Your cards,
your business.

This policy is written to be read. Here is what PullBinder collects, why, and what we do not do with it.

Effective October 1, 2026 · previous version effective September 14, 2026

What we collect

• Account information. Your email address, either given directly or from your sign-in provider when you use a third-party account to sign in. If you claim an @handle, we store the handle, display name, and bio you choose.
• Your collection. The cards you add: names, sets, grades, conditions, quantities, purchase prices, and notes. This is the product; without it there is nothing to value.
• What you bought and sold. Every purchase and sale you record: date, quantity, price per card, fees, and which purchase a sale came out of. This is the ledger behind your realized gains, your holding periods, and the year-end file you can export.
• Files you import. When you upload a CSV to bring a collection in, we keep the file as you sent it, up to 1 MB, alongside the cards it created; a larger file is stored cut off at 1 MB and recorded as having been cut off. It is how we can tell what actually happened if an import goes wrong. It ages out on the same clock as the rest of your account.
• Where you keep your cards. If you use Places, the container, binder page and pocket you file each card into, plus anything you mark as not in hand. This is a note you write about your own shelf; we do not ask for your home address and there is no field for it.
• Images you upload. Your profile photo, and any card photo you use in place of the stock image. You keep ownership of a card photo you upload. It appears in your binder, and anywhere you choose to put it: on your profile if you make one public. Under the Terms you also grant us a broad licence to use content you upload, including to promote PullBinder; that licence is set out in Your content and you should read it. Separately: if we replace a card's stock artwork because the vendor's image is wrong or missing, that replacement is shown to everyone, but it is our image, never yours.
• Payment & subscription data. If you subscribe, our payment processor handles the payment and we never see or store your card number. What we keep is the boring half: the processor’s customer and subscription ids, which plan you are on, when it changes, whether a payment failed, and a record of the price you were shown when you agreed to it.
• Messages you send us. If you email or use the contact page, we keep the correspondence.
• How you found us. The first time your browser arrives, we note the site that referred you (for example a search engine, a forum, or an AI assistant), the page you landed on, and any campaign tags in the link (the utm_ values). We keep the first one we ever see, so we can tell which channels actually bring people in rather than which one you happened to use on the day you signed up. We store the page path, never the full address with its query string; that is deliberate, because links can carry one-time tokens and those are none of our business. Until you create an account this sits in your own browser and is never sent to us; if you never sign up, we never receive it.
• How you use the app. Once you are signed in, we record which sections you open, roughly how long you spend on each, and the actions that matter to the product working: a card added and how it was added (typed, scanned, or imported), a search run, a scan attempted, a file imported. We use it to see which parts of PullBinder are actually used, to find where something is going wrong, and to tell a real account from an automated one. We do not record what you type into search boxes beyond the query itself, and we do not track you across other websites.
• Sign-in & security data. When you sign in, we record your IP address, your browser's user-agent string, and derive an approximate, city-level location from the IP. We use this to keep the service secure: spotting fraudulent or automated accounts, and showing you your own active sessions so you can sign out of a device you no longer have.

We derive only an approximate, city-level location from your IP address; we do not collect your precise GPS location, your contacts, or anything from your device beyond what the pages need to work. Two different things in this policy are called "location": the city we estimate from your IP, and the shelf or binder page you file a card on in Places. The first is derived from the network; the second is something you type, and it never leaves your account.

How we use it

To run PullBinder: value your cards, chart your portfolio, compute what you made when you sell, render your public profile if you make one. If you subscribe, we use your billing record to charge the right amount, to give you the features you paid for, and to email you when a payment fails. Price lookups sent to our market-data sources describe cards, never you. We use aggregate product data (how many users, which features get used) to decide what to build next.

What we never do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the privacy laws that use them. That is the statutory wording and we mean it as written: no data broker, no ad network, nothing here that follows you off this site. We do use a third-party analytics tool (described under Cookies below) and we run it with its advertising features turned off precisely so that this paragraph stays true. If any of that ever changes, we will update this policy and give you whatever choice the law requires.

