Privacy policy

Scope

ZeroFlip is a paper-trading simulator with an optional read-only REAL journal. The extension never connects to a wallet, requests keys or seed phrases, or places real orders. This policy covers the extension and its optional account/sync service, not the separately developed ZeroFlip Live companion.

Who is responsible

The controller for personal data processed by ZeroFlip is Prianshu Lal (postal address not supplied yet). Contact: Support email has not been supplied yet.

Data on your device

Simulated trades, balances, orders, notes, tags, journal attachments, recorded REAL confirmations and settings are stored in extension storage and IndexedDB. Price snapshots form a rolling 24-hour history; older snapshots are cleaned up while the browser is running. Custom theme backgrounds stay local and are never synced. API keys you enter for optional services are kept in local settings and used with the provider you select.

Normal and Alpha builds cannot connect to ZeroFlip Live or send real orders. The separate Live project is unreleased.

What ZeroFlip reads

On GMGN, Axiom, Terminal, Fomo, Trojan, Photon, Cielo, Shotgun, Definitive and Azura: the URL, tab title and visible token address, symbol, price, market cap and liquidity. It identifies the terminal's trade controls and trade box for REAL-mode framing, and reads visible trade confirmations if you enable the REAL journal. Normal page reading does not access the terminal's cookies, storage, session tokens, keys or text you type.

Reports and page captures

Report problem creates a local diagnostic report and copies it to your clipboard or displays it for manual copying. It includes browser/extension versions, simulator settings, terminal recognition, price-source status, errors and counts of trades/orders. The widget report does not deliberately include trade history, wallet addresses or balances; review errors before sharing. A separate Dashboard debug export includes recent trades only if you select that option.

Save page snapshot downloads page HTML and available CSS without page scripts, iframes or ZeroFlip's overlay. It can include visible wallet addresses, balances, account labels and other personal information. Review and redact captures before sharing. Neither action sends anything automatically. Support receives only messages and files you choose to send; never send keys or seed phrases.

Network requests

Each recipient receives your IP address and ordinary request metadata. DexScreener (api.dexscreener.com) receives token/pair addresses for public prices and liquidity. Jupiter (api.jup.ag) receives Solana token addresses for live prices, and planned sizes and your API key for optional route quotes. GeckoTerminal (api.geckoterminal.com) receives pool identifiers for chart history or Replay. Copy-a-wallet sends the public wallet addresses you add to your selected Solana RPC provider, including any credentials in the configured provider URL. Builds configured for remote selectors download signed page-reading rules without sending trade history or wallet balances.

Browser notifications are off by default and generated locally. Referral links open when clicked; the destination receives a normal request and the referral identifier.

When you uninstall

The site's feedback page opens after you remove ZeroFlip. Its address carries only the version number. Choosing a reason opens an email to us, and nothing is sent unless you send it.

Optional account and sync

Only in builds configured with an account API: signing in stores your email, account identifier, hashed login codes and session tokens, and creation/expiry timestamps. Codes expire after 10 minutes and are sent through the configured email provider (currently Resend). To prevent abuse the API limits requests per IP address and per email address; these counters are stored only as one-way hashes and deleted within about 3 days (an account's email counters immediately when it is deleted). The hosting provider keeps short-lived request logs (path, time and network metadata such as IP address) for operating the service.

Sync encrypts ledger events on your device with a key derived from your passphrase. The server stores ciphertext, event identifiers, sequence numbers and timestamps. Your passphrase and key are not uploaded and cannot be recovered by the service. Theme backgrounds and journal image attachments are not part of ledger sync. Account and synced data remain until you delete the account.

Optional usage counters are off by default; if collected, they store event names and daily totals, without trade contents or token/wallet addresses. Network infrastructure still sees request metadata. Anonymous aggregate counters cannot be linked back to an account for deletion.

Deleting data

Dashboard → Settings → Your data → Delete all data, or uninstalling, removes local extension data: trades, orders, notes, attachments, price history, alerts, saved card designs and media, your card profile, copy-trading wallets and log, and API keys and RPC URLs. Only look and behaviour choices (theme, frame, language and similar) are kept. Delete exported files and downloaded captures yourself. Local deletion does not delete cloud data: use Dashboard → Account → Delete account to remove the account, sessions, synced events, any pending login code and the account's email request counters. Synced events may return if sync remains enabled on another installation.

Legal bases

Under the GDPR: providing an account and sync you asked for (Art. 6(1)(b)); IP-based abuse limits and answering support messages (legitimate interest, Art. 6(1)(f)); optional usage counters only with your consent (Art. 6(1)(a)), which you can withdraw in Settings at any time. Data on your device is not processed by us. In builds with an account, the API runs on Cloudflare and sign-in emails go through Resend; both may process data outside the EU under the EU Standard Contractual Clauses.

Cookies and tracking

The extension sets no cookies. This website sets no cookies, stores nothing in your browser and has no analytics, advertising trackers or third-party code, so there is no cookie banner. Its only script is its own black-hole animation on the home page, which sends nothing anywhere. ZeroFlip does not sell or share personal data for advertising.

Children

ZeroFlip is for adults (18+) and is not directed at children. If you believe a child has created an account, contact us and we will delete it.

Your rights

Your trading data is on your device: export it any time (Dashboard → Settings → Your data → CSV or backup) and delete it with Delete all data. For an account, Delete account removes it immediately. To ask about, correct or delete any data we hold, or to object to processing, use the contact below; we answer within 30 days. You may also complain to the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at) or the authority where you live.

Affiliate disclosure

Affiliate link: ZeroFlip may earn a commission if you sign up. It costs you nothing extra. Referral links can be hidden in Settings.

Contact

Support email has not been supplied yet.