Privacy policy

Pullnomics is a price-comparison site. You can use every page without an account and without giving us any personal information. This policy explains the little we do collect, why, who else sees it, and how to make us delete it. Short version: we store an email address only if you ask for alerts or email us; we log clicks on the eBay, TCGplayer and store buttons, keeping hashes in place of your IP address and browser details; eBay may set cookies when you click through, and Google would set them only if ads were enabled (none run today); we never sell personal data.

1. Who is responsible

The data controller is the operator of Pullnomics, reachable at hello@pullnomics.com. We are based in the United States and our servers are located there.

2. What we collect and why

2.1 Email alerts (only if you subscribe)

• What: your email address, the alert criteria you chose (card, set, product, price and score thresholds), a label describing them, the frequency, whether the alert is active or paused, whether the address has been confirmed, random tokens used in the confirm, manage and unsubscribe links, the time the alert was created and the time it last sent, and a delivery log recording which deal was sent to which alert and when.
• Why: to send the alerts you asked for, to send each listing at most once, to honour unsubscribes, and to prove consent (the confirmation click is our record of double opt-in).
• Legal basis (GDPR): your consent, given when you confirm the address. You can withdraw it at any time with the unsubscribe link.
• Processor: alert emails are not being sent yet. When they start, they will be sent through Resend (resend.com), which will process the address and message content on our behalf.
• While alert emails are not sending: the site scans eBay listings and lists deals, but alert emails are not switched on yet. An alert you create now is stored unconfirmed, with your email address and criteria, because you asked us to save it, and nothing is emailed. If emails are switched on, the first message will be a confirmation link, and nothing further is sent unless you click it. To have an unconfirmed entry deleted, email us from that address.

2.2 Click logging on marketplace links

• What: when you click an eBay, TCGplayer or store button (Pokémon Center, Target, Walmart, Best Buy, GameStop), your browser sends us a small beacon. We store an identifier for the card, product, listing or deal the button belongs to, which marketplace it leads to, the path of the page you were on and that page’s full address as your browser reports it (including any query string), the time of the click, your country as reported by our hosting provider, and two hashes: a SHA-256 hash of your IP address and one of your browser’s user-agent string, each combined with a secret value we hold and truncated to 24 characters. We do not store the raw IP address or user agent.
• Why: to see which pages and buttons people act on, to detect click fraud and abuse, to reconcile eBay’s commission reports with our own counts, and to see how much traffic goes to each store. The hashes let us count distinct visitors approximately. They are pseudonymous, not anonymous: we hold the secret value used to make them, so a given IP address could in principle be matched to its hash by trying every possible address. We do not attempt that, and we do not match the hashes against alert email addresses or any other record.
• Legal basis: our legitimate interest in measuring and securing the service. The link itself goes directly to eBay, TCGplayer or the store; the beacon runs in parallel and never delays or redirects you.

2.3 Server and hosting logs

Our hosting provider records standard request logs (IP address, URL, user agent, timestamp) for security and debugging and deletes them on a short rolling basis. Searches you type into the site’s search box are answered from our database and are not stored beyond those transient logs. We do not use advertising trackers or any analytics that follows you across websites.

2.4 Page-view analytics

We use Vercel Web Analytics to count page views and see which pages are read. It sets no cookies. For each page view Vercel records the time, the page address (our site removes alert-link tokens and search terms from it before sending), the referring page as your browser reports it, your approximate location (country, region and city, derived from your IP address), your operating system, browser and device type and their versions, and a hash computed from the request, which Vercel uses to count visits and discards after 24 hours. Vercel Inc. processes this on our behalf; Vercel states that the data is used for aggregated statistics only. Legal basis: our legitimate interest in knowing which pages are used.

2.5 Contact

If you email us, we keep the correspondence for as long as needed to deal with it and for a reasonable period afterwards.

2.6 Deal Check

When you paste an eBay link or item number into the Deal Check, our server reads the item number from it and asks eBay’s Browse API for that listing. eBay’s API receives the item number from our server, not anything about you. The site does not store or log what you paste. The listing photo shown with the result loads from eBay’s image server (section 3.4), and if you then click the listing’s eBay button, the click is logged as described in section 2.2.

2.7 eBay sellers

Listings come from eBay’s Browse API. For every listing the site matches to a card or product, not only those shown as deals, we store the details eBay publishes, including the seller’s eBay username, feedback score and feedback percentage. We show the username and feedback beside each deal and in the Deal Check, and the feedback is one input to a listing’s confidence rating. We keep a seller’s record until eBay notifies us that the member has closed or deleted their account; we then delete that seller’s record, their listings and the deals built on them. A listing that has ended, or that eBay no longer returns, is deleted 14 days later unless a deal was built on it.

3. Cookies and third-party tracking

Pullnomics itself sets no tracking cookies. Two third parties may:

3.1 eBay Partner Network

Pullnomics is a member of the eBay Partner Network. Links to eBay carry an affiliate parameter. When you click one, eBay may set cookies in your browser so that a purchase within its attribution window (24 hours for fixed-price items; for auctions, a bid within 24 hours that wins within 10 days) is credited to us. eBay’s processing is governed by the eBay User Privacy Notice. We receive aggregate commission reports; we do not receive your name, address or order details.

