Privacy Policy

What we collect

Pullworthy works without an account. If you do not create one, we do not collect a name, an email address or a password. What we collect either way:

• The card images you upload for grading.
• A salted, one-way hash of your IP address, used only for basic rate limiting. We never store your raw IP address.
• The grading results we generate — sub-grades, centering measurements, the overall estimate, and any value figures shown alongside them.

If you create an account

Accounts are optional. Grading works without one; an account exists only so your graded cards stay in one place. If you create one, we additionally store:

• Your email address, which is how you sign in.
• A one-way hash of your password. We never store the password itself and cannot read it.
• Session records — a random token, when it expires, and the browser and IP address the session was created from — so that staying signed in works and you can be signed out.

We do not send marketing email. We send email only to confirm your address and, if you use the marketplace, to tell you that you have a new message — that notification never contains the message itself.

You can delete your account at any time. Deleting it removes your email address, your password hash and all your sessions. Your grading reports are not deleted — they are detached from the account and become anonymous again, so any share link you have already given someone keeps working. To delete your account, sign in and go to Settings → Account, or email us using the address below and we will do it for you.

If you publish a card to the gallery

Publishing is a separate, deliberate act, and it is reversible at any time. Grading a card never publishes it. If you do publish one, these become PUBLIC — visible to anyone, including search engines:

• The display name you chose. Your email address is never shown anywhere public, never shown to other users, and never appears in a message or a notification.
• A snapshot of the card taken at the moment you published: its photo, its identity, and the grade estimates. It is frozen — a later re-grade changes your private report and not the listing.
• Whether you are open to selling, and an asking price if you set one.
• A link to your full grading report ONLY if you ticked that box when publishing. It is off by default.
• An approximate location, and only if you chose to add one. It is a district-level point rounded to about a kilometre — a postcode district or a town, never an address and never your exact position. Buyers see a place label and a rough distance in miles. You can remove it at any time, and removing it removes the stored coordinates.

Unpublishing takes the public page down. Deleting your account deletes your display name and every listing you published.

Messages between users

If you message another collector about a card, we store the message text, who sent it, which conversation it belongs to, and when. We also store any photos or short videos you attach to it.

• Messages are deleted after 24 months. A weekly job removes messages older than that along with their attachments, and removes any conversation left with no messages in it.
• Notification emails never contain the message. They say that you have a new message about a named card and link you to the site, so the text of what people say to each other never leaves our database and is never handled by our email provider.
• Attachments are stored at unguessable addresses and appear only in the conversation itself. They are never on a public page and never in an email.
• If you delete your account, your messages stay in the other person’s conversation but stop being attributed to you — they show as sent by a deleted account. This is so the person you were talking to keeps their own record of the conversation. Your listings, your display name and your location are deleted.

Blocking and reporting

You can block another user, which stops new messages in both directions. We store who blocked whom and when. Blocking hides nothing that was already said — the conversation stays readable to both of you, because a record of what happened is what a report is made of. We never tell the other person that they have been blocked.

You can also report a listing, a message or a user. We store what you reported, the reason you picked, any note you wrote and that it came from you. Reports are read by the site owner in a moderation queue, and a report about a message includes that message and its attachments — that is the evidence needed to make a decision about it. We do not tell the person you reported who reported them, and we keep reports after they are dealt with as the record that a complaint was made and handled. If the account that made a report is deleted, the report stays but stops being linked to anyone.

If you scan cards from a video

Your video is read on your device. We find each card in it, pick the sharpest picture of each face and show you what we found — all of that happens in your browser, and nothing is sent anywhere while you are checking it.

If you choose to have cards from that scan graded, we keep a copy of the video for as long as that scan is being set up. It exists for one reason: so a locked phone, a closed tab or a dropped connection part-way through cannot lose a scan you have paid for. We delete it as soon as the scan finishes, and a daily sweep deletes any video older than 24 hours whatever happened to the browser that uploaded it. We never keep your videos, we do not analyse them for anything else, and once one is deleted it is gone — to grade those cards later you would need fresh photos or a new video. If you do not ask for any grading, no video is uploaded at all.

