Privacy policy

• Account and sign-in: an internal account ID and the Site-specific ChatGPT sign-in ID. When Google or email sign-in is enabled, the application stores the WorkOS user ID, verified email address, account link, and session information returned by WorkOS. Sign-in providers may also supply profile details.
• Minecraft and Discord: your linked Minecraft UUID and username, verification status and change times, plus your linked Discord ID and display name.
• Devices and licensing: a hardware fingerprint hash, device public key, current observed IP address, device status, activation and last-seen times, license plan, and paid-access status. The mod derives the fingerprint locally from an operating-system machine identifier and its installation public key; the raw machine identifier and device private key are not uploaded to the account service.
• Payments: Stripe customer, checkout, subscription and payment references; amounts, currency, payment status, membership reservations, and paid device or Discord change records.
• Session records: activated Premium devices report completed collection events with item IDs, quantities, coin amounts, receipt identifiers, and their linked license. The website records when these reports arrive. Collected sale proceeds are not the same as profit.
• Security and verification: temporary pairing codes and challenges, signed ownership proofs, authentication state, rate-limit records, and account-action or verification diagnostics. Hosting providers also process connection and request information to deliver and protect the service.

The service uses this information to sign you in, connect the account you explicitly choose, verify Minecraft ownership, deliver paid downloads, enforce membership and device limits, process account changes, and show your account and collection history. Payment and security records also support billing reconciliation, troubleshooting, and review of unauthorized use.

When you choose Google sign-in, WorkOS handles the Google authentication flow. The verified email and WorkOS identity returned to this application are used for account authentication, linking, security, and support. The application does not use this Google sign-in data for advertising. Matching email addresses alone do not merge AutoBazaarFlipper accounts.

OpenAI Sites provides website hosting and ChatGPT sign-in; its hosting infrastructure includes Cloudflare. WorkOS provides Google and email sign-in when configured. Stripe handles checkout, billing details, invoices, and subscription payments. Discord verifies a Discord account you choose to link. Official Minecraft services provide public profile data and ownership-verification information; Hypixel supplies public Bazaar market data.

Information needed for these functions is processed by the relevant provider under its own privacy terms. Passwords entered in WorkOS-hosted sign-in forms and full payment-card details entered in Stripe checkout are handled by those providers, rather than stored in this application's account database. The mod does not send Minecraft passwords or Minecraft access tokens to the AutoBazaarFlipper account service.

Sharing your selected items is optional and off by default in the mod. If you enable it, the service receives your current item IDs, associates them with your activated device, and shows other eligible Premium members a count of participating accounts per item. That member view does not include usernames, Discord identities, IP addresses, or device identifiers.

You can turn sharing off in the mod. It then attempts to clear the active item list; published activity also stops appearing when its short activity window expires. This expiry is not a promise that the underlying database row has been deleted. Your account's collection history is separate from this sharing preference.

The application uses necessary cookies to keep you signed in and bind sign-in or account-linking requests to your browser. Application session cookies use Secure, HttpOnly, and SameSite protections. Sign-in and payment providers may use their own cookies. Blocking necessary cookies can prevent these flows from working.

The mod stores its device key, activation token, settings, session files, and pending collection reports locally. Service authentication uses device signatures and short-lived signed licenses. Saved WorkOS tokens are encrypted in the service database; device tokens and pairing codes are stored as hashes. These specific protections do not mean every stored field or local file is encrypted, and no security measure guarantees absolute protection.

Account, license, payment-reference, collection, and audit records are stored in the service database. The current application has no automatic account-deletion workflow or fixed deletion schedule. Authentication sessions and verification codes expire for use, but expiry does not necessarily remove their stored records. Canceling a subscription does not delete your account or payment history.

You can review linked accounts and devices in Account, manage your subscription through Billing, and turn off optional item sharing in the mod. You can also ask support about access to, correction of, or deletion of your information. Requests need account verification and individual review; this page does not promise an automatic deletion deadline. Providers such as Stripe maintain their own records under their own policies.

Use our Discord community to ask how to contact support privately about a privacy request. Do not post passwords, pairing codes, payment details, or other private account information in public channels.