Acceptable Use — the things we will not build
Most SaaS acceptable-use policies are written to describe how you may use the service. This one describes what we will refuse to ship, even if a paying customer asks for it. The two documents live at different levels: this one is prior to product development.
1. We will not automate Carvana, CarMax, KBB Instant Cash Offer, or Peddle
All four platforms require the person submitting a request to represent that they hold, or are legitimately authorized to sell, the vehicle. Carvana's terms explicitly bar dealer resellers. Automating any of these platforms on behalf of a flipper who does not hold title is fraud and creates breach-of-warranty exposure to the platform.
Algo (Auto Lenders) is different — their public flow does not require title at the pre-submit step, and the follow-up phone call is a human off-ramp for both parties. That is why Algo is the only third-party instant-offer buyer FlipScout ever calls.
2. We will not run a hosted scraping fleet against Autotrader or KBB
Cox Automotive's Visitor Agreement (Autotrader) and KBB's terms both prohibit "systematic extraction … by … web robots, crawlers, or spiders." Craigslist v. 3Taps (settled 2015, $1M plus a permanent injunction) is directly-on-point precedent for "IP-block-then-scrape-anyway" behavior. Cox owns both brands and Manheim; they have both the motive and the litigation muscle.
The self-hosted CLI is a different posture: the user is the visitor those terms bind, running the scan on their own machine at their own IP. The hosted Pro / Shop service uses licensed FSBO data (MarketCheck) and licensed valuations (VinAudit) instead.
3. We will not run a hosted scraping fleet against Facebook Marketplace
Meta's 2025-01-01 terms amendment extended the anti-automation prohibition to logged-off visitors, closing the Bright-Data loophole. Hosting an FBM crawler is the fastest path to a takedown. A Chrome-extension "personal mode" that reads FBM as the user's own logged-in browser is a v1.x conversation, not a hosted service.
4. We will not run a hosted scraping fleet against Craigslist
See 3Taps, above. Same posture as FBM — if we ever add Craigslist coverage, it's user-side only.
5. We will not present KBB numbers as "official KBB data" under our brand
Even on the CLI, where the user is the visitor, we render KBB numbers as "KBB Fair Purchase Range (per Autotrader listing)" rather than "FlipScout KBB estimate". The user pulled the number from KBB; we surfaced it. Same posture as a browser extension overlaying prices.
6. We will not build a batch mode tuned to help users evade state dealer-license caps
Nearly every US state caps how many cars a private party can sell per year before a dealer license is required. Florida is two; Washington three; Texas four (rolling 12 months); New York and California five (calendar year). Range across all states: two to twelve.
Building a feature that enables a user to exceed those caps — identity rotation, batch-quoting fifty VINs per hour to stage inventory, cross-account listing management to spread sales across multiple names, an "auto-post to Facebook under a rotating identity" mode — crosses into "conscious, voluntary, culpable participation" in the illegal unlicensed-dealer activity. Not a hill we'll die on.
Every internal roadmap review explicitly asks "does this feature enable state-cap evasion?" A "yes" kills the feature in review.
7. We will not automate Algo submissions without per-submission consent
Every Algo submission requires --yes on the CLI and,
on the hosted service, a typed AGREE matching a hash
of the current Algo disclaimer text you were shown. There is no
"one --yes covers the queue" mode. There is no cron
mode. There is no daemon that submits floors overnight.
8. We will not accept phone or email overrides at the CLI or the API
The phone that rings is the phone in your own settings file. No
--phone flag, no FLIPSCOUT_PHONE env
var, no API parameter that overrides it, no admin dashboard that
injects one. The moment you can pass a phone number in a URL
parameter, roommate-swap attacks become the default fraud pattern.
9. We will not proxy credentials to third-party sites
No stored Autotrader, KBB, Algo, Carvana, or CarMax cookies. Every quote is a fresh Playwright context. If Algo requires the user to log in, we don't quietly relay a stored login — we prompt the user each time.
10. We will not sell your data
No selling contact info, no selling search history, no selling scored listings, no letting a data broker license the corpus. See the Privacy Policy.
11. We will not silently change any of the above
If we ever remove an item from this list, we'll post a written brief explaining what changed and why the change is safe, and email every active hosted-service customer at least 30 days before the change takes effect. A quiet product update that starts doing any of items 1–10 would break trust with the flippers who bought FlipScout precisely because it doesn't do them.
Reporting a violation
If you believe FlipScout is being used against this policy — a hosted crawler pretending to be a CLI, a batch-mode evasion tool someone built on top of the API, an Algo submission with your contact info that you did not authorize — email abuse@flipscout.dev and we will investigate within five business days.