Privacy
Effective 2026-08-11 · plain-language version, and the only version
This describes what MidasFlip actually collects, where it goes, and what we do not touch. It is written against the code, not against a template. The client is open source, so you can check every claim here yourself.
1. What the mod sends from your game
Four things, and nothing else:
The item you hover. Its item id and the modifiers that affect price — stars, recombobulator, gems, enchantments, hot potato books — are sent so we can price it. This happens only for an item you point at, one at a time.
Your Minecraft username and UUID, when you link your account. The UUID is sent again roughly once a minute so the mod can find your own auction listings and warn you about undercuts.
Items you bought. While you hold an open position, the mod asks for that item's current value about once a minute so it can warn you if the market moves under you — up to ten at a time. Positions are opened from your own purchases, which the mod reads from your chat.
Nothing else from the game. Your purse and bank balance are never read. Nothing enumerates your inventory or your containers. There is no bulk upload: every request is a plain GET, and the single POST the mod makes — pairing — carries no body at all.
2. What the website stores
Your username and password. The password is stored only as a salted scrypt hash. We cannot read it, and neither can anyone who steals the database.
Your email address, if you gave one. It is optional. It exists so you can reset your password, and so we can reach you about your account. It is not required to use MidasFlip.
Your Minecraft username and UUID, if you linked them. This is what lets the dashboard show your own trades.
API keys, session cookies and password-reset links are stored only as SHA-256 digests. The database holds no usable copy of any of them. A reset link works once and expires in 60 minutes.
Counts of API requests, so we can see usage and stop abuse, and a record of administrative actions.
3. Your trade history is public market data
The trades shown on your dashboard are not something we collected from you. They are Hypixel's own public auction records, which anyone can fetch, matched to the Minecraft UUID you linked. We did not learn them from your client, and unlinking your Minecraft account stops us matching them to you.
4. Cookies
One cookie: your login session. It is marked SameSite=Strict and stores nothing but an opaque token. There are no analytics cookies, no advertising cookies and no third-party trackers of any kind on this site.
5. Who else sees anything
Resend delivers password-reset email. It receives your email address and the contents of that message. It sees nothing else.
Mojang is asked to turn a Minecraft username into a UUID when you link your account. That is a lookup against their public API.
Hypixel receives nothing from us about you. We read their public auction and bazaar endpoints; no user data travels in that direction.
Discord receives our own market alerts through a webhook we own. It receives nothing about you.
Our hosting provider handles the servers and, like any web host, sees connection metadata such as IP addresses in ordinary server logs.
There is no analytics provider, no advertising network, and no AI or machine learning vendor. Nothing you do here is sent to a model. Prices come from statistics over public sale records, not from an AI service.
We do not sell your data. There is nobody to sell it to and it would destroy the only thing this product has.
6. IP addresses
Your IP is used to rate-limit sign-ups, logins, password-reset requests, mod pairing, the beta form and the public flip board, so that one person cannot flood them. Those counters live in Redis and expire within the hour. Redis writes to disk, so a counter can briefly exist in a log file before it expires. An IP is also recorded against a password-reset request so abuse can be traced.
7. How long we keep it
Account data stays while your account exists. Sessions expire after 14 days. Password-reset records are pruned after 7 days. Public market records are historical data about the auction house, not about you, and are kept indefinitely.
8. What you can ask for
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Deleting your account removes your login, your email, your API keys and your Minecraft link. It does not remove Hypixel's public auction records, because those are not ours to erase — but nothing will connect them to you.
Ask through the contact route on the main site or on the project's GitHub. We will not ask you to prove anything beyond control of the account.
9. Children
MidasFlip is not directed at children under 13, and we do not knowingly create accounts for them.
10. Changes
If this changes materially we will date the new version at the top. We will not quietly widen what we collect; the list in sections 1 and 2 is meant to be complete, and if it stops being complete that is a bug worth reporting.
Questions about any of this belong on the GitHub issue tracker, in public, where the answer is useful to everyone.