Privacy Notice

Who is responsible

Flipwise is operated by Misinformed Dev, Sydney, Australia. We are the controller for the personal data we collect about users of the website, the API and the RuneLite plugin. Privacy questions and requests: kristophbarbour.game@gmail.com.

What we collect, and why

  • Website account: your Discord user id, username, avatar and, if your Discord account has a verified one, your email address. We receive them from Discord when you log in and use them to create and show your account. We store no password. The email address is used for one thing: checkout opens with it filled in and fixed, so a purchase always belongs to the right account and we can tell that you already have a subscription before you could pay twice. We do not send marketing email.
  • Subscription: Paddle.com, our Merchant of Record, takes the payment and is a controller of your payment data in its own right; we never see card details. When you open checkout we pass Paddle your email address, your country if our network told us one, and our internal id for your account. Paddle tells us your subscription's status, its billing period, and its Paddle customer and subscription ids.
  • Plugin: the RuneLite plugin requests tips from our servers. The request carries your IP address and, if you configured one, your plugin token (we store only a hash of it, and when it was last used). It carries no game data: not your character name, cash, offers, inventory, bank or trade history. Those stay in your RuneLite client.
  • Alerts: if you turn on Discord alerts, the settings you choose (thresholds and watched items), so our bot can send you the direct messages you asked for.
  • Logs: standard request logs (IP address, path, status, timing), kept for up to 30 days to prevent abuse and to debug problems.

Our legal bases are the performance of our contract with you (your account, the service, your subscription), our legitimate interests in keeping the service secure and working (logs, abuse prevention), and legal obligations where they apply.

What we do not do

We do not sell data, run advertising, or profile players. We do not track which suggestions you act on.

Who we share it with

  • Paddle.com, as Merchant of Record: the sale, subscription management and payments, tax compliance and invoicing.
  • Discord: login, and delivering the direct messages you asked for.
  • Infrastructure providers that host or carry the service for us, under contract.
  • Professional advisers (legal, accounting) and authorities, where the law requires it or to protect rights and safety.

Some of these providers process data outside your country, including in the United States and the United Kingdom. Where the law requires it, those transfers rely on an adequacy decision or on standard contractual clauses.

How long we keep it

Account data stays until you ask us to delete your account. Login sessions expire after 30 days, request logs after at most 30 days. Records of a subscription are kept for as long as accounting and tax rules require. Anything we no longer need is deleted or anonymised.

Cookies

We set only essential cookies: fw_session keeps you logged in (30 days), and fw_oauth_state protects the Discord login for the ten minutes it can take. There are no analytics or marketing cookies, so there is nothing to opt out of. Paddle's checkout, when you open it, may set its own cookies under Paddle's privacy policy.

Security

Traffic is encrypted in transit, plugin tokens are stored only as hashes, and access to the systems that hold personal data is limited to the people who run them.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to hand it to you in a portable form, and you can withdraw any consent you gave. We answer within one month. You can revoke plugin tokens yourself from your account page, and the plugin's local trade log lives in your RuneLite folder and is yours to delete. If you think we got it wrong, you can complain to the data protection authority where you live.

Data sources

Prices come from the OSRS Wiki real-time prices API, crowdsourced through RuneLite, used under CC BY-NC-SA 3.0.