Scope and current availability
FLIPI OSINT is the product brand for a local investigation workspace. This notice covers the marketing website and the account interface. Downloading does not require registration. Since version 2.9, using the workspace requires valid signed access; a number alone does not unlock it. Numbered accounts are available when the account interface reports that the access service is connected. Public paid checkout remains disabled during launch verification.
Your investigations stay local
Case files, source originals, notes, and saved recovery drafts are stored on your Mac. This website does not offer a case-upload endpoint and does not receive the content of investigations through account or payment requests. Choosing a collaboration room, a map provider, or an external research service can send information outside the local app.
Local storage does not mean automatic encryption. Working cases and drafts are not automatically encrypted; standard ZIP exports are unencrypted. Protected export is a separate option. A device, backup provider, or person with access to local files may be able to read them.
Optional AI providers
Version 3.0 adds an optional desktop AI assistant. Nothing is selected automatically. After reviewing the prepared text and explicitly sending it, your question and selected note text or source descriptions are sent to the configured local server or external provider. Original files are not automatically attached. API credentials are stored in this Mac’s Keychain and scoped to the configured endpoint; they are not sent to this website.
A local endpoint can itself forward data to cloud services: check your model server’s settings. External providers receive the submitted text and credentials and apply their own pricing, terms and retention. Tor does not unlink an API key from its provider account. OpenAI requests use store:false, which does not guarantee absence of all provider-side records. Stopping local waiting does not guarantee cancellation of provider computation or billing. Answers stay in memory until you save them as a local note; model output needs independent verification.
Website requests and providers
We do not add advertising analytics, session replay, cross-site tracking pixels, or fingerprinting to this website. Fonts and decorative assets are served from the website. Netlify hosts the new deployment and downloads; Vercel delivers the previous deployment during domain migration. Both providers’ delivery infrastructure may process network information; specifically, the delivery infrastructure may process IP addresses, requested paths, timestamps, browser information, and security or operational records.
We do not claim that hosting infrastructure keeps no logs. Infrastructure records are subject to the hosting provider’s configuration and retention practices. Network information is used to deliver content, maintain availability, and protect the service; where applicable, these purposes are assessed as legitimate interests, subject to the rights provided by law. Providers may process information in more than one country. See the privacy information of Netlify, Vercel and Supabase for their own practices. Supabase stores the access records in a separate database schema; case files are not sent to it. Short-lived keyed IP hashes are used for request limits and deleted after their rate-limit windows expire.
Numbered accounts
The account model asks for no name, email address, phone number, username, or separate password. A cryptographically generated 16-digit number is the access credential. Anyone who obtains it may be able to use the account, so it should be kept private. Losing it can make recovery impossible; no email-based recovery is offered.
The access service stores an HMAC-derived account identifier instead of the plaintext number, together with the access plan, expiry, device identifiers or active device slots, and the invoice-to-account association needed to add prepaid time. These identifiers are pseudonymous; they are not automatically anonymous data. Account records are processed to provide and administer access, not to collect investigation content.
When account login is enabled, the website uses an encrypted, HttpOnly, Secure, SameSite session cookie. Its purpose is to keep access credentials out of URLs and browser-readable persistent storage. The cookie does not survive its server-side expiry; logging out clears it. The number is shown only after an explicit action and is not put into localStorage by the account interface.
Cryptocurrency and payment records
Public payments are currently unavailable. The prepared model uses a separate invoice identifier to associate payment with prepaid time. The prepared Solana Pay request includes a random reference, not the raw account number. The recipient, amount, reference and transaction are public on Solana. RPC providers receive requests for the reference and transaction; Coinbase supplies a EUR/USDC exchange-rate quote without an account number. The merchant service still needs an association between an invoice and an account to credit the right balance.
Payment records can include an invoice ID, amount, currency, status, time, destination, and other network-specific transaction information. Solana transactions are public; wallets, exchanges, blockchain nodes, and payment infrastructure can create additional records. Cryptocurrency does not guarantee anonymity. Applicable accounting and dispute requirements may require retention after access expires. No fixed payment-record deletion period is promised before those requirements are established.
Cookies, preferences, and retention
The motion preference stores only a boolean value under flipi-reduced-motion in localStorage. It contains no account number or cross-site identifier. You can clear it through your browser’s site-data settings. Account cookies are set only when a successful login or account creation is possible.
Local case retention is controlled by you. A recovery draft must already have been written to disk before it can be restored. Account and invoice records are retained only as required to administer access, prevent abuse, and meet applicable duties; provider-controlled records follow the provider’s retention. We do not invent a universal deletion deadline or promise zero retention.
Rights and limits
Depending on the applicable law, rights may include access, correction, deletion, restriction, portability, objection, withdrawal of consent where consent is used, and a complaint to the competent supervisory authority. Mandatory rights are not removed by using a numbered account or paying with cryptocurrency. Information sufficient to authenticate an account may be needed before account-specific records can be disclosed.
No operator contact or legal-entity details are published in this version of the site. These omissions remain unresolved and this policy must not be read as confirmation of legal compliance. No automated support channel, data-rights request channel, or response deadline is represented as available when it is not.
Changes and independent services
A revision date is shown above. Changes to the site’s actual data flows should be reflected in a revised notice. External map services, research websites, hosting, wallets, and exchanges have their own terms and privacy practices. FLIPI OSINT is not a VPN and does not automatically route website traffic through Tor.