Privacy Policy

Who we are

FLIP is operated by Bidfins Limited, a company registered in England and Wales. Bidfins Limited is the controller of the personal data described on this page.

For anything about your data, whether a copy of it, a correction or a deletion, email hello@flipmobilegames.com or use the support page on this site.

The short version

We collect what running fair contests and paying out prizes actually requires, and not much else. We do not sell your data, and we do not run advertising trackers.

The longer version below says what each piece is, why we hold it, and how long for.

What we collect

We hold the following about you:

• Your email address, and where you add one your mobile phone number. We use your email to sign you in with a one-time code and to reach you about your account. We use your phone number only to reach you if you win a prize. The section on sign-in codes below explains more.
• Your first and last name and your country, given when you set up your account. Your real name is never shown to other players.
• Account identifiers: a unique account id, your display name, and where you use them the identifier your Apple or Google sign-in gives us. We never receive your Apple, Google, email or phone password.
• A device identifier, generated by the app on first launch. It is how a device is recognised across sessions, and how referral abuse is limited.
• A record of how your account was created: the network address, device and browser you signed up from, the approximate town and country that address points to, and, on the web, the page that first brought you to FLIP. We also note the network address and approximate country of your recent sign-ins, and check that country against the one you chose, because which games you can play depends on where you are. We keep all of this to spot fake and duplicate accounts and to apply those regional rules, and for nothing else. Location lookups use the free IP to City Lite database by DB-IP (db-ip.com), licensed under CC BY 4.0, and are made on our own servers, so your address is not sent to anyone for this.
• Match records: every action you took in a contest, its timing, and the result. This is what lets us answer a dispute.
• Wallet and ledger records: coin purchases, entry fees and prizes, held as double-entry accounting entries.
• Your approximate region, inferred from the network address your connection arrives on. We use it to decide whether paid contests are available to you, and for nothing else.
• Your device’s location, when we ask for it at sign-up and before games and coin purchases. It is matched against a map of countries and states on our own servers, and we keep only the country and state it falls in and when it was checked, never the location itself. We use it to set where your account plays from and to check you are there, and for nothing else.
• If you win a cash prize, your identity check: photos of your ID document and a selfie, what is read from the document (such as your name, date of birth and document number), whether your name appears on a sanctions list, and the result. This is collected by Didit, our identity verification provider, and we use it only to confirm the winner is who they say they are and old enough to be paid.
• Technical logs, such as error reports and connection records, kept for a limited period so faults can be diagnosed.

Sign-in codes by email

You sign in to FLIP with a one-time code sent to your email address, or with your Apple or Google account. We do not send codes or any other messages by SMS.

Sign-in emails are transactional. We do not send marketing by email or SMS, and we never sell or share your email address or phone number with any third party for their own marketing.

Email codes are delivered on our behalf by our email provider. Each message carries only the code and the short text around it.

Why we hold it, in law

Where we process your data to run the service you asked for, such as signing you in, running scheduled events, settling contests and paying out, the basis is performance of a contract.

Where we process it to verify identity, to check your age, or to apply regional restrictions, the basis is compliance with a legal obligation.

Comparing the selfie in a prize winner’s identity check with the photo on their ID uses biometric data. The basis for that is your explicit consent, which you give when you start the check. You do not have to give it: if you would rather not, we will verify you another way.

Where we process it to detect cheating, fraud or account abuse, and to keep the service secure, the basis is our legitimate interests in running a platform that holds money on behalf of players.

Match records and why they are kept

Every contest records the actions each player took, in order, and the result. Together they are a complete account of what happened.

This is what allows a disputed result to be settled by re-running it rather than by taking someone’s word. It is also why we cannot delete an individual match record on request while the money it moved is still on the books.

Payments

Coin purchases on the web, whether cash coins or play coins, are handled by our payment processor. Card details are entered on their systems and never reach ours. We receive a reference, an amount, and whether the payment succeeded.

Play coin purchases inside the apps are handled by Apple or Google. We receive a receipt to verify and nothing more.

Who else sees your data

We share data with the following categories of provider, and only for the purpose named. A current list of the specific providers we use is available on request at hello@flipmobilegames.com.

• Our email provider, to deliver one-time sign-in codes and essential account emails.
• Our payment processor, to take payments.
• Our identity verification provider, Didit (didit.me), to check a prize winner’s ID document, selfie and age, and their name against sanctions lists.
• Apple and Google, to verify in-app purchase receipts, and to sign you in where you chose to.
• Our hosting and database providers, who store the data on our behalf and do not use it.
• Law enforcement or a regulator, where we are legally required to.

Where your data is handled

FLIP is operated from the United Kingdom, and your data is held under UK data protection law. Some of the providers above operate outside the UK, so your data may be transferred abroad to reach them.

Where it is, that transfer is covered by the safeguards UK law requires, such as an adequacy decision for the country in question or standard contractual clauses with the provider, so your data carries its protection with it.

Other players

Other players see your display name, your avatar, and your results, meaning your place on the leaderboard. They do not see your real name, your email address, your phone number, your region, your balance or your friend list.

Your friend code is shared by you, deliberately, when you show someone your QR code or send them your code. Anyone holding it can send you a friend request.

How long we keep it

Ledger and payment records are kept for as long as accounting and anti-money-laundering law requires, currently six years from the end of the financial year they fall in.

Match records are kept while the contest can still be disputed, and are retained in aggregate afterwards for leaderboards and integrity checks.

Technical logs are kept for a short period and then deleted. Records of requests our firewall blocks, including the network address they came from, are kept for 30 days.

When you close your account, we delete or anonymise what we are not required to keep.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to processing we carry out under legitimate interests.

Some of these have limits. We cannot delete a ledger entry that a legal retention period still covers, and we cannot delete the record of a contest whose prize has not yet settled.

We do not make decisions about you by automated means that produce a legal effect. An account flagged by our integrity checks is reviewed by a person before anything is withheld.

You can complain to the Information Commissioner’s Office if you think we have handled your data wrongly. We would rather you told us first, and we will try to put it right.

Children

FLIP is not intended for anyone under 18, and paid contests are limited to adults who meet the minimum age where they live. If we learn that an account belongs to a child, we close it and delete what we are able to.

Contact

FLIP is operated by Bidfins Limited. Email us about anything on this page at hello@flipmobilegames.com, or use the support page on this site. We deal with data requests as soon as we can, and within the time the law allows.