Legal

Privacy Policy

What Flogit touches, what stays on your computer, and the few things that leave it. Written to match what the software actually does.

Effective 18 July 2026 · last updated 15 October 2026

Flogit is a browser extension that helps Vinted sellers manage their own shop: inventory, sales, offers, pricing, and creating listings. This policy explains exactly what data Flogit touches, what stays on your computer, and the few things that leave it. It is written to match what the software actually does; where a term is technical we say plainly what it means.

Who we are. Flogit is operated by Lost In The Tabs, Amoreiras Square, R. Carlos Alberto da Mota Pinto nº17, 3rd Floor A – Escritório 317, 1070-313 Lisboa, Portugal. For any privacy question, or to exercise the rights below, contact us at [email protected].

The short version

Almost everything Flogit knows about your shop stays on your own computer: your inventory, order history, buyer offers, messages, market estimates and your private cost/expense notes are stored locally in your browser. The only copies we keep are a backup of your listings and a short summary of your shop for the app (Section 3.8).
You sign in to Flogit with an account: your email and a password, or Google or X. It exists for three things: to keep your plan with you on any browser, to keep a backup of your shop's listings, and to show a short summary of your shop on a browser without the extension, such as your phone (Section 3.8). We use your email to sign you in and to send you emails about your account (Section 3.7). We send you the newsletter, or a daily email of new items from your saved searches, only if you ask for it.
Your listings are backed up to your account. The title, description, details and photos of each listing in your Vinted shop are copied to our servers (Cloudflare, EU) so you keep them if a listing, or your Vinted account, disappears. Your sales, messages, offers and books are not part of it and stay on your computer.
A few things leave your device, and only when you use the feature that needs them: the text of a listing you ask AI to help with, the conversation with a buyer when you ask for a suggested reply or a translation, a market search term, and (if you use photo autofill or phone upload) the photos of the item you are listing. Phone-upload photos are deleted as soon as your computer picks them up.
The extension has no analytics, trackers, or advertising SDKs. None. This website counts visits with Cloudflare Web Analytics, which sets no cookie. Google Analytics, which does set a cookie, runs only if you accept it in the cookie notice. Neither is used for advertising or linked to you personally.
We never see, store, or transmit your Vinted password or your Vinted login session.
If you also sell on Wallapop, Flogit reads your Wallapop shop the same way: in your browser, from a Wallapop tab you have open. What it reads stays on your computer (Section 2).
If a parcel was not collected or is coming back, Flogit can show where it waits: only after you allow it, the extension reads that parcel's Vinted Go tracking page in your browser. What it reads, the pick-up point and the days left, stays on your computer.

1. What stays on your device and is never sent to us

Flogit keeps the working data of your shop in your browser's own storage (chrome.storage.local and a local database). This data is not transmitted to Flogit's servers, to Vinted, or to anyone else. It includes:

