Privacy policy

Last updated: September 2026. This notice describes how Puck Flip handles information in connection with this website, the signed-in workspace, and the eBay account you may connect to it. It also serves as the privacy notice required for eBay Partner Network participation.

Who we are

Puck Flip (puckflip.com) is operated by David Coutu, entreprise individuelle (travailleur autonome), Québec, Canada (NEQ 2272273188). David Coutu is the controller of the personal data described here.

Privacy inquiries, access requests and deletion requests: support@puckflip.com.

Information we process

• Public pages — Web server access logs (IP address, user agent, requested URL, timestamp) kept by the hosting stack for security and troubleshooting, plus the traffic counters described under “Cookies and measurement”.
• Account — If you sign in with Google or Facebook, the provider returns an email address, a display name and a provider identifier. We store these to create and secure your workspace account.
• Content you create — Draft and published listings, listing templates, collection items, saved searches, watched cards, snipes, portfolio snapshots and preferences.
• Card photos — Images you upload for card identification. See the dedicated section below.
• Connected eBay account — OAuth access and refresh tokens, your eBay user identifiers, and the listing, order and sales data we retrieve on your behalf.
• Billing — Subscription status, Stripe customer and subscription identifiers, and the email address passed to Stripe at checkout. We never receive or store your card number.
• Support email — Messages you send us and the address you send them from.

Card photos and AI identification

When you upload a photo of a card, the image is transmitted to third-party services to identify the card and find comparable items:

• Google — the photo is sent to the Google Gemini generative AI API to read the player, set, card number, parallel and condition cues.
• eBay — the photo is sent to the eBay Browse API image search to retrieve visually similar listings.

Photos are stored on our server under randomly generated file names so results can be displayed and reopened. Do not upload images containing personal information you do not want processed this way. You can ask us to delete your uploaded photos at any time using the contact address above.

Purposes and legal bases

• Providing the tools you request — performance of our contract with you.
• Securing accounts, preventing abuse and enforcing usage quotas — legitimate interests.
• Billing and subscription management — performance of contract and legal obligations.
• Affiliate attribution on eBay links — legitimate interests, disclosed on our Affiliate disclosure page.

We do not sell personal information and we do not use it for behavioural advertising.

Service providers

The following providers process data on our behalf or as independent controllers. Providers marked “feature-dependent” are only involved when the corresponding feature is enabled or used.

• eBay Inc. — OAuth sign-in to your eBay account, listing publication, order and sales retrieval, market and image search, affiliate link attribution.
• Google LLC — Google sign-in, and the Gemini generative AI API used to identify uploaded card photos and to filter sold-item results.
• Meta Platforms — Facebook Login, when you choose that sign-in method.
• Stripe, Inc. — subscription checkout, billing portal and payment processing.
• OVHcloud — hosting. Our application server and database are located in Québec, Canada.
• Hostinger — outgoing SMTP for service and error notification emails.
• Sentry — error and exception reporting (feature-dependent). We do not attach account identifiers to these reports.
• SerpAPI — retrieval of completed eBay sales (feature-dependent; text queries only, no photos).
• SportsCardsPro — reference card values (feature-dependent; card identifiers only).
• CardHedge — alternative source of recent sales (feature-dependent; card identifiers only).
• GemRate — PSA population and gem-rate data (feature-dependent; card identifiers only).
• Gixen — auction sniping, only if you use that tool. The item number, your maximum bid and your Gixen session credentials are transmitted to Gixen.

Retention

• Account and content — kept while your account exists, then deleted when you ask us to close it.
• eBay item data caches (card analyses, sold-item results, AI filtering of sold items) — 7 days, then purged by a daily job.
• Price engine data (observed active listings, unmatched titles) — 30 days after the last time the listing was seen.
• Public card search cache (eBay Browse results) — served for 1 hour, rows deleted after 7 days.
• PSA population cache — 7 days.
• USD/CAD exchange rate — refreshed daily, considered stale after 72 hours.
• Usage counters tied to the free-trial and rate-limit gates — up to 365 days, keyed to a hash, never to a stored IP address.
• Database backups — rotated after 7 days.

