Privacy Policy

Last updated: 10 September 2026  ·  Version 1.12.3

1. What we collect

Flick does not collect personal data from the extension: it never asks for your name, phone number, or any personally identifying information, and no personal data leaves your device in normal use. The one exception is at payment: when you complete a Stripe checkout for a Pro licence or a free trial, Stripe shares the email address you enter there with Flick's Cloudflare Worker, which stores it on your licence record to issue your key and to recognise you if your subscription lapses and you return. The record is kept for the customer relationship and is deleted on request (see Contact). Users who never start a checkout never have an email address collected.

2. What stays on your device

The following data is stored locally in your browser using chrome.storage.local and never leaves your device:

• Your Vinted session token and CSRF token - read from your existing browser session to make API calls on your behalf. These are never transmitted anywhere other than Vinted's own servers.
• Your Vinted user ID - used to fetch your wardrobe listings.
• Sent-offer history - which items and buyers you've sent offers or messages to, including offer price, discount, currency, original price, item title, thumbnail, and buyer username. Used to prevent duplicate offers and to power your Analytics. Automatically pruned after 90 days.
• Repost run logs - timestamps, items reposted, measured run durations, and any failures for each repost run. Capped at 100 entries.
• Scheduled repost definitions - your configured schedules including days of week, time, item limit, rotation cursor, safe mode, peak hours, and offer cooldown settings.
• Smart Rules (Pro) - your saved rule definitions (accept%, counter%, auto-action, buyer/item conditions), the action log (rule matched, offer price, decision, timestamp, success/failure), and pending recommendations awaiting your review. Persisted locally; never leaves your device.
• Analytics event logs - aggregated counters used for honest counts, conversion bands, best-posting-time guidance, and weekly summaries. Derived from your own run and offer history; never leaves your device.
• Offer message templates - reusable offer/message text you save, with optional {item}, {price} and {discount} variables.
• Restriction-detection evidence - when Vinted returns certain errors during a Flick run, a short excerpt of the error response (up to 300 characters, never including tokens, cookies, or item titles) is kept on your device so Flick can recognise a Vinted listing-restriction notice and pause itself. Capped at 20 entries, pruned after 7 days, and it never leaves your device.
• Your preferences - which tab you last used, selected discount percentage, and whether you've seen the onboarding screen.
• Your Pro licence key - stored locally for quick validation (cached with a short expiry). The key itself is generated by the Cloudflare Worker backend and sent only to that worker for validation.
• Daily usage counters - number of reposts and offers sent today, used to enforce free-tier limits (3 reposts/day, 5 offers/day for free users), plus the Smart Rules auto-actions performed today (25/day budget) and the scheduled reposts started today (8/day safety ceiling) for Pro users. The authoritative counts are also reported to the licence worker under the same hashed identity as trial protection (counts only - never what the items were), so a storage wipe or clock change cannot reset the allowances or the safety caps; the local copy is kept for offline fail-open. Resets each day (worker UTC midnight; displayed at your local midnight).
• Trial-protection identifiers - a random per-install device ID, a wipe-surviving profile token (mirrored into IndexedDB), and a SHA-256 hash of your Vinted user ID. Sent to the licence worker so the 7-day free trial can only be used once per install / per Vinted account. The raw Vinted user ID is never transmitted; only its hash is. For daily-usage enforcement only, the extension also sends a hardware fingerprint hash: a SHA-256 derived from stable device characteristics (platform, CPU-core count, memory, user-agent), salted with the extension's install id and recomputed on load, never stored. Only the hash is transmitted - the raw characteristics never leave the device - and it enables the free-tier allowances and Pro safety caps to survive clearing extension data or a full reinstall on the same device. The free-trial CTA also checks that your Vinted account is established (a completed sale or an account at least 30 days old) so the trial is not offered to freshly created accounts, and stores a small local marker (a Vinted-account hash and a timestamp) inside Vinted's own browser storage on the Vinted site so a trial cannot be re-claimed for another Vinted account on the same browser after the extension is reinstalled; clearing Vinted site data removes it. Trial-claim metadata (the hashed identities above, the email domain, and the IP recorded by Stripe at checkout) is kept for up to 90 days and is only accessible to the operator for abuse review and revocation.

All of this data is stored only inside your browser and is removed when you uninstall Flick from Chrome; individual history lists can also be cleared with their own "Clear all" buttons. Nothing in this list is stored on Flick's servers. The one exception is the trial-prevention marker written into Vinted's own browser storage (described above), which survives an uninstall and is only removed when you clear Vinted site data.

3. What we do NOT do

• We do not collect personally identifying information from the free extension, and we never ask for your name or phone number at any point.
• We do not use cookies set by us.
• We do not store your Vinted password. Authentication works through your existing Vinted browser session - the same session cookies your browser already uses when you visit Vinted.
• We do not sell, share, or rent any data.

4. How the extension works

Flick reads your Vinted session tokens from cookies and uses them to make API calls to Vinted's own servers (www.vinted.co.uk and equivalent regional domains) on your behalf. This is the same mechanism your browser uses when you browse Vinted normally. The extension acts as an interface - all data flows between your browser and Vinted, with nothing in between.

For scheduled reposts, Flick uses Chrome's built-in alarm API to trigger repost runs at your configured times - even when the extension popup is closed. When an alarm fires, the extension briefly wakes up, performs the repost run using your cached session, and sends you a Chrome notification with the result.

