Privacy Policy

Last updated 13 October 2026

Crateflip (“the service”, “we”) helps you copy items you have for sale on Discogs to eBay. This policy explains what information the service handles and why. The service is independent and is not affiliated with or endorsed by Discogs or eBay.

Information we handle

• Discogs account. When you sign in with Discogs we receive your Discogs user ID and username, and an access token that lets the service act on your behalf. We never see your Discogs password.
• Your Discogs listings. Your browser fetches your “For Sale” inventory and the release details you choose directly from Discogs; our server only signs those requests, so your credentials never reach the page. The data is held in your browser’s memory while the page is open. When you publish or edit an item, its details (artist, title, format, condition, price, images and notes) are sent to our server to build the eBay listing. We do not store your inventory or these details.
• eBay account. When you connect eBay we receive access and refresh tokens (we never see your eBay password), plus the eBay site you choose to list on and the shipping, payment and returns policies and item location you select.
• Postcode. If you create an item location, the postcode you enter is sent to eBay. We do not store it.
• Listing records. For each item you push to eBay we record the Discogs listing ID and release ID, the eBay offer and listing IDs, its eBay title, whether it succeeded, and any error message, so we can prevent duplicates, show you the result, and show you what a sync was spent on in your sync history. We do not store anything else about the item.
• Sales. If you allow the service to read your eBay orders, it checks them every few minutes for items it listed and records each sale: the order and item IDs, the item title, the price and the date. We do not store anything about the buyer. If you choose “Remove from Discogs” on a sold item, the service deletes that Discogs listing on your behalf; it never does so without your click.
• Sales history. The sales history page reads your Discogs orders directly from Discogs in your browser, to show each item, date, price and status. Order details, including anything about buyers, are not sent to or stored by our server. If you choose “Import last 90 days”, the service reads your recent eBay orders for items it listed and records them as described under “Sales” above.
• Contact form. If you use the contact form, your name, email address and message are emailed to us so we can reply, and are not stored by the service. If you are signed in, your Discogs username is included so we can find your account. To limit abuse we keep a scrambled (hashed) form of your IP address, not the address itself, with the time of each attempt for up to two days.
• Syncs and payments. Each new eBay listing uses one “sync”. We keep a record of your syncs: what was added (free syncs, listing credits you bought, syncs we gave you), and each new listing that used one, with the date. If you buy listing credits, PayPal takes the payment and tells us it succeeded. We store the PayPal order number, the listing credits, the amount and the date. We never see or store your card or PayPal login details.
• Records that leave Discogs. Your browser compares your Discogs “For Sale” list with the eBay listings the service created. When a record is gone from Discogs but its eBay listing is still live, the service tells you and, only if you click “End on eBay”, ends that eBay listing on your behalf. Dismissing it is remembered so you are not asked again.
• Technical data. Our hosting provider records standard request information such as IP address, requested page and error details in server logs.

How we use it

Only to provide the service: signing you in, showing your Discogs inventory, creating and publishing the eBay listings you select, and keeping the service secure and working. We do not sell your information, use it for advertising, or use it to build marketing profiles.

Who we share it with

• Discogs and eBay, as needed to carry out what you ask. Their own privacy policies apply to data they hold.
• Cloudflare, which hosts the service and its database.
• PayPal, if you buy syncs. PayPal’s own privacy policy applies to the payment.
• DigitalOcean, which hosts a small server we run. When you sign in, it makes one request to Discogs on our behalf to confirm which Discogs account you are (it sees the request and Discogs’ reply, and stores nothing).
• An exchange-rate service (frankfurter.dev, which publishes European Central Bank rates). Our server asks it for the rate between two currencies when you list on an eBay site that uses a different currency from your Discogs prices. Only the two currency codes are sent, nothing about you or your listings.

We do not share your information with anyone else unless the law requires it.

Cookies and similar technology

We use a single cookie, sid, to keep you signed in. It is strictly necessary, contains a random identifier only, and expires after 90 days or when you sign out.

We use Shipfound for analytics. By default it stores nothing in your browser. If you accept the banner shown on the site, it stores a first-party identifier for up to 13 months, so we can tell a visitor is the same one returning on a later day and test different page wording against each other. Decline, and that visit is still counted, just not linked to your next one. We use no advertising cookies.

Security

Discogs and eBay tokens are encrypted before they are stored, and all traffic uses HTTPS. No system is perfectly secure, but we take reasonable steps to protect your data.

How long we keep it

• Sign-in sessions expire after 90 days.
• eBay tokens and settings are deleted when you use “Disconnect” in the app.
• Your Discogs sign-in details and listing records are kept until you ask us to delete them.
• Payment records are kept for as long as we need them for accounting and tax.
• Server logs are kept for a short period by our hosting provider.

Your choices and rights

You can sign out at any time, disconnect eBay in the app, and revoke the service’s access from your Discogs and eBay account settings. Depending on where you live you may also have the right to access, correct or delete your information. To exercise any of these, or to have all of your data deleted, email us at the address below.

Children

The service is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes

We may update this policy. The effective date above shows when it last changed.

Contact

Questions or requests: privacy@crateflip.app, or use the contact form