Introduction

This Privacy Policy describes how FlipX ("FlipX", "we", "us") handles information when you use our website at flipx.gg, related APIs, and the optional RuneLite plugin (together, the "Service"). By using the Service, you agree to this policy and our Terms of Service.

FlipX is an unofficial third-party tool for Old School RuneScape Grand Exchange flipping. It is not affiliated with, endorsed by, or sponsored by Jagex Limited.

Information we collect

The data we collect depends on how you use FlipX. We do not sell your personal information.

Account and profile

Sign-in: email address and authentication records when you register or sign in (including via supported OAuth providers such as Google or Discord). OAuth providers may share basic profile fields (for example name or avatar URL) according to their own policies and your choices.
Profile settings: display name, timezone, optional public username, bio, avatar URL, and visibility preferences (private, friends-only, or public).

Subscriptions and billing

Paid plans are processed by Stripe. We store subscription status, plan tier, and Stripe customer and subscription identifiers linked to your FlipX account. Stripe collects and processes payment card and billing details directly; we do not store full card numbers on our servers.

Portfolio and Grand Exchange activity

If you import history or use the RuneLite plugin, we store Grand Exchange offer events and derived analytics, including for example:

Linked OSRS account hash and in-game display name from RuneLite
Optional declared RuneScape name (RSN) and verification timestamps
Item ID and name, buy/sell side, price, quantities, slot index, offer state
Event timestamps and idempotency keys used to deduplicate uploads
Imports you upload (for example Flipping Utilities JSON export files)

We use this data to power portfolio views, flip matching, session stats, and related features you enable. We do not receive your bank, inventory, chat, or location inside the game.

RuneLite plugin

The plugin is optional. When you pair a device, we issue an API key (stored hashed on our side; shown once during pairing and stored locally in the plugin). We record device identifiers, an optional label, last-seen time, and revocation status. Plugin traffic includes your IP address and standard request metadata as part of HTTPS.

Copilot, slot optimizer, and other in-client panels are display-only guidance — they do not place, modify, or cancel in-game offers. Risk Lens and planner output use historical market snapshots; they are not price predictions.

Saved preferences and lists

Watchlists, saved filter presets (bookmarks), and similar in-app settings
Some UI preferences may be stored in your browser (for example theme choice or locally cached bookmarks before you sign in)

Social and competitive features (opt-in)

Leaderboards, public profiles, friends, and groups are off or private by default. If you opt in, we may process and display aggregated trading statistics (such as profit, flip count, GP/hour, and ROI over selected periods), your chosen username, and friendship or group membership needed to operate those features.

Referrals

If you use or share a referral link, we store referral codes, attribution between referrer and new account, and (for anti-abuse) identifiers such as activation device ID when a referral qualifies for rewards.

Technical and security data

IP address, user agent, and request logs from our hosting provider
Rate-limit and abuse-prevention signals tied to accounts or IP addresses
Session cookies and tokens used to keep you signed in

How we use information

Provide, maintain, and improve the Service
Authenticate you and enforce plan entitlements
Process subscriptions and support billing disputes
Compute portfolio, session, and optional leaderboard statistics
Sync data between the web app and paired plugin devices
Operate referrals, support, and security monitoring
Comply with law and protect users, our infrastructure, and the Service

We may use aggregated or de-identified statistics (for example platform-wide flip counts) that do not identify you personally.

Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process personal data when necessary to perform our contract with you (providing the Service), when necessary for our legitimate interests (such as security, fraud prevention, and product improvement, balanced against your rights), when you have given consent (for example opting into public leaderboards), or when required by law.

Cookies and similar technologies

Authentication: cookies or local storage used by our auth provider to maintain your session
Referrals: a short-lived cookie (typically up to 30 days) if you arrive via a referral link, so we can attribute signup correctly
Preferences: local storage for settings such as theme
Advertising: when Google AdSense is enabled on the site, Google may set cookies or use similar technologies to serve and measure ads. See Google's advertising policies and your ad settings in your Google account.

Most browsers let you block or delete cookies; some features may not work without session cookies.

Third parties and subprocessors

We share data with service providers only as needed to run FlipX:

Supabase — authentication, database, and row-level security for account data
Stripe — payment processing and subscription management
Vercel — hosting, edge delivery, and operational logs
Google — AdSense when configured for ad serving

Market data: public prices and volumes come from the OSRS Wiki Real-Time Prices API. Our servers call that API with a descriptive User-Agent (including operator contact information) as required by the Wiki; the Wiki operators see our server requests, not your personal FlipX account.

OAuth sign-in is subject to the privacy policies of the provider you choose (for example Google or Discord).

Data retention

We keep account and portfolio data while your account is active and as needed to provide the Service. If you revoke a plugin device, we stop accepting new uploads from that key; historical events already stored remain unless you delete your account. Server logs are retained for a limited period for security and debugging. Referral and billing records may be kept longer where required for accounting, tax, or legal compliance.

Security

We use HTTPS, hashed plugin API keys, access controls, and database policies to protect data. No method of transmission or storage is completely secure; use a strong password, protect pairing codes and API keys, and revoke devices you no longer use.

International transfers

FlipX is operated from the United States. If you access the Service from other regions, your information may be processed in the U.S. or where our subprocessors operate. We rely on appropriate safeguards where required by applicable law.

Children

The Service is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will take appropriate steps.

Your choices and rights

Plugin sync: disable GE upload in plugin settings or disconnect without uninstalling
Devices: revoke paired RuneLite devices anytime in Settings → Devices
Social visibility: keep profiles and stats private, or adjust opt-in and visibility in settings
Billing: manage or cancel subscriptions via Settings and Stripe customer portal where available
Access and deletion: you may request access, correction, export, or deletion of personal data by contacting us. Self-service account deletion is not yet available in the app; we will honor valid requests subject to legal retention obligations.

Depending on where you live, you may have additional rights (for example under GDPR or UK GDPR, or U.S. state privacy laws such as the CCPA/CPRA). You may also have the right to lodge a complaint with your local supervisory authority. We will not discriminate against you for exercising privacy rights where applicable.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated "Last updated" date. Material changes may also be communicated through the Service or Discord where appropriate. Continued use after changes constitutes acceptance where permitted by law.

Contact

Privacy questions, data requests, or concerns: reach us on Discord or open an issue in the FlipX RuneLite plugin repository on GitHub.