used again to claim credits or purchases.
Sign-in codes and sign-ins	To prove it's you.	Nobody. We keep only a scrambled (hashed) copy, never the code or token itself.	A code works for 10 minutes and stops after five wrong tries. A sign-in lasts up to 90 days after you last used it, or until you sign out.
The random "device ID" your phone uses with us	Everything on our servers is tied to it: limits, listings, messages. Once you sign in, your phone uses your account's own ID, so your things follow you to a new phone. It is never shown to other users.	RevenueCat, which handles subscriptions, is told it each time the app starts and uses it as your purchase ID. If you connect eBay, it also travels to eBay inside the sign-in link.	As long as your account exists.
How many scans you have used	To apply the free allowance (100 scans a month for each account) and the fair-use limit that comes with Pro. We store counts only, not what you scanned.	Nobody.	Deleted with your account; otherwise 30 days after the period it counts has ended.
Photos and item details you scan	To work out what an item is and estimate what it might sell for. A photo is sent to OpenAI. Item names and barcodes go to eBay and to OpenAI. Every barcode you scan is also looked up in Open Food Facts, and for some items the name goes to Google Shopping through a service called SerpApi.	OpenAI, eBay, SerpApi and Open Food Facts (section 4).	We do not keep your scan photos. Those companies keep what they keep under their own terms.
A vehicle registration you look up	To show the car's MOT history and DVLA details.	The DVLA and DVSA (UK government services), through our server.	We do not keep a record of what you looked up.
Marketplace listing: title, price, description, category, where it is (free text), condition, details and photos	To show your item to buyers. We also keep a few things privately with every listing and never show them to buyers: a country code worked out from your connection, your phone's region and time zone, and whether anything looked out of place, so a person can glance at a listing that does. Never your IP address. When you upload a photo we remove the hidden details your phone saves inside it, such as where and when it was taken and which phone took it; only which way up it should be shown is kept.	Public. Anyone using the app can see it. The private signals above are seen only by us.	A listing is live for 30 days. It then comes off the public list but is kept for another 30 days so you can relist it (anyone with its direct link could still open it until it is deleted), and is then deleted. A sold listing is deleted 6 months after it was marked sold. If you mark it sold to someone who wrote to you, we note who, so that person can review it. Photos and everything else go with the listing.
Your seller profile: an optional display name, the date you joined, how many things you have sold, reviews about you	So buyers can judge who they are dealing with.	Public on your profile. Your display name isn't checked, so don't use anything you wouldn't want shown.	Until you delete your account, or 24 months after your last activity if you have no listings.
If you sell as a business: the business name you give us	To label your listings "Trade seller", so buyers know they are dealing with a business.	Public on your listings and profile. We don't check it.	As long as your account exists.
A car's registration number, when you list a car	To check with the DVLA and DVSA that the car exists, to show buyers its make, colour, fuel, year, tax and MOT status and the mileage recorded at each MOT test, to stop the same car being listed twice, and to make scam listings harder.	The DVLA and DVSA. The number itself is kept privately with the listing and is never shown to buyers.	Deleted with the listing.
Messages between a buyer and a seller (up to 1,000 characters each)	So the two of you can talk about an item.	Only the two people. We may read a conversation if someone reports it. If the seller is a car dealership that lists through FlipPilot Dealer OS, the dealership sees your message text and a reference number for the chat, never your email or device ID, and keeps its own copy.	Up to 12 months after the last message in the conversation, or sooner if its listing is deleted first. A dealership keeps its own copy.
