Privacy policy

Nothing is visible to people who aren’t signed in, and nothing at all once your account is closed under our rules for trading safely. Other members can see:

• your profile card (your username, when you joined and how many friends you have);
• your collection, if your setting allows it: friends only (the standard) or just you. Your collection value only shows if you turn it on. You change them under You, in Privacy;
• in the Trade Finder, to whoever can see your collection: the cards you mark for trade, and your copies of the cards they look for;
• your public folders and binders, except ones you archived, to whoever can see your collection. Pictures you add to a binder only you see;
• your shop and listings with the country you ship from and, when you sell, whether you sell as a private collector or a business, your seller rating with your average stars and how many ratings you got, your level with the month you reached it and your number of sales and of trades with members you don’t know, whether you use Pulls Pro and with it your shop’s name, words, banner and logo, your shipping rates, how many business days you take to ship and the day you’re back from holiday;
• the ratings you give, with your username;
• to your friends, unless you switch it off under Privacy: which of their spare cards are on your wishlist (up to three per friend). With it off, you don’t see theirs either.
• if you switch on Match with members you don’t know (off by default), members from Starter who switched it on too see your @username, your level and how many trades you completed, and only: the cards you marked for trade that are on their wishlist, and which of their cards for trade are on your wishlist. Never the rest of your wishlist or collection, what you paid or your notes.
• None of this to a member you blocked, or who blocked you: they don’t find you, see your profile, shop or collection, or get notifications about you, and Pulls doesn’t tell them.

Only the other side of a trade: once you both agreed, the other member sees the address you want their parcel at, for that trade only. With a member you don’t know, the one who ships second sees it once the first parcel is on its way. You both see the tracking and the photo of the card in the envelope, and a report with its photos and answer is seen by you both and Pulls.

Only the other side of an order: the seller sees your delivery address once you paid, and can print it on a packing slip or, with Pulls Pro, fetch it into their own shop system, where it’s in their care. Claims, with their photos and videos, are seen by the buyer, the seller and Pulls. While a return is agreed, the buyer sees the seller’s return address, until the card is sent, unless it goes back on a label from Pulls. When you open a tracking link on an order or a return, your browser goes to the carrier’s site with the tracking number and, if the carrier asks for it, the postcode the parcel goes to. Reports only by Pulls: the seller doesn’t see who reported. When you ask for photos, the seller sees what you asked and your note as coming from “a buyer”, not your username. We keep who sent it, but only look when the seller reports the note. Strikes and bans only by you and Pulls.

Never shown to others: your email address, sign-in details, notes, purchase prices, cart and buy list. Nor your wishlist itself, except to your friends as above: members only see roughly how many people want a card (3+, 10+ and so on), counted from the day after a card is added, and never who. Only you see which sellers you follow. Sellers don’t see who follows them.

We store your data in the EU, backups included. A few services help us. Where one works outside the EU, it does so under the EU’s adequacy decision for the United States (the Data Privacy Framework) or the EU’s standard contractual clauses:

• Your sign-in provider handles signing in, under its own privacy policy. Some are based outside the EU.
• Cloudflare carries all traffic to Pulls and protects it against attacks and overload. On our behalf it handles your IP address and what your browser or the app sends, cookies included; the connection is encrypted on both sides of it. When it checks for automated traffic, it may set a short-lived security cookie. It also runs our domain names and forwards email sent to [email protected]. Cloudflare works worldwide, so this can happen outside the EU, under its data processing agreement with the EU’s standard contractual clauses.
• Mailjet sends our emails about your orders, claims, reports, photo requests, your imports, your payouts and your account, the reminders before a deadline on an order or a photo request (you can switch them off) and, if you switch it on, a daily overview when you sell, and if you switch it on, an email when someone sends you a friend request or accepts yours, the alerts you switch on for cards on your wishlist (at most one email a day; your own choice, switch them off in the market’s Alerts or with the link in every alert email), and one email when a seller you follow is back from holiday (not if you switched market emails off). It gets your email address and the message, including what another member wrote in an order or claim. Mailjet keeps your address as a contact. When you delete your account, we ask it to delete that too, which takes up to 30 days. Our own messages never contain payment details. We send them without open or click tracking. Mailjet stores them in the EU, and its support can work from the United States. To run its network and stop spam and fraud, Mailjet decides for itself how it uses this data, under its own privacy policy.
• Google (Gmail) receives email you send to [email protected]. Google is based in the United States and receives it under the Data Privacy Framework.
• Stripe (Stripe Payments Europe, in Ireland) handles payments and payouts. When you pay, Stripe’s page asks for your payment details itself; Pulls sends it what the order is for (card names, the seller’s username and the amounts), never your name, email or address. When you set up payouts, you give your identity and bank details in Stripe’s own forms. You reach them from the Payouts page, and Stripe can open a window of its own to sign you in. Those forms load from Stripe, so Stripe sees your IP address and browser while you use them. Stripe checks them itself, as payment companies must, and tells Pulls whether your payouts are ready and when it needs new details. Pulls gives Stripe the email address of your account when you set up payouts. For what it collects itself, Stripe is responsible under its own privacy policy. Stripe is part of a group based in the United States, so data can go outside the EU, under the EU’s standard contractual clauses.
• TCGdex supplies most card data and most card images. Our server fetches them; your browser and the app only load card images from Pulls.

