Privacy policy

Pullnomics is a price-comparison site. You can use every page without an account and without giving us any personal information. This policy explains the little we do collect, why, who else sees it, and how to make us delete it. Short version: we store an email address only if you ask for alerts; we log clicks on eBay links with hashed, non-reversible identifiers; eBay and Google may set cookies when you click through or when an ad is shown; we never sell personal data.

1. Who is responsible

The data controller is the operator of Pullnomics, reachable at hello@pullnomics.com. We are based in the United States and our servers are located there.

2. What we collect and why

2.1 Email alerts (only if you subscribe)

• What: your email address, the alert criteria you chose (card, set, product, price and score thresholds), the frequency, whether the address has been confirmed, random tokens used in the confirm, manage and unsubscribe links, the time the alert was created, and a delivery log recording which deal was sent to which alert and when.
• Why: to send the alerts you asked for, to send each listing at most once, to honour unsubscribes, and to prove consent (the confirmation click is our record of double opt-in).
• Legal basis (GDPR): your consent, given when you confirm the address. You can withdraw it at any time with the unsubscribe link.
• Processor: messages are sent through Resend (resend.com), which processes the address and message content on our behalf.

2.2 Click logging on marketplace links

• What: when you click “View on eBay”, your browser sends us a small beacon containing the listing id, the deal id, the page you were on, the referring page, your country as reported by our hosting provider, and two hashes: a salted SHA-256 hash of your IP address and one of your browser’s user-agent string, each truncated to 24 characters. We do not store the raw IP address or user agent.
• Why: to see which deals people act on, to detect click fraud and abuse, and to reconcile eBay’s commission reports with our own counts. The hashes let us count distinct visitors approximately without being able to identify anyone.
• Legal basis: our legitimate interest in measuring and securing the service. The link itself goes directly to eBay; the beacon runs in parallel and never delays or redirects you.

2.3 Server and hosting logs

Our hosting provider records standard request logs (IP address, URL, user agent, timestamp) for security and debugging and deletes them on a short rolling basis. Searches you type into the site’s search box are answered from our database and are not stored beyond those transient logs. We do not run analytics scripts that track you across pages.

2.4 Contact

If you email us, we keep the correspondence for as long as needed to deal with it and for a reasonable period afterwards.

3. Cookies and third-party tracking

Pullnomics itself sets no tracking cookies. Two third parties may:

3.1 eBay Partner Network

Pullnomics is a member of the eBay Partner Network. Links to eBay carry an affiliate parameter. When you click one, eBay may set cookies in your browser so that a purchase within its attribution window (24 hours for fixed-price items; for auctions, a bid within 24 hours that wins within 10 days) is credited to us. eBay’s processing is governed by the eBay User Privacy Notice. We receive aggregate commission reports; we do not receive your name, address or order details.

3.2 Google AdSense advertising cookies

We may display advertising served by Google AdSense. Google’s required disclosure applies:

• Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.
• Users may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info.

Google’s handling of data in its ad products is described at How Google uses information from sites or apps that use our services. Visitors from the European Economic Area, the United Kingdom and Switzerland are shown a consent dialog before any personalised advertising cookies are set, and can change their choice at any time through that dialog.

3.3 Browser storage

The site may use your browser’s local storage to remember interface preferences such as a chosen filter. Nothing in it identifies you and it never leaves your browser.

4. Who we share data with

• Service providers acting on our instructions: Vercel (hosting and edge network), a managed PostgreSQL provider (database), Resend (email delivery). Each is bound by a data-processing agreement.
• eBay and Google, as described in section 3, act as independent controllers for the cookies they set.
• Legal requests: we disclose data if required by law or to protect the service from abuse.

We do not sell personal information and have not sold it in the preceding twelve months. Personalised advertising cookies set by Google may count as “sharing” for cross-context behavioural advertising under California law; the opt-out links in section 3.2 and the consent dialog are how you decline it.

5. How long we keep data

• Alerts: until you delete the alert. Unsubscribing pauses alerts rather than deleting them, so that we can honour your opt-out permanently; email us if you want the record erased instead. Delivery-log rows are deleted with their alert.
• Click logs: up to 12 months, after which only aggregate counts are kept.
• Correspondence: up to 24 months after the last message.

6. Your rights

Everyone: you can unsubscribe from every alert with one click in any email, or from the manage page linked in each email, with no login.

If you are in the EEA, UK or Switzerland (GDPR): you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing; and not to be discriminated against for exercising these rights. We do not use or disclose sensitive personal information.

How to exercise them: email hello@pullnomics.com from the address concerned, or via the contact page. We verify requests by replying to the email address on file and respond within 30 days, or within any shorter period the law requires. An authorised agent may act for you if they provide written permission.

7. Security

All traffic is encrypted with TLS. Alert links use long random tokens that cannot be guessed; anyone who has a manage link can change the alerts on that address, so treat forwarded emails accordingly. Identifiers in the click log are salted hashes that cannot be reversed to an IP address.

8. Children

Pullnomics is written for adult collectors and is not directed at children. We do not knowingly collect personal information from anyone under 13 (or under 16 where that is the local age of digital consent). If you believe a child has subscribed to alerts, email us and we will delete the record.

9. International transfers

Our infrastructure is in the United States. If you use the site from elsewhere, your data is transferred there. For EEA and UK visitors, our processors rely on standard contractual clauses or the EU-US Data Privacy Framework.

10. Changes

We will post any change to this policy on this page and update the effective date at the top. Material changes to how we use alert email addresses will be announced by email before they take effect.

11. Contact

hello@pullnomics.com. See also the terms of use.