Retaining eBay item data beyond what is needed is not permitted by eBay, which is why the caches above are purged on a fixed schedule rather than kept indefinitely.

Cookies and measurement

• PHPSESSID — strictly necessary session cookie, lifetime 30 days, HttpOnly, SameSite=Lax, Secure over HTTPS. It keeps you signed in; it is not used for advertising. It is only set once you sign in.
• pf_csrf — strictly necessary anti-forgery token for visitors without a session (free trial, sign-in forms). HttpOnly, SameSite=Lax, deleted when the browser closes.
• dc_locale — your language preference (French or English), lifetime 1 year. Functional only; set when you switch language.
• pf_has_account — set at your first sign-in, lifetime 1 year, HttpOnly, SameSite=Lax. It only tells the public home page to show “Open the app” instead of the free-trial pitch. It contains no identifier and is not used to track you across sites.
• pf_utm — set only when you arrive through a link carrying utm_ parameters (a post, an ad, a newsletter), lifetime 90 days, HttpOnly, SameSite=Lax. It stores the source, medium and campaign names of that first visit, nothing else, so that we can count which channels bring new accounts. No identifier, no cross-site tracking.
• None of these cookies requires consent under Québec’s Law 25, PIPEDA or the EU ePrivacy rules: they are either strictly necessary or store a preference you chose. No cookie is used to identify, locate or profile you.
• Traffic measurement on public pages — page views and affiliate link clicks are recorded server-side with a visitor_hash: a SHA-1 of your IP address, the current UTC date and your user agent. The raw IP address is not stored in that table, and because the date is part of the hash it changes every 24 hours.
• Free-trial counter — a second, date-free hash of IP address and user agent is used to count the free identifications allowed without an account. Again, no raw IP address is stored.
• Affiliate links — when you follow a link to eBay, eBay may set its own cookies under its own policy.

We do not use third-party advertising or analytics trackers on this site.

eBay data and account closure

When you connect your eBay account, we store the OAuth tokens needed to act on your behalf and we process the listings, orders and completed sales returned by eBay’s APIs. You can disconnect at any time; see User data deletion.

We operate the eBay Marketplace Account Deletion/Closure endpoint at /ebay/marketplace-account-deletion. When eBay notifies us that an account has been closed, we verify the notification signature and erase the corresponding data: eBay OAuth tokens, listings and listing templates, collection items, snipes, watched cards, saved searches, bulk listing jobs and portfolio history. Your Puck Flip login and subscription are kept, because they belong to your Google or Facebook identity rather than to eBay; the account simply returns to a state where no eBay account is connected.

Where data is processed

Our server and database are hosted in Québec, Canada. Several of the providers listed above (in particular eBay, Google, Meta, Stripe and Sentry) operate outside Canada, including in the United States and the European Union. Transfers rely on the providers’ own contractual safeguards.

Your rights

Depending on where you live — Québec (Law 25), Canada (PIPEDA), the EU and UK (GDPR), California (CPRA) and other regimes — you may have the right to access your personal information, correct it, delete it, obtain a portable copy, withdraw consent, or object to certain processing. To exercise a right, write to support@puckflip.com. We respond within 30 days. We may ask you to confirm the email address associated with your account before acting on a request. You may also complain to your local supervisory authority — in Québec, the Commission d’accès à l’information.

Security

Access to the workspace requires authentication, session cookies are HttpOnly and sent over HTTPS, eBay and Stripe webhook payloads are signature-verified, and database access is restricted to the application. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The service is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

We may update this notice. The “Last updated” date above changes when we do. Material changes affecting how we use your data will be announced in the application.

This page describes our actual practices; it is not legal advice. See also our Terms of service, User data deletion and Affiliate disclosure.

Confidentialité (résumé FR)