We don't share your collection with anyone unless you choose to: a public profile shows what you make public, including, if you turn one on, the total value of your collection as a single figure; a share link shows the cards you put in it, and both are off by default.

Where your card photographs go. When you scan a card, the photograph is sent to a third-party vision provider that works out which card it is, and is processed under that provider's terms and ours. Outside our own storage, that is the only place your images go. We say this plainly rather than let a tidier sentence stand in for it.

We don't run ads today. Subscriptions are how this is meant to pay for itself, and that is the plan. We are not going to promise we never will; a small product should be honest that it may one day have to earn its keep another way. If we introduce advertising, we will say what runs and what information is involved, and the commitments above still apply.

We compile and use aggregated, anonymized and de-identified information: figures that describe how many people are here and broadly what they collect, and that do not identify you. We may use, publish, share and licence that information for any purpose, including research, benchmarking, market reporting and the development of new products and services. We keep it in de-identified form and do not attempt to reverse it back to a person.

Who touches the data

PullBinder runs on service providers who process data on our behalf under contract, and only on our instructions: infrastructure and hosting, database and authentication, file storage for the photos you upload, payment processing, card recognition for the scanner, product analytics so we can see which parts of the app people actually use, and email delivery for the messages we send you. We choose them for security and change them when we need to, so we describe them by what they do rather than by name. Inside PullBinder, access to your information is limited to people who need it to operate and support the service. Concretely: we can look at an account’s cards and its sign-in records when we are supporting you or investigating abuse. We would rather say that than let the sentence before it do the work.

Two of those are worth being specific about, because you interact with them directly. Our payment processor receives your email and your card details from you; the card details never touch our servers, and its own privacy policy governs what it does with them. If you sign in with a third-party account, that provider knows you authenticated with us, and its privacy policy governs that step.

Beyond that, we share your information only in a few ordinary situations: when the law compels us; to investigate fraud, abuse, or a threat to someone's safety; to enforce our Terms; with our own professional advisers under a duty of confidence; and, if PullBinder is ever acquired or merges with another company, with that company as part of the transaction, in which case this policy keeps governing your information until you are told otherwise. We do not share it for anything else.

If you need the current list by name (for a security review, or your own diligence), ask at [email protected] and we will tell you.

Cookies and local storage

We store your sign-in session in your browser so you stay signed in, your display preferences so the app remembers how you like it, and (from your very first visit) a single note of how you arrived: the referring site, the page you landed on, and any campaign tags in the link. That note stays in your browser and is sent to us only if you create an account; clearing your browser storage erases it, and if you never sign up we never see it. One more, and it is a third party's: an analytics provider sets a cookie that counts visits and measures which parts of the app actually get used (how many people open Places, where a signup stalls, that sort of thing). We run it in measurement mode with the advertising features switched off: no ad personalization, no cross-site identity matching, and your IP address truncated before it is stored. It measures this site; it does not follow you off it. There are no advertising cookies, and we do not build a profile of you across other sites. Where the law gives you a choice about how your information is used, this policy tells you how to exercise it.

Your controls

You can make your profile private or delete your handle at any time in Settings. You can delete cards or photos at any time. You can revoke a share link, or set it to expire, from the share panel. Settings also shows every device currently signed in to your account and lets you sign them all out. If you subscribe, you can cancel whenever you like from Plan in your account menu. To delete your account and everything in it, open Settings, scroll to Delete your account, and press the button. It happens straight away, it is permanent, and it includes your collection and photos. Any paid plan is cancelled first, so you are not billed again. Backups age out on the schedule under How long we keep it.

Your rights over your data

Wherever the law gives you these rights (and in practice we do not check before honoring them), you can ask us to show you what we hold about you, correct anything wrong, hand it back in a portable form, stop a particular use, or delete it entirely. Email [email protected] from your account address and a person handles it, usually within 45 days. We may first confirm it's really you, so nobody else can request your data in your name. Asking costs you nothing and never changes how we treat you.