Our Discord server: if you join it, Discord handles your Discord account and messages under its own privacy policy. Our moderators see what you post there and the reports you send them, and use that only to moderate the server. Our Discord bot keeps your Discord user ID, how many of your messages counted towards your level, when the last one counted, and whether it gave you the Beta tester role. It doesn’t keep or use what you write. It shows your level as a role and posts in the channel when you reach a new one, with the name you use on the server. If your Discord account is on the Pulls beta invite list, it gives you the Beta tester role, so others on the server can see you’re testing Pulls. A moderator removes that role if you ask. We do this in our legitimate interest. A warning, mute or ban is kept as long as it applies, and what the bot keeps is deleted when you leave the server.

Your own shop: when you connect it in Pulls Pro, Pulls sends it what sells or comes back on Pulls and what happens to those orders: your SKUs, listing IDs, numbers of copies, order numbers, what happened to the order (paid, shipped, completed, cancelled, refunded or a claim opened), whether it ships tracked, and when. These messages never contain a buyer’s name, address or payment details. With an orders key, your own systems, or an AI tool you connect to your key, can fetch your Pulls orders: order numbers, cards and copies, prices, shipping, tracking and status. Only if you also allow addresses for that key does it get the delivery address, with the name on it, of paid orders waiting to be shipped: the address the order page already shows you. An AI tool connected through Pulls’ MCP server never gets an address. Never the buyer’s email, phone or payment details. What your systems or the tool’s provider keep is your responsibility. Pulls can’t delete what they already fetched.

• Until you delete your account. Then your profile and account are removed right away, and your photos shortly after. If money from your sales still waits at Stripe, it goes to your bank first as your last payout, and your account goes by itself once it’s there, usually within a few days. Your listings are paused until then. You can cancel it until then. Orders and the ratings you gave stay for the other member’s records, without your name, address or payment details. The delivery country stays, and so does what you wrote in a claim or a rating.
• Orders: the delivery address is removed 90 days after the order ends, and the link to the buyer, with what was written in a claim and its photos, after 2 years. The videos of a counterfeit report are deleted 30 days after the claim closes. On a trade, the addresses and photos are removed 90 days after it ends, and at the latest 180 days after you both agreed. Your notifications in Pulls are deleted after 90 days, and a declined or withdrawn friend request after 30 days.
• Reports, objections and our decisions on them are kept for 6 months after they’re closed, also when the listing or account is gone, without the seller’s name or photos. Strikes count for 12 months. A ban or a closure stays as long as the account. After the account is deleted, the ban or closure, the scrambled identifiers and the decision behind it are kept until 5 years after the ban or closure.
• A binder you delete goes at once, with the pictures you added to it. An archived binder keeps them until you delete it or your account.
• What we only need for a step, such as a check at sign-in or removing a deleted account’s photos and Apple sign-in, is removed once that step is done.
• An import of cards to sell, with the lines or file you sent, is deleted 30 days after you start it. The listings it made stay.
• The stock sync log of Pulls Pro, with what it asked you to look at, is deleted after 90 days, and the messages to your shop, with the references your shop sends for its sales, after 30 days. When your systems send a call with an Idempotency-Key, or the app or the website sends an import of your collection or a card you added while offline, Pulls keeps a fingerprint of the call and the answer it gave for 24 hours, so a repeated call isn’t done twice.
• A photo request, with its note, is deleted 6 months after it closes, or earlier when you delete your account.
• Feedback, with its screenshot, is deleted 6 months after we handled it and 12 months after you sent it at the latest, or earlier when you delete your account.
• Emails we send are kept for up to 7 days, their text only until they’re sent.
• Usage statistics are deleted after 90 days; only totals that point to no one remain.
• Notes about an account that went past the limits are deleted after 90 days.
• When someone at Pulls opens or changes an account as an admin, we log who did it, what they did and which account, never what was in it. That log is deleted after 90 days, also when the account is gone.
• Logs of failed connections are deleted after 14 days. Other logs rotate automatically: once they reach a fixed size, the oldest lines are overwritten. When the app crashes, we keep a copy of its log until we understand why, for at most 30 days.
• Backups keep a copy for up to 30 days and are only used to recover from a failure.