Inventory: your items, and any SKU, purchase price, quantity, or notes you add.
Sales and orders: order history, cost-of-goods and per-order notes you enter, and the buyer's name when Vinted shows it on the shipping screen (never their address).
Market estimates: the comparable-listing prices Flogit computes for you and its record of which comparable listings have come and gone over time.
Buyer offers and negotiation data: offers received, conversation-read markers, and records used to flag repeat low-ballers (which may include a buyer's public Vinted username).
Your private ledger: any purchases and expenses you record in Flogit.
Dispute-evidence photos: if you capture item photos as evidence, the image files are stored locally in your browser (IndexedDB) and are never uploaded.
Invoices (Vinted Pro): if you turn on invoices, the invoices and credit notes you issue, with your business details and the buyer's name and billing address, which Flogit reads from Vinted for that sale. The buyer's email address is not kept.
InvoiceXpress: if you connect your InvoiceXpress account instead, each invoice (the buyer's name and billing address, the items and prices) goes straight from your browser to your own InvoiceXpress account, with your API key, which stays on your device. It does not pass through Flogit's servers.
Moloni: if you connect your Moloni account instead, each invoice (the buyer's name and billing address, the items and prices) passes through Flogit's server on its way to your own Moloni account, because Moloni's API cannot be called from a browser. Nothing of it is stored or logged there. The keys that let Flogit reach your Moloni account stay on your device; our server holds them for at most five minutes while you connect.
FacturaDirecta: in Spain, if you connect your FacturaDirecta account, each invoice (the buyer's name and address, the items and prices) and your FacturaDirecta API key pass through Flogit's server on their way to your own FacturaDirecta account, because FacturaDirecta's API cannot be called from a browser. Nothing of it is stored or logged there; the key stays on your device.
TS Facturas: in Spain, if you connect TS Facturas (formerly Billin) instead, each invoice (the buyer's name, the items and prices) goes straight from your browser to your own TS Facturas account, with your API credentials, which stay on your device. It does not pass through Flogit's servers.
Fatture in Cloud: in Italy, if you connect your Fatture in Cloud account, each invoice (the buyer's name and address, the items and prices) passes through Flogit's server on its way to your own Fatture in Cloud account, because its API cannot be called from a browser. Nothing of it is stored or logged there. The keys that let Flogit reach your account stay on your device; our server holds them for at most five minutes while you connect.
Buy: your saved searches, your favourites and what your alerts found. A search on Wallapop goes from your browser straight to Wallapop, and one on Vinted runs in your own Vinted session.
Wallapop: which of your items are also on Wallapop, and your finished Wallapop sales (title, price, date, how it was delivered and, for a shipped sale, the buyer's short name, city and country).

Because this data lives in your browser profile, clearing the extension's storage or removing the extension deletes it. Apart from the listings backup and the short summary of your shop for the app, both in Section 3.8, none of it is sent to us.

2. How Flogit reads your Vinted data

Flogit reads your Vinted shop through Vinted's own website, from within the Vinted tab, using the login session you already have open in your browser. Concretely:

Flogit never handles your Vinted password.
Flogit never reads, copies, or transmits your Vinted login cookie. That cookie is attached by your browser only to requests to Vinted itself; Flogit's requests to its own backend deliberately send no cookies.
Reading your Vinted data (items, orders, offers) happens locally in the page and is used to populate the on-device data described in Section 1.

Wallapop

If you use Flogit with Wallapop (sending items there, or seeing your Wallapop sales), it works the same way, with one difference worth stating plainly:

Flogit's Wallapop requests run inside a Wallapop tab you already have open, with the sign-in token that Wallapop's own page uses for the same requests. Flogit reads that token there and sends it only to Wallapop. It is never sent to us and never stored.
Flogit never handles your Wallapop password.
What it reads: your listings on sale and sold, your finished sales (title, price, date, how it was delivered and, for a shipped sale, the buyer's short name, city and country), and whether you are signed in, with your Wallapop name and photo. This stays on your computer (Section 1).
The number of views and favourites of your Wallapop listings is read from Wallapop's public listing record, without your session.
Flogit only changes something on Wallapop when you press the button: publishing a listing you reviewed, or deleting one you confirmed.

3. What leaves your device, and where it goes

Flogit's backend runs at api.flogit.app (hosted on Cloudflare). Requests to it go through the extension's background worker, which attaches your account's session token, so the backend can apply your plan's allowance (Section 3.1). The following, and nothing else, is sent off your device:

3.1 Your plan: to apply its allowance

Your plan is kept on your Flogit account (Section 3.7). You choose it, change it or cancel it in Flogit, and Creem, our payment provider, handles the payment. Creem tells us which plan the account has, its status and its renewal date, and the backend applies that plan's allowance to your account.

A licence key, only if you have one from before. Plans used to come as a Creem licence key pasted into Flogit, and such a key is still accepted. It is sent to Creem to confirm the plan it grants. We store a one-way hash of it for that check, and the key itself only encrypted on your account (Section 3.7).
An anonymous device id. The extension also sends a random identifier generated on your device. It is not derived from you, your browser or your Vinted account. It told browsers apart before accounts existed, and the backend no longer uses it to apply your plan. You can erase it at any time by clearing the extension's storage.

