Security and trust
No password to leak, a token that is encrypted the moment it lands, and an easy way out: export or delete everything whenever you like. Written as plainly as the features, including what is not covered.
How access works
A one-use link sent to the email you bought with, valid for 15 minutes, or Discord, which tells the app who you are and which roles you hold in the members' server. The app stores a signed session and no password, because there is none.
It comes from your own logged-in browser and is encrypted before it is stored, with the key kept outside the database. Vinted rotates it on every use, so one copy belongs to one app.
The eBay connection uses eBay's official sign-in and signed requests. Disconnect it in Settings and the app's access ends.
The details
There is no password to set, and none for us to store. Sign in with a one-use link sent to the email you bought with, or with Discord, which is asked only who you are and which server roles you hold. The session is a signed cookie that expires on its own.
The token you paste is encrypted with a key kept outside the database. Its expiry is read from the token itself, and you are warned days before it runs out.
The eBay connection uses eBay's official sign-in and signed requests. We never see an eBay password.
Every query is scoped to the account that made it, in the same statement, and tested against a real database. One member's data cannot be returned to another.
Rate limits and body caps on every public endpoint, strict security headers, and a server that will only ever fetch from an allowlist of hosts.
One download holds your whole account. Delete it from Settings and it is gone. A lapsed member can still download or delete their data and see past receipts.
What is deliberately not claimed: that every credential is encrypted (the eBay connection's refresh token is held as eBay issues it), an uptime figure, or a compliance badge nobody has audited. If any of that changes, this page changes with it.
Your data, your exit
One download holds your whole account, and every list exports to a file. A lapsed member can still sign in to download their data and see past receipts.
Delete the account from Settings and the data goes with it. No retention emails, no dark patterns. Invoices are kept for as long as tax law requires, and nothing else is.
Email hello@getvintify.com with “Security report” in the subject. We take good-faith research seriously and will not act against it.
Sync your sales, manage your stock and see your profit, from day one.
Already a member? Log in