Privacy policy

Who we are

Pulls TCG (“Pulls”, “we”) is run by 3DCollector, Chamber of Commerce (KvK) 99719711, VAT NL005405544B42. You can reach us at privacy@pulls.trade.

We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

What we store

From your sign-in provider

You sign in with Discord, Google, Apple, Microsoft or X. From that provider we receive your name, email address, profile picture link and account ID. We also store the sign-in tokens the provider issues, so we can keep you signed in and, for Apple, revoke our access when you delete your account. We never see your password and never post on your behalf.

What you enter

• Your profile: username, display name, country, currency, preferred price source and who may see your profile.
• Your collection: cards and variants, condition, language, quantity, purchase price, notes, folders and binders, and cards you import from another app.
• Your wishlist, including the maximum price you’d pay.
• Your friends and friend requests.
• Your listings: cards you offer for sale or trade, prices, descriptions and the photos you upload.

When you use Pulls

• A session cookie that keeps you signed in on the website, and a sign-in token for the app.
• Your theme and display choices, stored in your own browser, not on our servers.
• Your IP address, held in memory for up to a minute to limit abuse (rate limiting). We don’t keep access logs.
• Error logs, which can contain your account ID when something goes wrong.

Why we use it

• To run Pulls for you (performing our agreement with you): your account, collection, wishlist, prices in your currency, your listings, your profile, friends and trade matches.
• To keep Pulls safe and working (our legitimate interest): the invite list, rate limits, error logs and backups.
• When the law requires it, for example if an authority lawfully asks for information.

Who can see it

Nothing is visible to people who aren’t signed in. Signed-in members can see:

• Your profile card: username, display name, country, when you joined and how many friends you have. Members can find you by username or name and send you a friend request.
• Your collection, depending on your profile setting (Account → Privacy). By default all members see it; you can limit it to friends or to yourself. It covers your collection stats, cards you marked for trade, sets in progress, recently added cards and the folders you show on your profile. Your collection value only appears if you turn that on.
• The Trade Finder: if your profile is visible to members, cards you marked for trade can show up in other members’ trade searches. Friends can also see cards they’re missing that you own, if your setting lets friends see your collection.
• Your listings, including photos, with your username, display name and country.

Never shown to others: your email address, sign-in details, notes, purchase prices and wishlist. We can access data when that’s needed to run, secure or support Pulls.

We use a few other services to run Pulls:

• Sign-in providers (Discord, Google, Apple, Microsoft, X) handle the sign-in you choose, under their own privacy policies. Some are based outside the EU.
• Cloudflare runs our domain names (DNS) and forwards email sent to privacy@pulls.trade.
• TCGdex provides card data and images. We copy images to our own server, so your browser normally loads them from us. If our copy isn’t available, your browser may load the image straight from TCGdex.

Pulls itself, its database and its backups run on our own hardware in the Netherlands.

How long we keep it

• Your data stays as long as you have an account.
• When you delete your account, we remove your data right away: your profile, sign-in details, collection, folders, wishlist, friends, listings and listing photos.
• Backups still contain it for up to 30 days, then it’s gone for good. We only use backups to recover from a failure.
• Error logs are rotated automatically, so older entries are overwritten.

Your rights

You can view and correct your profile and choose who sees it under Account, and you can delete your account at any time. You can also ask us for a copy of your data, to correct or delete it, to restrict how we use it, or object to it. Email privacy@pulls.trade from the address linked to your account. We reply within a month.

If you think we handle your data wrongly, please tell us first. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

Children

You need to be at least 13 to use Pulls. If you’re under 16, a parent or guardian must agree before you create an account. If you believe a child uses Pulls without that permission, email privacy@pulls.trade and we’ll delete the account.

Security

All traffic is encrypted (HTTPS). Only invited accounts can sign in, and every request checks that again. App sign-in codes are single-use and tied to the device that asked for them. No system is perfect: if a breach affects your data, we’ll tell you and the authorities as the law requires.

Changes

We update this policy when Pulls changes, for example when payments arrive. The date at the top shows the latest version. For important changes, we tell you in Pulls before they take effect.