If you live in California, or Virginia, Colorado, Connecticut, Utah, Texas, Oregon or Montana

California's privacy law, and the laws now in force in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing list of other states, give residents specific rights. We do not check which state you are in before honoring them; if a law grants you one of these anywhere, you have it here. They are: to know what personal information we collect and why, to get a copy, to have it deleted, and to not be treated differently for exercising any of them. The full list is under What we collect above: your account details, your collection, your transactions, where you keep your cards, images you upload, your payment and subscription record, your sign-in and security data, and messages you send us. We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is no "sale" or "sharing" to opt out of, and no "Do Not Sell" link to click; there would be nothing behind it. The only information we hold that any of these laws treats as sensitive is your sign-in credential, and we use it for exactly one thing: letting you into your own account. We do not use or disclose it to infer anything about you, which is why there is no “limit the use of my sensitive information” link either. We do not build behavioral profiles of you as a person, and we do not use your data to make automated decisions producing legal or similarly significant effects on you. The scores and figures in the app describe cards and holdings, not you. To use any of these rights, email [email protected]. If we turn a request down, we will tell you why, and you can appeal simply by replying to that email; we will answer the appeal within 45 days and tell you how to reach your state attorney general if you are still not satisfied. In California you may also make a request through an authorized agent.

Where your data lives

We store and process your data in the United States. If you use PullBinder from somewhere else, your information is transferred here and handled under US law, which may protect it differently than your own country would. It goes nowhere beyond the providers and situations described under Who touches the data.

Security

Data is encrypted in transit and access to production systems is restricted. No system is perfect. If a breach affects your data we will tell you plainly, and within the time and manner the law requires.

How long we keep it

Different things have different clocks, so here they are.

• Your account, collection, ledger and photos. Kept while your account is open. Deleting your account takes them out of the live service immediately. If you ask us by email instead, we do it normally well inside 30 days and in any event within the time the law allows.
• Which version of these documents you agreed to. The record of which version of the terms and this policy you accepted, and when, is kept even after the account is deleted, because it is the evidence that the agreement existed. It holds no cards, no transactions and nothing from your profile.
• Backups. A further 90 days. Backups exist so that a bad day does not cost you your collection, and they cannot be edited selectively, so deleted data survives there briefly, then ages out. This is the one people are surprised by, which is why it is written down.
• Payment records. Seven years. Not our choice: tax law requires a business to keep proof of what it charged and when. This is the fact of a transaction, never a card number; we have never held one of those.
• How you use the app. The page-by-page record of your activity is kept for 12 months and then deleted automatically. A year is enough to see a seasonal pattern and to investigate a problem; beyond that it tells us nothing we need and is simply a record of you that we are holding on to.
• How you found us. Kept for as long as your account is open, then deleted with it. It is one line: the referrer, the landing page and any campaign tags from your first visit, and it is what tells us which channels are worth continuing.
• Server logs. 90 days, then discarded.
• Support email. Kept while the conversation is useful, then cleared.

One exception to all of it: anything a law, a subpoena or an active fraud investigation requires us to preserve, held only as long as that requires.

One thing worth knowing before you delete a card. Selling a card removes it from your holdings but deliberately leaves its buy and sell rows in your ledger; otherwise the gain you realized would vanish from your own records the moment you sold. Deleting a card you never sold takes its ledger rows with it. Deleting your account removes all of it.

Children

PullBinder is not directed at children under 13, and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.

Changes

If this policy changes in a way that matters, we will post the revision here, update the effective date above, and tell you in the way the law requires for a change of that kind. We are not going to bury it. Using PullBinder after a change takes effect means the updated policy applies to you.

Contact

Questions, corrections, deletion requests: [email protected]. A person reads it.