Privacy Policy

FlipTrainer ("we", "our", "the Service") is a Solana memcoin trading simulator delivered as a Chrome Extension. The extension connects to FlipTrainer's backend services to simulate trades, track portfolio performance, and optionally purchase premium features.

By installing and using the extension you agree to this Privacy Policy. If you do not agree, please uninstall the extension and contact us to request deletion of any data already collected.

FlipTrainer is a Chrome Extension (Manifest V3). The sections below list every browser permission and every external host the extension is allowed to access, and explains exactly why each one is needed.

Permissions

For each permission the extension requests, here is why it is needed, how the related data is stored, and how you can remove it.

identity

• Why: lets you sign in with your Google account, so you never create or remember a separate FlipTrainer password. Used only to identify you, never for mailing lists, advertising, or spam.
• How it's stored: On our server we keep only your username, email, and Google account ID. On your device we keep a short-lived JWT access token (re-issued roughly every 15 minutes) and a refresh token, both in chrome.storage.local.
• How to remove it: Sign out to clear the tokens from your device, revoke FlipTrainer's access in your Google Account settings, or delete your account to erase the stored identity (see  Your Rights).

storage

• Why: keeps the data the app needs to work (your session and other user data) on your own device, so you stay signed in between visits.
• How it's stored: in chrome.storage.local, an area isolated to the extension and unreadable by websites. It holds your JWT tokens, your active wallet's public address, and the push-notification endpoint. Your wallet's private key is not stored on the device — it is kept encrypted on our servers. For a full breakdown of what is stored and where, see Data we collect.
• How to remove it: signing out clears the session items; removing the extension wipes FlipTrainer's entire chrome.storage.local. Your wallet is not affected — sign back in and it is still there.

sidePanel

• Why: the side panel is the app's main workspace, where you trade, track your portfolio, and use every FlipTrainer feature.
• How it's stored: nothing — it is only a UI surface and holds no data.
• How to remove it: closes with the panel; fully gone when you remove the extension.

notifications

• Why: shows browser push notifications for payment events, sniper alerts, and funds credited to your balance.
• How it's stored: a browser-generated push endpoint (contains no personal data) kept in chrome.storage.local and on our server so we can deliver the notifications.
• How to remove it: removing the extension clears the stored push endpoint and stops the notifications.

Hosts

Host	Purpose
flip-trainer.com	FlipTrainer's own backend — authentication, the trading simulation, payments, and the real-time event stream.
www.googleapis.com	Google OAuth and profile endpoints, used only at sign-in to verify your identity and read your name, email, and avatar.
axiom.trade, gmgn.ai, trade.padre.gg	Third-party trading terminals. The extension opens them as links from your alerts (one terminal is active at a time) and runs a content script on these sites to embed the FlipTrainer simulator panel — see Content scripts below. We do not send your personal data to these sites and never read their cookies or site storage.

Content scripts

On the three trading terminals above, the extension injects a content script that embeds the FlipTrainer simulator directly into the page.

• Where it runs: only on pages of axiom.trade, gmgn.ai, and trade.padre.gg — never on any other site.
• What it does: adds a FlipTrainer trade panel and quick-buy buttons (replacing the site's native quick-buy buttons with simulator ones), so you can practice trades without leaving the terminal.
• What it reads: the token contract address shown on the page and the current page URL — nothing else. It never reads those sites' cookies or storage, your accounts on those sites, form input, or keystrokes.
• What it sends: only when you act (place a simulated buy/sell or open the trade panel), the token contract address and the terminal page URL are sent to FlipTrainer's backend to execute your simulated trade and show your positions. Nothing is sent to the terminal sites themselves.
• Settings: panel preferences (amounts, position, on/off) are kept in the extension's own chrome.storage.local.

The extension collects only the data necessary to provide and improve the Service. The table below lists every category of data, where it is held, and why.

Data	Storage	Purpose
Google account name & email	local server	Account creation and profile display. Collected once during Google OAuth sign-in.
Google profile picture URL	local server	Displayed in the extension UI as the user avatar.
JWT access & refresh tokens	local	Session authentication. Stored in chrome.storage.local; never written to disk outside the browser profile.
Solana wallet address (public key)	local server	Identifies the user's wallet for balance checks, payments, and blockchain interactions.
Encrypted wallet private key	server encrypted	The private key is encrypted with AES-256-GCM using a key derived via HKDF-SHA256 from a server-side HMAC pepper, and stored encrypted in our database. The pepper lives only in the server environment and is never written to the database, so the ciphertext alone is useless. The server decrypts the key only to sign actions you request — trades, payments, withdrawals — this is a custodial wallet. You can export the private key at any time from the Wallet page and import it into any Solana wallet.
SOL wallet balance	local	Displayed in the wallet UI. Fetched directly from the Solana RPC; not stored server-side.
Simulated trading activity	server	Open/closed positions and P&L history. Required to provide the core trading simulation feature.
Token contract address & terminal page URL	server	Received when you place a simulated trade from the FlipTrainer panel embedded on a supported terminal (or from the Trade tab reading your active terminal tab). Used only to execute the trade you requested and attribute it to its source; never used to build a browsing profile.
Sniper wallet watch-list	server	Solana addresses the user chooses to monitor for on-chain activity. Stored only if the user explicitly configures them.
Web Push subscription endpoint	local server	Enables browser push notifications for payment confirmations and sniper alerts. The endpoint is browser-generated and contains no personally identifiable information.
Purchase & tip payment records	server	When you make a purchase or send a tip, we record the on-chain transaction signature, the sender wallet address, the SOL amount, a SOL/USD price snapshot, the payment status, and the timestamp. This is kept only to verify your on-chain payment and to prevent double-charging (each purchase is idempotent). The server signs the transfer from your wallet, but only when you explicitly confirm a purchase — it never initiates one on its own.

