Privacy Policy

flipped is an app made and run by The Trustee for JAG Fitness Trust & J Tolli, a partnership (ABN 57 385 787 167) based in Victoria, Australia. In this policy, "we" and "us" means that partnership, and "you" means the vendor or staff member using the app.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy says what we collect, why, where it goes, and what you can do about it. We have tried to keep it short and plain. If anything is unclear, ask us: support@flippedtcg.com.au.

The short version

• We collect what you need to run your card business in flipped: your sign-in, your stock, your deals and your shows.
• We don't sell your data. We don't show ads. There is no analytics or tracking in the app or on this website.
• Your business's records belong to you.
• People who browse your customer list are anonymous to us. Their wish list stays on their own phone.

What we collect

About you (an owner or staff member)

• Your email address and password. Passwords are handled by our sign-in provider and stored scrambled (hashed); we can't read them.
• The name shown for you in the app, and your role in a business (owner or staff).

About your business (what you put in the app)

• Your business name, and the public name you choose for your customer list.
• Stock: cards, sealed items and mystery packs, with their condition, grade, prices, what you paid, and where they're kept.
• Deals: sales, buys and trades, with amounts, how they were paid, the date, and the show.
• Shows, expenses, collections, imports and online sales listings (including the links you add, such as an eBay listing).
• Anything you type into a free-text field, such as a note.

About the people you deal with

• When you record a deal you can add the other person's name. It is optional. If you add it, you are collecting it, and you should only add what you need (see "Your responsibilities" below).

Technical details

• Each device that records a deal is given a random device code, so we can tell which phone sent which deal. It does not identify you or your phone's make or number.
• Like every website, our hosting and database providers see your IP address and browser type when your device connects. They keep these in short-lived server logs for security and fault-finding. We do not use them to profile you.

We do not collect your location, contacts, camera, microphone or payment card details in the app.

Why we collect it

• To run the app: show your stock, record your deals and work out your profit.
• To let your team work together on one business.
• To sign you in and keep your account secure.
• To show your customer list, if you switch it on.
• To bill your subscription (see "Payments").
• To keep your business's billing records (see "Billing details").
• To answer you when you contact us, and to tell you about important changes to the service.

We won't use your data for anything else without asking you first, unless the law requires it.

Payments

Subscriptions are paid through Stripe, on Stripe's own checkout page, not in the App Store or Google Play apps. Stripe collects and holds your card details; we never see or store your card number. Stripe tells us only what we need to run your subscription: your plan, whether it's paid, when it renews or ends, and Stripe's reference numbers for you. Stripe's privacy policy applies to what Stripe holds.

Billing details

A business's billing details are held by our payment provider, Stripe. We never see or store card numbers. Stripe tells us only what we need for the business's account, and Stripe's reference numbers for it. Stripe's privacy policy applies to what Stripe holds.

Who we share it with

We share data only with the services that run flipped for us, and only what each one needs:

Sign-up and password emails are sent by Supabase or by our email provider, Resend. Either one receives your email address and the email we send you.

eBay links in the app simply open eBay in your browser. We don't send eBay anything. Once you're on eBay, eBay's own privacy policy applies.

We don't sell or rent your data, and we don't share it with advertisers. We may disclose information if the law requires it (for example, a court order).

Where it's stored (overseas disclosure)

Your business records are stored by Supabase in its Sydney, Australia data centre (AWS ap-southeast-2). Netlify serves the app from a worldwide network and is based in the United States. Stripe is based in the United States and Ireland, with an Australian entity. Resend and Cloudflare are based in the United States. The card data services are based overseas.

So some of your information, such as your email address, IP address and billing details, may be stored or handled outside Australia, including in the United States and Ireland. Each provider gets only what it needs (see the table above), and its own privacy policy covers what it holds.

Your customer list and the people who visit it

If you switch on your customer list, anyone with the link or QR code can see everything in stock in your portfolio. You can't pick which items show. They see:

• Cards: name, set, number, language, variant, condition (or grader and grade), the card picture, your asking price, and where you keep it (if you've set one).
• Sealed items: name, set, language, price and how many.
• Mystery packs: only "Mystery pack", the price and how many, never what's inside.
• Your public business name, and the name and date of your running show, unless you switch that off.

You can hide prices. The list is public by your choice, and you can switch it off at any time. Turning it off stops the link working.

For people who visit your customer list:

• They don't sign in, and we don't ask for their name, email or anything else.
• Their wish list is saved only in their own browser. It is never sent to us or to you.
• The page sends us nothing about them. It only asks our database for that list's stock.
• Our hosting and database providers see their IP address and browser details when the page loads, as with any website. Card pictures load from the card data sources above.
• The page is hidden from search engines and does not pass its address on to other websites.

What is stored on your device

flipped saves some data on your phone so it stays quick and keeps working when the signal drops at a show. This is browser storage (IndexedDB and local storage), not cookies.

