Flip privacy

On your device

• Your entries, tags, notes and settings are stored in your browser's storage on your device. Flip works fully offline and without an account, and in that case nothing about your time leaves your device.
• Clearing your browser's site data for Flip removes this data. The browser extension shows the web app in its popup, so it uses the same storage.

If you sign in to sync

Signing in is optional and only for syncing between your devices. You sign in with Google (so Google knows you signed in to Flip), and Flip asks Google for proof that you are you and for your email address, but not for your name or profile. Flip does not send email at the moment; if that changes, this page will say so. After signing in, we store on our server (Cloudflare):

• Your sign-in: the identifier Google gives us for you, the email address of your Google account (it identifies your account, and it is not shared or sold) and the time you signed up.
• Your entries: the start and end times, pauses, tags and notes you create, and the settings you chose (day start, time zone, week start), kept as the list of changes you made, so every device can rebuild the same picture.
• Your devices: a name such as “Chrome on Linux”, when it was last used and the time zone it last reported, so Flip can warn you when two of your devices count days differently.

Your data is encrypted in transit and stored with Cloudflare, but it is not end-to-end encrypted: the server can read your entries, because it has to combine the changes from your devices. We don't look at them, use them for anything else or share them.

Signing out lets you keep a copy of your data on that device or remove it. In Account you can sign a device out and delete your account. Deleting your account erases your account data (sign-in, entries, settings and devices) for good. The server's operational logs hold no entries or notes, only your account's random id and the time of events such as signing in or deleting, and expire on Cloudflare's schedule. The data on your devices stays unless you remove it.

Only if you say yes

The first time you open Flip it asks “Help improve Flip?”. Nothing is sent before you answer, nothing at all if you choose “No thanks”, and a browser that asks sites not to track (Global Privacy Control or Do Not Track) counts as no. If you choose “Share”, Flip sends:

Usage counts (Umami)

Anonymous counts to Umami: which screen was opened (a page pattern such as “/entries/:id”, never your data), the site's address and your browser's language, and these events, with nothing else attached:

• A timer was started, paused, resumed or stopped: which of the four, nothing else.
• A past entry was added or an entry was edited: nothing else.
• A tag was created: never its name.
• A report was opened: nothing about its filters or contents.

Crash reports (Sentry)

When Flip itself breaks, an error report goes to Sentry (EU data region): the error message, where in the code it happened, and your browser and operating system. Ids are removed and page addresses are cut down to the screen name before sending. There are no breadcrumbs, no screen recording and no session tracking.

As with any connection, Umami and Sentry see your IP address and your browser's user agent when Flip sends to them; neither is used to identify you or follow you to other sites.

Never sent to analytics

The names of your timers, tags and notes, your times and durations, your reports, or anything you type. There are no cookies and no ads.

The browser extension

The extension shows Flip's web app in its popup. It asks for two things: storage, to remember how many timers are running so the toolbar badge survives a browser restart, and access to the Flip web app's address, to show it. It cannot read other sites, your tabs, history or clipboard.

Who is responsible

Illia Veremiev, Denmark. For questions about your data, write to appbits.dev@outlook.dk.

Last changed: 11 October 2026.