Which conversations you have opened	So the app can tell you when a chat has something new in it.	Nobody.	Until the chat itself is deleted (12 months after its last message), or you delete your account.
Reviews you write, and reports and blocks you make	Trust and safety.	A review is public on the seller's profile. Reports and blocks are seen only by us.	Reviews go when you delete your account. A report is kept for 24 months, because it can matter to a safety decision or a legal claim; when you delete your account your identity is taken off it. A report someone else made about you or your listing is kept for the same time after you delete your account.
Boot fairs and events you add	To show events to other people.	Public, except your device ID. Your email is shown only if you choose to show it.	60 days after the event's date.
Scan credits and purchases	To keep your credit balance and know whether you have Pro. We keep a record of credits added and used (the last 100 uses). It does not say what you scanned.	Google Play or the App Store takes your payment, and we never see your card details. RevenueCat tells us a purchase happened.	Deleted with your account, and any credits left are lost. We keep only the store's purchase reference numbers that have already been paid out (and, for a refunded purchase, its date and number of credits), with no name or account attached, so the same purchase can't be counted twice.
Operation Nightglass progress	To remember which chapters of the story you have unlocked.	Nobody.	With your account.
The Operation Nightglass story pages	The chapters are web pages that open inside the app. They load their lettering from Google Fonts.	Google, which receives your phone's IP address and device type when a chapter opens, as it does for any web font.	We don't keep it. Google keeps what it keeps under its own terms.
Feedback, ratings and "doesn't look right" price reports you send	To improve the app and fix wrong prices.	Read only by us.	24 months, or sooner if you delete your data. Please don't put personal details in them.
Rounded location, only if you have already allowed location	To pick adverts near you. The position is rounded to about a mile and sent with the request. We use it to choose an advert and then forget it: it is not stored or logged.	Nobody.	Not kept.
Postcodes you type (for boot fairs and local adverts)	To turn a postcode into a place on the map.	postcodes.io.	The postcode of a boot fair is public with the fair, and the postcode of a business's advert is kept with the advert (see the advertiser row). Others are not kept.
Advert counts	To count how many times an advert is shown, tapped or saved. We don't record who.	Nobody.	Counts only.
Your eBay connection, only if you connect eBay	To create an eBay listing for an item you choose to export.	eBay. Our server keeps your eBay sign-in tokens encrypted.	Until you disconnect eBay or delete your account.
If you advertise your business: its name, website, phone number, address, postcode and logo, and each advert you book (its words, pictures, area, dates and price)	To check your adverts, show them in the app, take payment and contact you about them.	An advert's words and pictures are public while it runs. OpenAI looks at them to help a person check them. Stripe takes card payments.	Until you delete your account (we can't do that while a paid advert is still renewing: cancel it first). What we were paid for an advert is kept for 6 years as a business record, with only the business name, amounts, dates and payment references.
Technical records	To run and secure the service. Our server log records what page was asked for, the result and the time, with no IP addresses and no search terms. IP addresses are held briefly in the server's memory to limit abuse.	Our host, Render, keeps its own ordinary server logs. Its network passes traffic through Cloudflare.	Short-lived. See section 4 for backups.
Emails you send us	To answer you.	Cloudflare forwards mail sent to support@flippilot.co.uk to our mailbox.	As long as we need to deal with your request and keep a sensible record of it.