• Your sign-in, so you stay signed in.
• A copy of your stock and recent History, Reports and Portfolio figures.
• Deals waiting to send: a deal saved with no signal waits here until it can be sent.
• Drafts and preferences: a half-built deal or card, deals saved for later, your theme, the last payment method used, recent locations, and similar settings.
• The card list and card pictures, downloaded once.
• On a customer list: the visitor's wish list and the lists they opened, kept on their phone for 30 days from last use.

When you sign out, we clear your business's data from that device: your stock copy, History, drafts, settings tied to your business, and any customer lists that phone opened. We keep two things on purpose:

• Deals not yet sent. These are your money. They send next time you're online. Deals saved for later are cleared if you confirm when you sign out.
• The card list, because it's slow to download and says nothing about you.

Cookies. The app and this website don't set cookies for sign-in, advertising or tracking, and this website loads no analytics. Sign-in is kept in your browser's storage instead. When you pay, Stripe's checkout page may set Stripe's own cookies; Stripe's privacy policy covers them. Stripe, our payment provider, may set its own cookies; Stripe's privacy policy covers them. The website remembers which sample card it last showed you, on your device only. It isn't tracking.

How we keep it safe

• Everything travels over an encrypted (HTTPS) connection.
• Each business can only see its own records. This is enforced in the database itself, not just in the app.
• Staff can do only what their role allows. Some things are for the owner only.
• While your business is open, a deal is never quietly erased. A mistake is voided and fixed, so your records stay complete and you can trust your numbers.
• The app blocks other websites from embedding it, and only talks to the services listed above.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), in line with the Notifiable Data Breaches scheme.

Seeing and correcting your information

You can see and change almost everything yourself in the app: your stock, prices, deals (by voiding and fixing them), shows and settings. You can change your password in Settings.

You can download your portfolio and every deal yourself, as spreadsheet (CSV) files, in Settings › Your business › Export your data.

If you want a copy of what we hold about you, or want us to correct something you can't change yourself, email support@flippedtcg.com.au. We'll reply within 30 days. We may need to check it's really you first.

Deleting your data and how long we keep it

Your business records. A business's ledger (deals, stock movements, shows and expenses) is its financial record, so we keep it while the business is open, including while its subscription is paused or endedselling is paused. You may also need to keep these records for tax; the ATO generally asks for five years. You can export a copy any time (see above), or email us and we'll send your records.

Deleting your account. In the app, go to Settings › Your business › Business › Delete account. You'll be asked for your password. Or email support@flippedtcg.com.au and we'll do it for you. See Delete your account.

What happens depends on your role:

• Staff, or an owner when another owner stays: your account is deleted straight away and can't be brought back. You're signed out, your password is removed, and your email address is replaced with a scrambled code. Your deals stay in the business's records, linked to an ID with no name or email attached, and shown as "Former staff member" or "Former owner".
• The only owner first hands the business on to someone on the team (Hand it on), or closes it. Handed on, the business carries on with its new owner and your account is deleted.
• Closing a business stops selling for everyone, and signs everyone out and stops a subscription bought on the web from renewing (one bought through the App Store or Google Play has to be cancelled there). The owner then picks when the accounts are deleted. Delete accounts in 30 days is picked unless the owner changes it: for 30 days the owner can reopen the business by signing in with the same email and password and tapping Keep my business. When the 30 days end, every account in the business is deleted and it can't be reopened. Delete accounts now deletes every account at once, and the business can't be reopened.
• After a close, either way: your deals, stock and shows are kept for 5 years, then removed. That includes any names and notes typed into them. The 5 years start on the day the business closes. They're the business's financial records, and the ATO generally asks businesses to keep records for five years. If you want something removed sooner, email us and we'll tell you what we can do.

Backups and logs. Removed data may stay in our providers' systems, such as server logs, for a limited time before it is cleared.

Deletion records. When an account is deleted, a record of the deletion, including the account's email address, is kept in our sign-in provider's audit log for record-keeping and security. That log may also show the email address next to earlier sign-ins. We don't use it for anything else.

Billing records are kept for at least as long as Australian tax law requires.

Your responsibilities as a vendor

If you record other people's details in flipped, such as a name on a deal, you are responsible for collecting them fairly and only keeping what you need. Most small businesses with turnover under $3 million aren't covered by the Privacy Act, but it's good practice either way. Our tip: a first name or nickname is usually enough.

Children

flipped is for businesses and is not meant for anyone under 18. We don't knowingly collect information from children. The customer list collects nothing from visitors of any age. If you think a child has created an account, contact us and we'll remove it.

Changes to this policy

If we change this policy in a way that matters, we'll tell you in the app or by email before the change takes effect. The date at the top shows the latest version.

Complaints

If you're unhappy with how we've handled your information, please contact us first at support@flippedtcg.com.au. We'll reply within 30 days.

If you're still not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

Contact us