3.2 Listing text: when you use AI writing help

When you ask Flogit to improve a listing or suggest a price, the relevant text is sent to our backend and on to Anthropic (the "Claude" AI provider) to generate the suggestion. Depending on the feature this text may include: the item's title, description, brand, category, size, condition and price, and, for negotiation help, the listing and offer prices and the text of the buyer/seller messages in that conversation. For a suggested reply to an offer or a message, that also includes the buyer's public Vinted username. If you turn on writing in your own style, the text of up to three of your own listings is sent as an example. When you turn on translation in Messages, the buyer's messages and your inbox previews are sent the same way, to translate them into your Flogit language, until you turn it off. When you send an item to Wallapop, its title, description, size and condition are sent the same way to write the Wallapop title and description and to choose its Wallapop category. This is used only to produce the suggestion you asked for.

3.3 A search term: for market comparisons

When Flogit estimates a resale value, it may send a search phrase (built from the item's title and brand) to our backend, which queries the eBay Browse API. Only the search phrase is sent, with no identity or account information. The words you search on the Buy page reach eBay the same way. To search Vinted in the languages of nearby countries too, those words also go to Anthropic to be translated, once per search.

3.4 Item photos: only if you use AI photo autofill

If you use the feature that reads your photos to fill in a new listing, the photos of the item you are listing are sent to our backend and on to Anthropic to detect the item's attributes (category, colour, and so on) and draft the listing. These photos:

are sent only when you click to run the feature, never automatically, never in the background;
are used only to generate that listing's details, in that moment;
are not stored on our servers after the request is handled, and are not used to train any AI model;
are the photos you chose to publish on Vinted anyway.

If you never use photo autofill or phone upload (Section 3.5), no image ever leaves your device through Flogit.

3.5 Photos you send from your phone: only if you use phone upload

If you use phone upload (the QR code that lets you photograph an item with your phone and have the pictures appear in the listing form on your computer), those photos necessarily pass through our servers, because that is the only way to get them from one device to the other.

We hold them as briefly as we can:

they are stored in Cloudflare R2 (EU), and deleted the moment your computer collects them, normally within a few seconds;
anything not collected is erased automatically when the link expires, 15 minutes after you open it, whether you collected it or not;
the link's address is a random 128-bit value that acts as its only key. It is shown only on your own screen, and reading the photos back additionally requires the same device that opened the link, so someone who photographed your QR code could add pictures to your form, but could never see what you uploaded;
they are not used to train any AI model and are not sent to Anthropic unless you separately choose to run photo autofill on them;
the phone shrinks each photo before sending it, so we never receive the original full-resolution file.

You start this flow deliberately, one session at a time. If you never open the QR, nothing is ever uploaded.

3.6 Vinted Pro credentials: only if you connect Vinted Pro

If you connect a Vinted Pro account, the API keys you provide are sent to our backend and stored encrypted; the signing key is decrypted only inside our server to sign requests to Vinted's Pro API on your behalf. Do not use this feature unless you have a Vinted Pro account and intend to.

3.7 Your account: email and password, or Google or X

Flogit asks you to sign in before it opens. You create the account with an email address and a password, or by continuing with Google or with X. What we hold:

