Last updated: 10 September 2026
Flip Tycoon ("the app") is a daily trading game published by Velqor ("I", "me"). This policy explains what the app collects, why, where it is stored, and how to get rid of it.
Contact: hello@velqor.io
The short version
• You sign in with Google. I receive your email address, your name and your profile picture URL from Google.
• The game stores what you do in it: your balance, your flips, your streak, which items you have handled and which buyers you have dealt with.
• Analytics and crash reporting are on, tied to a random account ID rather than to your name or email.
• There are no ads, no ad networks, and nothing is sold or shared with advertisers or data brokers.
• You can delete your account and everything in it from inside the app, at any time, without asking me.
What is collected, and why
Account information
When you sign in with Google, Google gives the app your email address, display name and profile picture URL. These are stored so your account persists between sessions and so the league table can show a name.
You can change the name shown to other players at any time in Settings. Your email address is never shown to other players.
Why: to give you an account. Legal basis: performance of a contract — the app cannot save your progress without one.
Game data
Everything you do in the game is stored against your account: your cash balance, every flip you have played and what it earned, your daily streak, items you have kept, purchases of in-game intel, and your standing with each of the twelve in-game buyers.
Why: it is the game. Legal basis: performance of a contract.
Device settings
• Time zone, so the daily board changes at midnight where you are rather than at midnight somewhere else.
• Language, so the game can show you text in it.
• A push notification token, if you allow notifications, so the app can tell you when a new board is ready. The token identifies your device installation, not you. Deny or revoke notifications and no token is stored.
Why: to make the game work in your time zone and language, and to send the notifications you asked for. Legal basis: performance of a contract, and your consent for notifications.
Analytics
The app uses Google Firebase Analytics to count how many people reach certain points — signing in, finishing the tutorial, playing a first flip, finishing a day, opening the daily review — and to record sign-in failures.
These events are recorded against a random account identifier, not your name or email address. Firebase also automatically collects general technical information such as your device model, operating system version, app version and approximate country.
I use this to find out where people get stuck. I do not use it to build a profile of you, and it is not used for advertising.
Why: to fix things that are broken and improve the game. Legal basis: legitimate interest in a working product.
Crash reports
The app uses Google Firebase Crashlytics. If the app crashes, it sends me a report containing the error, the app version, your device model and operating system version, and the state of the app at the time.
Why: to fix crashes. Legal basis: legitimate interest in a working product.
What is stored only on your device
Your sound and vibration preferences, your theme, whether you have seen the tutorial, and whether you have been asked about notifications are stored on your device only. They are never sent to me and they disappear when you uninstall the app.
What is never collected
No location data. No contacts. No photos, camera or microphone access. No advertising identifier. No ad networks of any kind. Nothing about you is sold or shared with data brokers.
Who else processes your data
I use the following services to run the app. Each one only receives what it needs to do its job.
• Supabase (Supabase Inc.) — Your account, sign-in and all game data. Stored: Ireland (EU).
• Google Sign-In (Google LLC) — Authenticating you. Stored: Google's infrastructure.
• Firebase Analytics (Google LLC) — Anonymous usage events. Stored: Google's infrastructure.
• Firebase Crashlytics (Google LLC) — Crash reports. Stored: Google's infrastructure.
• Firebase Cloud Messaging (Google LLC) — Push notifications. Stored: Google's infrastructure.
• Cloudflare R2 (Cloudflare, Inc.) — Serving item and character images. Stored: Cloudflare's global network.
Cloudflare receives your IP address when your device loads an image, in the same way any website request works. No account data is sent to Cloudflare.
Google's privacy policy: https://policies.google.com/privacy Supabase's privacy policy: https://supabase.com/privacy Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/
Some of these providers are based in the United States. Transfers outside the EU rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Where your data is stored
Your account and game data are stored in a Supabase database hosted in Ireland (EU). Analytics, crash reports and push notifications are processed by Google.
How long it is kept
Your account and game data are kept for as long as your account exists. Delete your account and they are deleted immediately — see below.
Analytics data is retained by Firebase according to its own retention settings (currently the Firebase default of 2 months for user-level data, with aggregate reports kept longer). Crash reports are retained for up to 90 days.
Deleting your account
Open the app, go to Settings → Delete account. This permanently deletes your sign-in record and every row of game data attached to it — profile, flips, vault, buyer relationships, notification token, everything. It happens straight away and it cannot be undone. You do not need to email me and I cannot recover it afterwards.
Deleting the app from your phone does not delete your account. Use the button.
Your rights
If you are in the EU, the UK or another region with similar law, you have the right to:
• Access the data I hold about you
• Correct it if it is wrong
• Delete it (the in-app button does this immediately)
• Object to or restrict how it is used
• Receive a copy of it in a portable format
• Withdraw consent for notifications, at any time, in your device settings
• Complain to your local data protection authority
To exercise any of these, email hello@velqor.io. I will respond within 30 days. To delete everything, the in-app button is faster than I am.
Children
Flip Tycoon is not directed at children. You must be 13 or older to use it, and 16 or older in countries where that is the age of digital consent. I do not knowingly collect data from children below those ages. If you believe a child has created an account, email me and I will delete it.
In-app purchases
There is currently nothing to buy in Flip Tycoon. If that changes, this policy will be updated before any purchase is possible, and payment will be handled by Apple or Google — I never see or store your card details.
Changes to this policy
If this policy changes, the date at the top changes with it. Significant changes will be announced in the app.
Contact
Velqor
Email: hello@velqor.io