Puck FlipBETA

Privacy policy

Last updated: October 2026. This notice describes how Puck Flip handles information in connection with this website, the signed-in workspace, and the eBay account you may connect to it. It also serves as the privacy notice required for eBay Partner Network participation.

Who we are

Puck Flip (puckflip.com) is operated by David Coutu, entreprise individuelle (travailleur autonome), Québec, Canada (NEQ 2272273188). David Coutu is the person responsible for the protection of the personal information described here.

Privacy inquiries, access requests and deletion requests: support@puckflip.com.

Information we process

  • Account — You can sign in with Google, with Facebook, or with an email address and a passkey. Google and Facebook return an email address, a display name, a profile picture address and a provider identifier. With a passkey we store your email address, the public key of the passkey and the label you give it; we never receive the private key. We store these to create and secure your account.
  • Email verification codes — When you register or sign in by email, we store a hash of the code together with the IP address the request came from, to limit abuse. These rows are deleted after 24 hours.
  • Content you create — Draft and published listings, listing templates, collection items (including your notes and purchase costs), saved searches, watched cards, snipes, portfolio snapshots and preferences, including the seller postal code and country you enter for eBay.
  • Card photos — Images you upload for card identification. See the dedicated section below.
  • Connected eBay account — OAuth access and refresh tokens (encrypted at rest), your eBay user identifiers, and the listing, order and sales data we retrieve on your behalf: order numbers, amounts, status and tracking numbers. We do not store the names or addresses of your buyers.
  • Billing — Subscription status, Stripe customer and subscription identifiers, and the email address passed to Stripe at checkout. We never receive or store your card number.
  • Emails we send you — Alerts you set up (watched cards, sale opportunities in your collection, completion of a bulk listing job) are sent to your account address.
  • Access logs — Our web server records the IP address, user agent, requested URL and time of each request, for security and troubleshooting. Sign-in codes and tokens carried in a URL are masked before the line is written.
  • Usage counters and traffic measurement — described under “Cookies and measurement”.
  • Support email — Messages you send us and the address you send them from.

Card photos and AI identification

Every photo you upload is re-encoded on our server before anything else happens: embedded metadata, including the location and device recorded by your phone, is removed, and iPhone photos (HEIC) are converted to JPEG. A photo that cannot be re-encoded is refused. The cleaned image is then transmitted to third-party services to identify the card and find comparable items:

  • Google — the photo is sent to the Google Gemini generative AI API to read the player, set, card number, parallel and condition cues.
  • eBay — the photo is sent to the eBay Browse API image search to retrieve visually similar listings.

Photos are stored on our server under randomly generated file names so results can be displayed and reopened. They are served by direct address, without sign-in: anyone who has the exact address of a photo can open it. Do not upload images showing anything you do not want processed or viewable this way. Photos attached to your account are deleted when you delete your account (those uploaded in the last 7 days are removed by the daily clean-up, within 7 days); you can also ask us to delete them at any time.

Purposes

  • Providing the tools you request: identifying cards, valuing them, managing your collection, preparing and publishing your eBay listings.
  • Securing accounts, preventing abuse and enforcing usage quotas.
  • Billing and subscription management.
  • Measuring which pages are visited and which channels bring new accounts.
  • Affiliate attribution on eBay links, disclosed on our Affiliate disclosure page.

We do not sell personal information and we do not use it for behavioural advertising.

Service providers

The following providers process data on our behalf or as independent controllers. This list reflects the features currently in service; providers marked “feature-dependent” are only involved when you use the corresponding feature.

  • eBay Inc. — OAuth sign-in to your eBay account, listing publication, order and sales retrieval, market and image search, affiliate link attribution.
  • Google LLC — Google sign-in, and the Gemini generative AI API used to identify uploaded card photos and to check that comparable listings match your card.
  • Meta Platforms — Facebook Login, when you choose that sign-in method.
  • Stripe, Inc. — subscription checkout, billing portal and payment processing.
  • OVHcloud — hosting. Our application server and database are located in Québec, Canada.
  • Hostinger — outgoing SMTP for the emails we send you and for our own error notifications.

Fonts and script libraries are served from our own server: loading a page does not contact any third party. Thumbnails of eBay listings, wherever they are shown, are loaded directly from eBay’s image servers, and your profile picture from Google or Facebook when you signed in with them.

