FlipReply
Back to Home

Data Privacy & Security Architecture

Engineered with Zero-Knowledge Local Sandboxing • Updated September 2026
Our Core Engineering Philosophy

As sellers ourselves, we designed FlipReply with zero tolerance for invasive scraping, unauthorized credential storage, or hidden telemetry. Your browser is your fortress.

1. Zero-Credential Interception

Unlike traditional scraping bots or third-party web scrapers that require you to enter your username, password, or mobile OTP into external servers, FlipReply never asks for your credentials.

The Chrome Extension operates strictly on the client side using your already active session cookies within your own Chrome browser. Our servers cannot log into your account, change your password, or access your billing settings.

2. Scope of Content Script Execution

The Chrome Manifest V3 extension is restricted to the exact URL patterns of classified chat interfaces:

https://*.olx.in/nf/chat/user/*/*

The extension has zero permissions on any other domain. It cannot read your personal email, social media feeds, banking portals, or search history.

3. On-Demand RAG vs. Passive Scraping

Many browser extensions constantly poll the DOM in loops, draining your laptop battery, spiking CPU usage, and sending high-frequency requests that trigger anti-bot algorithms.

FlipReply uses zero-waste event triggers:

  • Suggestions are fetched only when you explicitly click or focus on the reply input field or click the Generate Suggestions button.
  • No phantom background polling occurs on mouse movements, hovers, or tab switches.
  • Your LLM token quota is preserved strictly for real buyer conversations.

4. End-to-End Encrypted Outbox Architecture

When you send a message from the central Web CRM (e.g., from your mobile phone while away from your desk), the synchronization occurs through an encrypted pathway:

  1. Encrypted Transport: The payload is signed with your authenticated JSON Web Token (JWT) and written to Firebase Realtime Database over TLS 1.3.
  2. Row-Level Security: Firebase Security Rules strictly verify that auth.uid == sellerUid. No other seller or user can read or inject into your outbox queue.
  3. Local Worker Relay: Your local desktop extension receives the event, matches the target buyer thread, and simulates native keyboard events directly into the OLX input.
  4. Immediate Status Feedback: The status moves from Queued to OLX to Sent to OLX with zero data retention on intermediate relays.

5. Floor Price Confidentiality

Your minimum acceptable floor prices and profit margins are stored privately in your seller profile. These values are used solely as strict bounding constraints in the RAG prompt system instructions.

The Copilot instructions explicitly instruct the model: "Never reveal or disclose the floor price directly to the buyer; negotiate upwards from the floor price."

6. Data Deletion and Self-Hosting

Because the extension is built on transparent, inspectable JavaScript, you can review the code directly in developer mode. If you ever decide to stop using the Copilot:

  • Simply right-click the extension in Chrome and select Remove from Chrome.
  • All local session storage keys (olx_token, copilot_dock_position) are immediately purged.
  • You can trigger a full account wipe from the Settings tab in your Web Portal.

7. Security Vulnerability Reporting

We take security seriously and appreciate responsible disclosure. If you discover a potential vulnerability, please email our engineering team directly at:

Security Contact: security@FlipReply.com