The still pictures pulled out of the video for the cards you chose to grade are ordinary card images, kept exactly like any other photo you upload (see Retention below).

Authenticity screening

When we can identify a card confidently, we also compare your photo against the official picture of that printing and note anything that looks different. This is screening, not authentication: it produces risk indicators to look at, never a verdict about your card, and only physical inspection by a professional service can authenticate one.

The result is yours alone. It is left out of the report entirely for anyone else — including anyone you send the share link to — and it never appears on a marketplace listing, a preview image, or a search result. Our administrators can see it, which is how we check the screening is behaving and how we handle a counterfeit report about a listing.

We store the screening’s result with your grading report, and we keep a short note of anything it flagged so a person can review it. If that review decides the note is worth keeping, what we keep is a sentence about how the printing should look — not your photograph. We do not currently keep any part of a user’s picture as reference material, and we would ask you first if that ever changed. Notes we reject are deleted after twelve months. If you delete your account, anything of yours that a note was derived from is deleted with it and the note stops being linked to you.

Lawful basis for processing

Under UK GDPR, we process this data on the basis of our legitimate interest in operating the grading service you have asked us to provide — that is, using your uploaded images and a hashed identifier to generate and return a grading report, and to keep the service reasonably free of abuse. Where you have created an account, we process your email address and password hash to perform the service you signed up for.

Who processes your data

We use a small number of processors to run the service:

• OpenRouter — card images are sent here to be read and graded. OpenRouter is a router: it passes the image on to whichever model is handling that request, which today includes Alibaba's Qwen vision models. Subject to OpenRouter's and the model provider's data-handling terms.
• Google — card images are also sent to Google's Gemini and Cloud Vision APIs, both as a second opinion on a reading and for text recognition.
• Vercel — hosts the site and stores uploaded images in Vercel Blob storage.
• Neon — hosts the database holding grading reports, collections and related records.
• PriceCharting and PokemonPriceTracker — supply card prices. We send them card identities, never your images and never anything about you.

A card image may be sent to more than one of the AI providers above for a single grading — one reads the card, and a second may be asked to check the first. We do not send your email address, your name or your account to any of them.

Your rights over your data

Pullworthy is the data controller for the personal data described on this page. Under UK GDPR you have the right to:

• See what we hold about you, and get a copy of it — instantly, from Settings → Account, without asking anyone.
• Correct anything that is wrong.
• Have it deleted — signed in, at Settings → Account, or by asking us.
• Object to or restrict what we do with it.
• Take it elsewhere — the same download is machine-readable JSON, which is the portable form.

To exercise any of these, email chris@pullworthy.com. We will respond within one month.

If you are not happy with how we have handled your data, you can complain to the UK's Information Commissioner's Office at ico.org.uk.

Retention

We keep uploaded images and grading reports until you ask us to delete them. There is no automatic expiry on those.

Messages between users are different: they are deleted automatically after 24 months, along with anything attached to them and any conversation left empty. Abandoned uploads that were never graded are removed after seven days.

Requesting deletion

To request deletion of your images and grading data, email chris@pullworthy.com with the share link(s) for the grading(s) you want removed. To delete an account and everything attached to it, use the deletion endpoint described above or ask us at the same address.

No sale of data

We do not sell your data to anyone, for any purpose.

Cookies and local storage

We do not use tracking or advertising cookies. If you sign in, we set one essential cookie holding your session token — it is httpOnly, so no script on the page can read it, and it is removed when you sign out. The other client-side storage we use is essential browser localStorage, which holds the edit token that lets your browser make changes to a grading you started (for example, replacing a photo). This never leaves your device except when sent back to us to authorise an edit, and it is not used to track you across sites.

International transfers

Our infrastructure providers operate servers in the United States, so your data may be processed outside the UK. Where that happens, we rely on the appropriate safeguards required under UK GDPR, such as our processors' standard contractual clauses.