Your email address, lower-cased. It is used to sign you in and to send you emails about your account: the confirmation link when you register, one welcome email once your address is confirmed, the link to choose a new password when you ask for one, and news about the requests you follow on the feedback board.
Your newsletter choice, only if you ask for the newsletter by ticking the box when you register or by turning it on in your account settings: that you want it, and when you said so. It is off unless you turn it on. Every newsletter has a link to stop it with one click, and you can turn it off at any time in your account settings.
Your password as a salted one-way hash (PBKDF2-SHA256). We never hold the password itself, and we never see your Google or X password.
If you use Google or X, the identifier the provider gives us for you and the confirmed email on that account. Nothing else is read from it: no contacts, no posts, no followers, and Flogit never posts or follows on your behalf. An X account with no confirmed email cannot be used to sign in.
A session token for each browser you sign in on, stored as a one-way hash and valid for 180 days from its last use, with the kind of browser and the country Cloudflare reads from the connection, so that an account used from many places at once can be spotted. The IP address itself is not kept. You can give each browser a name and sign any of them out from your account page.
Your recent sign-ins: when, how (password, Google, X or an emailed link), the kind of browser and the country, and whether the password was wrong, so you can spot a sign-in that was not you. Kept 90 days; never the IP address or the password.
Your plan, and your licence key, encrypted, if you activated one, so that signing in on another browser brings the plan with it.
Your profile, if you fill it in on the shop page: first name, last name, phone, address, tax number, website, Instagram, a short description and a profile photo. All of it is optional and shown only to you; the Flogit team sees it only when looking into your account, for support or to check it is not being misused, and Flogit uses it for nothing else. The photo is stored in Cloudflare R2 (EU).
If you add no photo, Flogit uses the public photo of your Vinted shop, and you can change or remove it on the same page.

These emails are sent through Resend, our email provider, which receives your address and the content of the email. If Resend cannot send one, the same email goes out from our own mailbox at our web host in Portugal, AlmourolTec (PTisp), instead.

Delete account, in Settings, erases all of the above and the backup below, immediately.

3.8 Your shop's backup

While the Flogit panel is open, it copies each listing in your Vinted shop to your account, a little at a time: the title, description, price, brand, size, condition, category and the other details of the listing, and its photos. When a listing later disappears from your shop, the copy stays and is marked as sold, hidden or gone.

It covers listings only. Your orders, messages, offers, buyers, costs and books are not copied and stay on your computer, as in Section 1; the only exception is the short summary for the app, below.
Photos are stored in Cloudflare R2 (EU), one copy per distinct photo, under your account only. The listing text is stored in Cloudflare D1.
The backup is yours to read and take. The Shop backup screen in Flogit shows it, lets you copy every text and download the photos, and publishes nothing unless you ask it to.
The risk report on that screen is computed from your own backup when you open it, and nothing about it is stored.
A summary for the app. The Flogit app at flogit.app/app also keeps a short summary of your shop, so a browser without the extension (your phone) can show it: for each listing its title, price, photo, condition and counters, and for each Vinted sale its title, price, photo, status and date. No buyer, message or address is in it. It is rewritten as your shop changes and erased with your account.
Your plan sets how many listings the backup keeps. Above that number it pauses and deletes nothing.
It is kept until you delete your account, which erases every listing and photo at once, or until you ask us to erase it.

We do not read your backup for any purpose of our own, and we do not use it to train any model.

3.9 A shipping label: only when you issue an invoice

Vinted no longer gives a seller the buyer's name and address, except to Pro accounts. When you issue an invoice and Vinted did not give them, Flogit sends a picture of that sale's shipping label to its server, which reads the recipient's name and address off it and sends them back for you to check. Nothing from the label is stored on our server.

3.10 Saved-search alerts: eBay on our server, and the daily email

When an alert's search includes eBay, we keep that search on our server (its words, price limits, the words it must have or leave out, and which eBay site) so it can ask eBay every hour, even with your browser closed. With it we keep the eBay listings it has already seen, and the new ones until your browser collects them. All of it goes when you turn the alert off or delete the search.

On the Buy page you can ask for one email a day with the new items your saved-search alerts found. Your browser then sends us those items (title, price, photo and link, all public listings) and the words of the search that found them. We keep them until the evening email goes out and then delete them, after two days at most. Every one of these emails has a link to stop them.

3.11 Vinted's form options: to keep the forms current

When your browser loads the options Vinted offers for a category (sizes, conditions, materials, colours, parcel sizes, the category list, or a brand you pick), it sends that list to our server, so Flogit can show it to other sellers and notice when Vinted changes it. These are Vinted's own public lists, the same for every seller: no listing, shop, buyer or account data is in them.