What we don't collect from people using the app: your name (unless you choose a display name), phone number, date of birth, contacts, microphone, advertising IDs or analytics. The app has no advertising SDKs and no crash-reporting service. Businesses that advertise give us business details: see the advertiser row.

3. Why we are allowed to use your information

To give you what you asked for (a contract with you): your account, scans, Marketplace, messages, credits and Pro.
Our legitimate interests: keeping the Marketplace and the service safe and secure, stopping fraud and abuse, fixing faults, and counting adverts. We weigh this against your rights. You can object (section 8).
The law: when we are required to keep or hand over something, for example in answer to a lawful request.
Your consent: optional location for the weather card and for local adverts. You can turn it off in your phone's settings at any time.

We use some automatic checks. For example, a car listing is refused if its registration isn't recognised or the make doesn't match, and a listing that looks suspicious can be flagged. If one of these gets it wrong, email us and a person will look at it.

4. Who else handles your information

We use these companies to run FlipPilot, and we send each only what its job needs. They also have their own privacy policies.

Render (render.com) hosts our server. Our data is kept on a disk in Frankfurt, Germany. Render takes a daily backup of that disk and keeps each backup for at least seven days, so something you delete can remain in a backup for a short time afterwards. Requests to our server pass through Render's network, which uses Cloudflare.
Resend sends the sign-in emails. We use its Ireland servers. It keeps a log of the emails it sends, including the code in them, for a limited time under its own terms.
Cloudflare holds our website address, forwards emails sent to support@flippilot.co.uk to us, and hosts our main website at flippilot.co.uk, so it sees your IP address when your browser loads a page from there.
OpenAI looks at the photos you scan, and at item names, advert text and advert pictures, to identify items and to help check adverts. We use its business API.
eBay supplies public listings for price guides, and is the service you connect if you export an item to eBay.
SerpApi lets us search Google Shopping for some items. Open Food Facts supplies food and grocery barcode details.
Product pictures. When you scan a barcode, the picture shown with the result comes from eBay's or Open Food Facts' servers. Your phone loads it from them directly, so they see your phone's IP address.
Google Fonts supplies the lettering on the Operation Nightglass story pages. The request goes from your phone straight to Google, not through us.
The DVLA and DVSA are UK government services that supply vehicle and MOT details.
RevenueCat keeps track of subscriptions and purchases for us, with Google Play and the App Store, who take payment.
Open-Meteo gives the weather and postcodes.io turns postcodes into places. The weather request goes from your phone straight to Open-Meteo, not through us, and carries your phone's approximate location.
Stripe takes card payments from businesses that buy adverts. It is not used for ordinary app users.

We may also share information if the law requires it, to protect people from harm, or to deal with a legal claim. If FlipPilot is ever sold, your information would go with it, and the same promises would carry on.

5. Sending information outside the UK

Some of these companies are based in the USA or use servers outside the UK. When your information goes to a provider outside the UK, we rely on a safeguard the law allows, such as the UK–US data bridge for companies certified under it, or standard contract terms with the UK addendum, and we send only what is needed. Our own data sits in Germany and Ireland.

6. Adverts

The app shows adverts from businesses, always labelled as sponsored. They are not based on a profile of you. At most the app uses the rounded location described above to show a nearby business, and counts how often an advert is shown. If you report an advert, we keep your report (the reason, your note and your ID) for up to 24 months, or until a person has looked at the advert again and cleared it, with your identity taken off if you delete your account. Businesses that advertise use a separate portal, and our advertiser terms explain what we hold about them: their email, business details and booking, with card details going to Stripe and never to us.

7. Car dealers and trade sellers

Some Marketplace sellers are businesses. A seller can tell us it sells as a business and is then labelled "Trade seller" with the business name it gives. Some dealerships list their cars through FlipPilot Dealer OS, our software for dealers. If you message one, it sees your message and a reference number for the chat. It does not see your email or device ID, and it is responsible for what it does with your enquiry. Dealer OS has its own privacy policy for dealers and their staff.

8. Your rights and choices

You have the right to see what we hold about you, to have mistakes corrected, to have your information deleted, to restrict or object to how we use it, and to take a copy with you. You can do most of this yourself:

Download your information: Settings, then Your data, then Download my data.
Delete your account: Settings, then Account, then Delete my account. See what gets deleted.
Anything else: email support@flippilot.co.uk. We aim to answer within a month. We may need to check it is really you first.

If you aren't happy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

9. Keeping it safe

Everything travels over encrypted (HTTPS) connections. Sign-in codes and sign-in tokens are stored only in scrambled form, eBay sign-in tokens are encrypted, and the device ID is never shown to other users. We only let in the people who need to see the data to run the service. No system is perfectly secure, so please keep your sign-in codes to yourself, and tell us straight away if you think someone else has used your account.

10. Children

FlipPilot is for people aged 18 or over, and the app asks you to confirm that when you start. We don't knowingly collect information from anyone under 18. If you think we have, tell us and we will delete it.

11. Cookies and tracking

The pages on flippilot.co.uk set no cookies and have no analytics or advertising trackers, and they load nothing from other companies. The advertiser portal (api.flippilot.co.uk/advertise) keeps a sign-in token in your browser's local storage so you stay signed in, and uses it for nothing else. The app doesn't use advertising IDs or tracking SDKs. Apart from the services in section 4 (the weather, postcode look-ups, product pictures, the story-page lettering and purchases through the app store), the only other places your phone goes are links you choose to tap, such as a map.

12. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, where it affects what you have agreed to, ask you to confirm the new version in the app. Earlier versions are available on request.

Questions about any of this? Email support@flippilot.co.uk.