3.2 Google AdSense advertising cookies

No advertising runs on Pullnomics today and Google sets no cookies through this site. If we enable advertising served by Google AdSense, Google’s required disclosure will apply:

• Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.
• Users may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info.

Google’s handling of data in its ad products is described at How Google uses information from sites or apps that use our services. If advertising is enabled, visitors from the European Economic Area, the United Kingdom and Switzerland will be shown a consent dialog before any personalised advertising cookies are set, and can change their choice at any time through that dialog.

3.3 Browser storage

The site uses your browser’s local storage for four things only, and only after something sets them:

• pn_eggs_S1: if you play the egg hunt, your finds: which eggs, their codes, the date and the name you stamped them with. When you stamp a card, that name is sent to the site so the code can be signed; when anyone checks a code on the egg hunt page, the name on the screenshot is sent the same way. The server neither stores nor logs either.
• pn_recent: the last eight cards, sets and products you opened (their address, name, set and picture), shown back to you on the search page, the sets page and the page-not-found page. Clear it with the Clear button there. This list is never sent to the site.
• pn_starred: the cards, sets and products you starred, up to sixty, shown in the same places. Unstar an item on its page, or clear the list. This list is never sent to the site.
• pn_notrack: a testing switch the site’s operator uses, set only when a page is opened with a special address parameter. While it is set, that browser sends no click beacon and no page-view analytics.

3.4 Other outbound links and images

Recent sealed product pages link to the search results of retailers (Pokémon Center, Target, Walmart, Best Buy, GameStop). Those are plain links today, not affiliate links. A click on one is counted by the beacon described in section 2.2, and if we join a retailer’s affiliate program the link will be marked as an affiliate link on the page. Card and product pages also link to the matching TCGplayer product page. Those are plain links today: they carry no affiliate or tracking parameter, and a click on one is counted by the beacon described in section 2.2. If we join TCGplayer’s affiliate program they will become affiliate links, and this policy and the on-page disclosure will be updated first. Most images load directly from third-party hosts: card and product images from the Pokémon TCG API image CDN (images.pokemontcg.io), Scrydex (images.scrydex.com) and TCGplayer’s image CDN, and photos of eBay listings, wherever the site or an alert email shows a listing, from eBay’s image server (i.ebayimg.com). Your browser or email client requests these images when the page or email loads, without any click, so those hosts see your IP address and browser details as any website you visit would. Some card images and set logos on the home page are fetched through our own server instead.

4. Who we share data with

• Service providers acting on our instructions: Vercel (hosting, edge network and the page-view analytics in section 2.4) and Supabase (managed PostgreSQL database), each bound by a data-processing agreement; Resend, once alert emails start (section 2.1); and Cloudflare, which provides DNS for pullnomics.com and forwards email sent to addresses at that domain to the mailbox where we read it.
• eBay and Google, as described in section 3, act as independent controllers for the cookies they set. eBay also receives your IP address when listing photos load from its image server (section 3.4).
• Legal requests: we disclose data if required by law or to protect the service from abuse.

We do not sell personal information and have not sold it in the preceding twelve months. Personalised advertising cookies set by Google may count as “sharing” for cross-context behavioural advertising under California law; the opt-out links in section 3.2 and the consent dialog are how you decline it.

5. How long we keep data

• Alerts: until you delete the alert. Unsubscribing pauses alerts rather than deleting them. A paused alert is not emailed again unless you switch it back on, and a new alert on the same address is not emailed until its own confirmation link is clicked. Email us if you want the record erased instead. Delivery-log rows are deleted with their alert.
• Click logs: up to 12 months; older rows are deleted every night, and only aggregate counts are kept: daily totals, clicks per marketplace, and the ten busiest pages of the previous 30 days.
• Correspondence: up to 24 months after the last message.

6. Your rights

Everyone: alert emails are not sending yet, so to delete an alert you saved, email us from that address. Once they send, every alert email carries a one-click unsubscribe and a link to a manage page, with no login.

If you are in the EEA, UK or Switzerland (GDPR): you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing; and not to be discriminated against for exercising these rights. We do not use or disclose sensitive personal information.

How to exercise them: email hello@pullnomics.com from the address concerned, or via the contact page. We verify requests by replying to the email address on file and respond within 30 days, or within any shorter period the law requires. An authorised agent may act for you if they provide written permission.

7. Security

All traffic is encrypted with TLS. Alert links use long random tokens that cannot be guessed; anyone who has a manage link can change the alerts on that address, so treat forwarded emails accordingly. The click log holds no readable IP address or user agent, only hashes made with a secret value we hold; they are pseudonymous rather than anonymous (see section 2.2).

8. Children

Pullnomics is written for adult collectors and is not directed at children. We do not knowingly collect personal information from anyone under 13 (or under 16 where that is the local age of digital consent). If you believe a child has subscribed to alerts, email us and we will delete the record.

9. International transfers

Our infrastructure is in the United States. If you use the site from elsewhere, your data is transferred there. For EEA and UK visitors, our processors rely on standard contractual clauses or the EU-US Data Privacy Framework.

10. Changes

We will post any change to this policy on this page and update the effective date at the top. Alert emails are not sending yet, so a change is announced on this page only; once they send, material changes to how we use alert email addresses will be announced by email before they take effect.

11. Contact

hello@pullnomics.com. See also the terms of use.