How often Flick re-lists an item, how much it can do per day, and what happens automatically when Vinted pushes back - the full pacing rules are published on the re-listing rules page.

5. Permissions we use and why

• tabs - to open a hidden Vinted tab temporarily so API calls can bypass Cloudflare protection, and to detect which Vinted regional domain you use.
• scripting - to run scripts inside a Vinted tab so API requests inherit your session cookies. Required for authentication.
• cookies - to read your Vinted domain from session cookies so we connect to the right regional site (vinted.co.uk, vinted.fr, etc.).
• storage - to save your preferences, run logs, offer history, templates, and licence cache locally in your browser.
• alarms - to fire scheduled repost runs at your chosen times, even when the extension popup is closed.
• nativeMessaging - lets the extension talk to the optional Flick wake helper installed on your computer, so a scheduled repost can run even when Chrome is closed. This permission only allows communication with Flick's own helper; if you never install the helper it is never used.
• Host permissions (22 Vinted domains + Flick's two Cloudflare Workers) - to make API calls to Vinted's endpoints on your behalf across all supported regional domains (vinted.co.uk, vinted.fr, vinted.de, etc.), to validate your Pro licence key with the licence worker, to mirror scheduled-repost fire times to the scheduler worker so runs can be recovered after Chrome was asleep, and to receive empty Web Push wake signals from the scheduler worker at exact fire times.

6. Third-party services

The extension communicates only with:

• Vinted's own servers (*.vinted.co.uk, *.vinted.fr, and equivalent regional domains) - for all API calls: wardrobe listing, item detail, photo upload, item creation/deletion, conversation creation, and offer sending.
• Flick's Cloudflare Workers (flick-licence.flick-licence.workers.dev and flick-scheduler.flick-licence.workers.dev) - the licence worker validates your Pro licence key, checks your free-trial status, creates Stripe checkout sessions, tracks daily usage (free-tier quotas plus the Smart Rules and scheduled-repost safety caps), and serves remote configuration (feature switches and telemetry settings); the scheduler worker stores the fire times of your armed scheduled reposts (absolute timestamps only, no item data), returns them when a missed fire is due, and can send an empty Web Push notification (no payload, used only to wake the extension at the exact fire time). Licence and usage requests include the licence key string plus the trial-protection identifiers described above (device ID, profile hash, hashed Vinted user ID, and a salted hash of stable hardware characteristics - never the raw Vinted ID, raw device characteristics, or any listing/buyer data) and the device's IANA timezone (so the daily usage window resets at the seller's local midnight), and for daily-usage tracking the action and count (e.g. "repost" or "smart_rules", 1) under that hashed identity; scheduler requests include schedule ids and fire timestamps, and the scheduler worker keys the mirrored fire times by the same hashed identity (never the raw Vinted ID, raw device characteristics, or any listing/buyer data) so they survive clearing extension data or a full reinstall on the same device. The worker also keeps transient per-IP request counters (a 60-second key derived from Cloudflare's connecting-IP header) to rate-limit these endpoints against abuse - the counters expire within a minute and are never associated with your account, identity hashes, or extension data.
• Stripe - when you upgrade or start a free trial, checkout happens on Stripe's own pages. Flick never sees your card details. Stripe sends Flick's worker the email address entered at checkout, which is stored on your licence record to issue and deliver your licence key (kept for the customer relationship, deleted on request). Trial-claim metadata - the email domain and the IP address Stripe records at checkout - is used only in the 90-day trial-abuse review described in section 2.
• PostHog (eu.i.posthog.com) - product analytics to help us understand which features are used and where users encounter errors. We track feature usage events (e.g. "repost started", "offers sent") and error events (e.g. JavaScript errors in the popup). When Vinted's restriction notice is detected, one aggregate restriction_detected event records only the date, the surface involved, and how it was detected - never which item, which account, or any content. We do not track page content, item titles, prices, buyer names, or any personally identifying information. Each install is identified only by a random ID generated on that device (never the extension ID). This can be disabled remotely from the licence servers.
• Sentry (sentry.io - US and EU ingest endpoints) - crash and error reporting to detect outages quickly (for example, if a Vinted endpoint changes and breaks a feature). Error reports contain the extension version, the error message and stack trace of Flick's own code, and the HTTP method + status + URL path template of failed requests, with numeric IDs masked. Reports never include item titles, buyer names, session tokens, cookies, or request/response bodies. This can be disabled remotely from the licence servers.
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com) - the Inter web font used by the popup interface. Opening the popup requests the font stylesheet and font files from Google's servers, which receive your IP address and browser user-agent exactly as they would when loading any web font. No other data is sent, and the popup falls back to your system fonts if the request fails.

No third-party advertising or tracking services are used anywhere in the extension.

7. Removed surfaces

The live extension does not include AI drafting, multi-account automation, bundle messaging, quick-reply sending, bulk price editing, label batching, auto-restocking, or post-sale messaging. Their source is retained in the repository archive only and is not built or shipped.

8. Children's privacy

Flick is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above and bump the extension version. Continued use of the extension after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this privacy policy? Email the developer at useflick.app@gmail.com.

---

Flick is an independent tool and is not affiliated with, endorsed by, or connected to Vinted UAB.