4. The personal data we hold, and for how long

We keep the minimum needed to run the service:

Data	Why	Where	Retention
Your plan	To apply your plan's allowance	Cloudflare D1, on your account: the plan, its status and renewal date, Creem's customer and subscription ids, any extra listings bought in a pack, and when you opened a checkout and for which plan	Until you delete your account
Licence key hash	Only if you activated a licence key: to confirm with Creem the plan it grants	Cloudflare D1, as a one-way hash; the key itself only encrypted on your account (below)	Until the licence is removed or stops being valid
Anonymous device id	No longer used to apply your plan; it told browsers apart before accounts existed	Generated on your device; the backend only sees it as an opaque string	Yours to erase by clearing the extension's storage
Monthly usage count	To apply your plan's allowance	Cloudflare D1, against your account, or the licence key hash if your plan comes from a key	Per calendar month
Use of each feature	To see how Flogit is used and to spot an account that is shared or abused	Cloudflare D1, against your account: per month, how many times each server feature (writing, translating, offer replies, labels and the like) ran or was refused, and, once you have seen the notice about it in Flogit, how many times you used each part that runs in your browser (relists, market checks, price changes, offer answers and the like). Counts only, never which items, buyers, texts or prices	Until you delete your account
IP address	Abuse/rate-limiting on the free allowance only	Cloudflare D1 (rate-limit counter)	~24 hours
Phone-upload photos	Only if you use phone upload: to carry the pictures from your phone to your computer	Cloudflare R2 (EU)	Deleted on collection; 15 minutes maximum
Email address, password hash, Google id, X id	Your account: to sign you in and keep your plan and backup with you	Cloudflare D1; the password only as a salted one-way hash	Until you delete your account
Recent sign-ins	To show you who signed in to your account, and to spot an account that is shared or attacked	Cloudflare D1: date, method, kind of browser, country, and whether it worked	90 days
Session tokens	To keep you signed in on each browser	Cloudflare D1, as one-way hashes, with the kind of browser and the country Cloudflare reads from the connection (never the IP address itself)	180 days after last use, or until you sign out
Newsletter choice	Only if you ask for the newsletter: to send it to you	Cloudflare D1: whether you want it, when you chose, and where (sign-up or settings)	Until you change it or delete your account
Daily Buy email	Only if you turn it on: to send you the new items your saved searches found	Cloudflare D1: whether it is on and in which language, and until the email goes out the new items and the search words	The items: until the email is sent, two days at most. The switch: until you change it or delete your account
eBay alerts	Only for alerts that include eBay: to check eBay every hour, even with your browser closed	Cloudflare D1: the search (words, price limits, words to have or leave out, the eBay site), the eBay listings already seen, and new finds until your browser collects them	Until you turn the alert off, or delete the search or your account
Confirmation and password links	To confirm your email, or to set a new password	Cloudflare D1, as one-way hashes	24 hours or 15 minutes, single use
Encrypted licence key	Only if you activated a licence key: so any browser you sign in on gets its plan	Cloudflare D1 (encrypted)	Until you detach it or delete your account
Profile fields and photo	Only if you fill them in on the shop page: to show them back to you	Cloudflare D1 (text) and Cloudflare R2, EU (photo)	Until you clear them or delete your account
Shop backup: listing text and photos	To keep your listings if they, or your Vinted account, disappear	Cloudflare D1 (text) and Cloudflare R2, EU (photos)	Until you delete your account
Shop summary for the app: listing and sale rows	To show your shop on a browser without the extension	Cloudflare D1	Until you delete your account
Encrypted Vinted Pro keys	Only if you connect Pro	Cloudflare D1 (encrypted)	Until you disconnect Pro

The email address is the one thing above that identifies you as a person. It is used to sign you in, to send you the emails described in Section 3.7 and, only if you asked for them, the newsletter and the daily Buy email. We do not write to it for any other reason.