We do not collect: browsing history, keystrokes, mouse movements, geolocation, page content beyond the token contract address and page URL on the three supported trading terminals, or any data unrelated to the trading simulator.

On your device — session items (JWT tokens) are kept in chrome.storage.local, which is isolated to the extension and inaccessible to websites. Your wallet's private key is not stored on the device.

On our servers — data is stored in a PostgreSQL database hosted on a private server. Server-to-server communication is encrypted in transit (TLS). Alongside your account data we store your wallet's private key encrypted with AES-256-GCM; the decryption secret is held only in the server environment and never written to the database, and the key is decrypted solely to sign the actions you request.

• Authenticating your account and maintaining your session via JWT tokens.
• Displaying your profile (name, avatar) inside the extension.
• Managing your simulated SOL balance, open positions, and trade history.
• Processing purchases and tips — when you confirm one, the server signs the SOL transfer from your wallet to our treasury address, verifies it on-chain, and records the payment signature, amount, and status so a purchase or tip is never charged twice. Every purchase is a one-time payment you initiate yourself — there is no auto-renewal and the server never starts a payment on its own; tips are entirely optional.
• Monitoring Solana wallet addresses you explicitly add to your sniper watch-list and firing configured alerts.
• Sending push notifications for payment events and sniper alerts (only if you grant notification permission).
• Opening links to third-party trading terminals from your alerts, and opening the side panel.
• Embedding the FlipTrainer trade panel on supported terminals: when you place a simulated trade there, the token contract address and the terminal page URL are used to execute that trade and attribute it to its source. Your general browsing history is never collected or stored.

We do not use your data for advertising, profiling, or any purpose unrelated to operating the Service.

Party	Data shared	Purpose
Google (OAuth)	Google token (verified server-side)	Identity verification at sign-in. We receive your name, email, and profile picture URL from Google's API.
Web Push services (browser vendor)	Push endpoint (browser-generated)	Delivering browser push notifications. The push endpoint is provided by your browser vendor (Google for Chrome) and does not contain personal information.
Email delivery (SMTP — Google / Gmail)	Recipient email address + transactional message content	Sending transactional emails (payment confirmations, tips) through Google's SMTP server. These emails are transactional only — we never use this channel for marketing.

We do not share your name, email, or private key with any of the above parties. We do not use analytics SDKs, advertising networks, or data brokers.

We keep your data only for as long as it is needed to operate the Service, and we do not impose long financial-style retention periods.

• Account & profile data (name, email, Google account ID, public wallet address) — kept while your account is active; erased when you request account deletion.
• Simulated trading data (open and closed positions, P&L history) — retained for the lifetime of your account.
• Payment ledger — retained while your account exists, to keep purchases idempotent and verifiable; removed on account deletion.
• Push endpoint & sniper watch-list — kept until you disable notifications / remove the watch entry, or delete your account.
• On-chain transactions — recorded immutably on the Solana blockchain; they are outside our control and cannot be erased by us.
• Server logs — operational and short-lived; they are not used to identify you for advertising and are not shared with any analytics or logging SaaS.

You have the right to:

• Access — request a copy of all personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request deletion of your account and all associated data. Blockchain transactions (on-chain history) are immutable and cannot be erased by us.
• Portability — receive your trading history in a machine-readable format.
• Withdraw consent — uninstall the extension and contact us to stop all data processing.

To exercise any of these rights, contact us at the address in the Contact section. We will respond within 30 days.

• All traffic between the extension and our servers is encrypted with TLS.
• Your Solana private key is stored encrypted with AES-256-GCM in our database and decrypted only in server memory, solely to sign the actions you request. It is never written to disk in plaintext and never sent to your device except when you explicitly export it.
• The encryption key is derived (HKDF-SHA256) from an HMAC pepper that lives only in the server environment and is never stored in the database — leaking the database alone does not expose any keys.
• JWT access tokens are short-lived; refresh tokens are single-use and rotated on every session refresh.

No system is perfectly secure. If you discover a security issue please report it responsibly to the contact address below.

FlipTrainer is not directed at anyone under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us at support@flip-trainer.com and we will delete it promptly.

We may update this policy to reflect changes in the Service or applicable law. Material changes will be announced via an in-extension notification or email. The "Last updated" date at the top of this page always reflects the current revision. Continued use of the extension after a change constitutes acceptance of the new policy.

FlipTrainer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data (your name, email, and profile picture):

• is used only to provide user-facing features — signing you in and displaying your profile inside the extension;
• is never transferred to third parties, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you;
• is never used or transferred for serving advertisements;
• is never read by humans, unless we have your explicit consent, it is required for security purposes or legal compliance, or the data is aggregated and anonymized.