Privacy Policy

Last updated 2026-10-14

1. Who we are

Induxy, ..., is the data controller for the personal data described below. Contact us about privacy at .

2. What we collect

EzFlip is built to hold as little personal data as the product actually needs. Specifically:

  • Steam identity. Signing in with Steam gives us your SteamID64, your Steam persona (display) name, and your Steam avatar URL. Steam's OpenID sign-in does not hand us an email address, a real name, or your Steam password. We never see or store any of those.
  • Portfolio data. Positions you open or import (what you bought, on which market, for how much, and if closed, what you sold it for) is stored against your account so your portfolio and P&L can be shown back to you.
  • Marketplace API credentials, only if you choose to connect a market (Skinport, CSFloat, DMarket, Waxpeer, or Market.CSGO) for trade-history sync. The key is encrypted at rest with a rotatable master key; we store a masked hint (e.g. the last few characters) for you to recognize it, never the key in plain text.
  • Webhook URLs, if you set up price alerts (e.g. a Discord or generic webhook URL you provide). Also encrypted at rest. Note that an alert sends the matching opportunity's data to whatever URL you configure: that delivery is between your browser/our server and the endpoint you chose, not reviewed by us.
  • Billing data. If you subscribe to a paid plan, Stripe collects your payment details directly. EzFlip never sees or stores your card number. We keep your Stripe customer/subscription IDs and the billing email you gave Stripe at checkout. This billing email is display-only: it is never used to look up, merge, or identify your account, which stays keyed on your SteamID64.
  • Technical data. Standard server request logs (IP address, timestamp, requested path, user agent, referrer) for security, abuse prevention, and aggregate service analytics (how much traffic the site gets, which routes and countries it comes from), and a session cookie that keeps you signed in. See Cookie Policy.

We do not run any advertising or cross-site tracking script, and do not build an advertising profile of you. We do run cookieless, aggregate traffic analytics (Cloudflare Web Analytics) — it reports counts like page views, referrers, and country, never anything tied to you individually, and sets no cookie and stores nothing in your browser. See Cookie Policy for what that does and doesn't involve. If a per-visitor tracking script is ever added, this page and the Cookie Policy will be updated first.

3. Why we process it, and on what legal basis

  • Providing the account, portfolio, syncs, and alerts: necessary to perform our contract with you (GDPR Art. 6(1)(b)).
  • Billing: necessary to perform the subscription contract, and to comply with tax/accounting obligations (Art. 6(1)(b) and (c)).
  • Security, fraud/abuse prevention, service reliability, and aggregate traffic analytics: our legitimate interest in keeping the service working, secure, and understanding how it's actually used (Art. 6(1)(f)).

4. Who we share it with

  • Stripe: payment processing for paid plans.
  • Valve/Steam: to authenticate your sign-in and, if you use the Inventory Advisor, to read your public Steam inventory.
  • The marketplace(s) you connect (Skinport, CSFloat, DMarket, Waxpeer, Market.CSGO): we call their API using the key you provided, only to read your trade history for sync.
  • A webhook endpoint you configure (see §2), including a Discord server, if that's what you point an alert at.
  • Cloudflare: our CDN/edge proxy, in front of every request to this site regardless of how you interact with it, and our cookieless aggregate analytics provider (see §2 and the Cookie Policy).
  • Our hosting provider, which stores the infrastructure this runs on.

We do not sell personal data, and do not share it with data brokers or advertisers.

5. Security

Marketplace API keys and webhook URLs are encrypted at rest under a versioned, rotatable master key; session cookies are cryptographically signed; every API route defaults to requiring authentication unless explicitly marked public. Full detail is in our public SECURITY.md. No system is perfectly secure, and we can't guarantee absolute security, but we treat credential handling as the highest-risk part of this product and build accordingly.

6. Retention

We keep your account data for as long as your account exists. Deleting your account deletes your positions, marketplace credentials, and webhooks along with it. Billing records are kept for as long as tax/accounting law requires even after account deletion. Request logs (§2) are kept for 7 days and then deleted. To request deletion, contact us at .

7. Your rights

Under GDPR, you have the right to:

  • access the personal data we hold about you;
  • correct inaccurate data;
  • request deletion ("right to be forgotten");
  • restrict or object to certain processing;
  • receive your data in a portable format;
  • withdraw consent at any time, where processing is based on consent;
  • lodge a complaint with a supervisory authority: for us, ....

To exercise any of these, email .

8. International transfers

Where a processor (e.g. Stripe) is based outside the EEA, we rely on that provider's own GDPR-compliant transfer mechanism (such as Standard Contractual Clauses).

9. Changes to this policy

We'll update the "Last updated" date above whenever this policy changes materially, and will notify active subscribers of significant changes.