We do not store your order history, offers, messages, buyers, costs or ledger on our servers. Those stay on your device (Section 1). Of your sales we keep only the short summary for the app. The copies we keep of your shop are the listings backup and the app summary in Section 3.8. Our server keeps standard operational error logs (via Cloudflare) that do not contain this data.

5. Who we share data with (sub-processors)

We do not sell your data and we do not share it for advertising. We use these service providers strictly to run the features above:

Cloudflare: hosting, database and (for phone upload) short-lived photo storage for api.flogit.app.
Creem: our payment provider and merchant of record; handles the payment itself. When you choose a plan in Flogit, it receives your account's email and an identifier of the account, so that the plan lands on it, and it tells us the plan, its status and its renewal date. If you activate a licence key, Creem also receives that key to confirm the plan it grants. Creem replaced Gumroad on 18 September 2026.
Google: if you accept cookies on this website, Google Analytics receives visit data from it, never from the extension, so that we can count how many people read these pages. If you sign in with Google, Google also handles that sign-in and tells us the email and identifier of the account you chose; we send Google nothing about your shop.
X (Twitter): only if you sign in with X. X handles that sign-in and tells us the identifier and the confirmed email of the account you chose; we send X nothing about your shop and never post on your behalf.
Resend: sends Flogit's emails: the account emails, and the newsletter or the daily Buy email if you asked for them. It receives your email address and the content of the email, nothing else.
AlmourolTec (PTisp): our web host in Portugal. Its mail server sends an email only when Resend cannot, and it receives the emails you write to [email protected] and [email protected].
Anthropic: processes listing text and (if you use photo autofill) item photos to generate suggestions, and the words of a Buy search to translate them. Anthropic does not use data submitted through its API to train its models. See Anthropic's privacy policy.
eBay: receives only the search phrase, for resale comparisons and for your searches on the Buy page.

6. Fonts

The interface uses the "Outfit" font, which is bundled inside the extension, and it is not fetched from Google or any other server, so displaying Flogit makes no font-related network request and reveals nothing to a third party.

7. Your choices and rights

Delete your account from Settings → Profile → Danger zone → Delete account. It erases your email, password hash, sessions, the licence kept on the account, your profile and its photo, the whole shop backup, the app summary and any unused extra listings from a pack, immediately. While a paid plan that will renew is active, cancel it first. The data in your browser is not touched (see below). A licence key itself stays valid with Creem.
Cancel your plan at any time in Settings → Account. It runs to the end of the period you paid for, then your account goes back to the free plan.
Remove a licence key: if your plan comes from one, Settings → Account → Deactivate takes it off your account. The key stays valid on Creem, so you can use it again.
On-device data is under your direct control: remove the extension, or clear its storage, to erase everything described in Section 1.
Disconnect Vinted Pro at any time; this deletes your stored Pro credentials.
Stop the newsletter with the link at the bottom of any newsletter, or in your account settings in Flogit.
Stop the daily Buy email with the link at the bottom of it, or on the Buy page in Flogit.
Questions or requests: email [email protected] from the address of your account, so that we can find its records.

Depending on where you live (for example, the EU/UK under the GDPR), you may also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your data-protection authority. Our legal basis for processing your account, your backup and your licence key is performance of the service you asked for; for the device id and IP-based rate-limiting it is our legitimate interest in preventing abuse of a free allowance.

8. Children

Flogit is not intended for use by anyone under 16, consistent with Vinted's own minimum age. We do not knowingly collect data from children.

9. Changes to this policy

If we change how Flogit handles data, we will update this page and its "last updated" date. Material changes (in particular any new category of data that leaves your device) will be announced in the extension before they take effect.

10. Contact

Lost In The Tabs, Amoreiras Square, R. Carlos Alberto da Mota Pinto nº17, 3rd Floor A – Escritório 317 1070-313 Lisboa, Portugal Email: [email protected]