Retention

  • Account and content — kept while your account exists. Deleting your account erases them immediately.
  • Uploaded photos — kept while a listing or collection item refers to them. Photos nothing refers to any more are deleted after 7 days.
  • Sessions — closed after 30 days without a visit.
  • Email verification codes — 24 hours.
  • Usage counters for the AI quota — 12 months.
  • Traffic measurement on public pages — 13 months.
  • Technical records of AI calls (model, volume, errors — no account identifier) — 90 days.
  • Web server access logs — 30 days.
  • Application logs — 14 days.
  • eBay item data caches (card analyses, sold-item results, AI filtering of sold items) — 7 days, then purged by a daily job.
  • Price engine data (observed active listings, unmatched titles) — 30 days after the last time the listing was seen.
  • Public card search cache (eBay Browse results) — served for at most 1 hour, rows deleted after 7 days.
  • PSA population cache — 7 days.
  • Reference card values computed from market data — kept while the card is in our catalogue. They describe cards, not people.
  • Backups — encrypted, kept 7 days on our server. Backups are not edited: data you delete leaves them as they expire.

Retaining eBay item data beyond what is needed is not permitted by eBay, which is why the caches above are purged on a fixed schedule rather than kept indefinitely.

Cookies and measurement

All cookies are set by this site; none comes from a third party.

  • PHPSESSID — session cookie, lifetime 30 days, HttpOnly, SameSite=Lax, Secure over HTTPS. It keeps you signed in and is only set once you sign in.
  • pf_csrf — anti-forgery token for visitors without a session (sign-in forms). HttpOnly, SameSite=Lax, deleted when the browser closes.
  • dc_locale — your language preference (French or English), lifetime 1 year, set when you switch language.
  • pf_has_account — set at your first sign-in, lifetime 1 year, HttpOnly, SameSite=Lax. It only tells the public home page to show “Open the app” instead of the sign-up pitch. It contains no identifier.
  • pf_utm — set only when you arrive through a link carrying utm_ parameters (a post, an ad, a newsletter), lifetime 90 days, HttpOnly, SameSite=Lax. It stores the source, medium and campaign names of that first visit, so that we can count which channels bring new accounts. It contains no identifier. The site works the same without it: you can delete it from your browser at any time.
  • Browser storage — your last few searches and a few interface choices are kept in your own browser (local storage) and are not sent to us.
  • Traffic measurement on public pages — page views and affiliate link clicks are recorded on our server with a visitor_hash: a keyed hash of your IP address, the current UTC date and your user agent, computed with a secret that never leaves our server. The IP address itself is not stored in that table, and because the date is part of the hash it changes every 24 hours.
  • Usage counters — AI identifications are counted against the same visitor_hash, and against your account number once you are signed in.
  • Affiliate links — when you follow a link to eBay, eBay may set its own cookies under its own policy.

We do not use third-party advertising or analytics trackers, and we do not record your sessions.

eBay data and account closure

When you connect your eBay account, we store the OAuth tokens needed to act on your behalf and we process the listings, orders and completed sales returned by eBay’s APIs. You can disconnect at any time from your settings; see User data deletion.

We operate the eBay Marketplace Account Deletion/Closure endpoint at /ebay/marketplace-account-deletion. When eBay notifies us that an account has been closed, we verify the notification signature and erase the corresponding data: eBay OAuth tokens, listings and listing templates, collection items, snipes, watched cards, saved searches, bulk listing jobs and portfolio history. Your Puck Flip login and subscription are kept, because they belong to your Puck Flip account rather than to eBay; the account simply returns to a state where no eBay account is connected.

Where data is processed

Our server and database are hosted in Québec, Canada. Several of the providers listed above (in particular eBay, Google, Meta and Stripe) operate outside Québec and outside Canada, including in the United States and the European Union: the information described for each of them is communicated to them there.

Your rights

You can ask to access your personal information, have it corrected, obtain a copy, withdraw your consent or have it deleted. Some of this you can do yourself:

  • Delete your account — Settings → Account → Delete my account. See User data deletion.
  • Disconnect eBay — Settings → eBay connection.
  • Download your data — Settings → Account → Download my data, as a JSON file. Your collection can also be exported as a CSV file from the collection page.

For anything else, write to support@puckflip.com. We respond within 30 days. We may ask you to confirm the email address associated with your account before acting on a request. You may also complain to the authority responsible where you live — in Québec, the Commission d’accès à l’information.

Security

Access to the workspace requires authentication, session cookies are HttpOnly and sent over HTTPS, eBay tokens are encrypted in our database, backups are encrypted with a key that is not kept on the server, eBay and Stripe notifications are signature-verified, and database access is restricted to the application. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The service is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

We may update this notice. The “Last updated” date above changes when we do. Material changes affecting how we use your data will be announced in the application.

This page describes our actual practices; it is not legal advice. See also our Terms of service, User data deletion and Affiliate disclosure.