Privacy Policy

What we collect

Pullworthy works without an account. If you do not create one, we do not collect a name, an email address or a password. What we collect either way:

• The card images you upload for grading.
• A salted, one-way hash of your IP address, used only for basic rate limiting. We never store your raw IP address.
• The grading results we generate — sub-grades, centering measurements, the overall estimate, and any value figures shown alongside them.

If you create an account

Accounts are optional. Grading works without one; an account exists only so your graded cards stay in one place. If you create one, we additionally store:

• Your email address, which is how you sign in.
• A one-way hash of your password. We never store the password itself and cannot read it.
• Session records — a random token, when it expires, and the browser and IP address the session was created from — so that staying signed in works and you can be signed out.

We do not send marketing email. We send email only to confirm your address and, if you use the marketplace, to tell you that you have a new message — that notification never contains the message itself.

You can delete your account at any time. Deleting it removes your email address, your password hash and all your sessions. Your grading reports are not deleted — they are detached from the account and become anonymous again, so any share link you have already given someone keeps working. Deletion is available at POST /api/account/delete with the body {"confirm":"DELETE"} while signed in, or email us using the address below and we will do it for you.

If you publish a card to the gallery

Publishing is a separate, deliberate act, and it is reversible at any time. Grading a card never publishes it. If you do publish one, these become PUBLIC — visible to anyone, including search engines:

• The display name you chose. Your email address is never shown anywhere public, never shown to other users, and never appears in a message or a notification.
• A snapshot of the card taken at the moment you published: its photo, its identity, and the grade estimates. It is frozen — a later re-grade changes your private report and not the listing.
• Whether you are open to selling, and an asking price if you set one.
• A link to your full grading report ONLY if you ticked that box when publishing. It is off by default.
• An approximate location, and only if you chose to add one. It is a district-level point rounded to about a kilometre — a postcode district or a town, never an address and never your exact position. Buyers see a place label and a rough distance in miles. You can remove it at any time, and removing it removes the stored coordinates.

Unpublishing takes the public page down. Deleting your account deletes your display name and every listing you published.

Messages between users

If you message another collector about a card, we store the message text, who sent it, which conversation it belongs to, and when. We also store any photos or short videos you attach to it.

• Messages are deleted after 24 months. A weekly job removes messages older than that along with their attachments, and removes any conversation left with no messages in it.
• Notification emails never contain the message. They say that you have a new message about a named card and link you to the site, so the text of what people say to each other never leaves our database and is never handled by our email provider.
• Attachments are stored at unguessable addresses and appear only in the conversation itself. They are never on a public page and never in an email.
• If you delete your account, your messages stay in the other person’s conversation but stop being attributed to you — they show as sent by a deleted account. This is so the person you were talking to keeps their own record of the conversation. Your listings, your display name and your location are deleted.

Blocking and reporting

You can block another user, which stops new messages in both directions. We store who blocked whom and when. Blocking hides nothing that was already said — the conversation stays readable to both of you, because a record of what happened is what a report is made of. We never tell the other person that they have been blocked.

You can also report a listing, a message or a user. We store what you reported, the reason you picked, any note you wrote and that it came from you. Reports are read by the site owner in a moderation queue, and a report about a message includes that message and its attachments — that is the evidence needed to make a decision about it. We do not tell the person you reported who reported them, and we keep reports after they are dealt with as the record that a complaint was made and handled. If the account that made a report is deleted, the report stays but stops being linked to anyone.

If you scan cards from a video

Your video is read on your device. We find each card in it, pick the sharpest picture of each face and show you what we found — all of that happens in your browser, and nothing is sent anywhere while you are checking it.

If you choose to have cards from that scan graded, we keep a copy of the video for as long as that scan is being set up. It exists for one reason: so a locked phone, a closed tab or a dropped connection part-way through cannot lose a scan you have paid for. We delete it as soon as the scan finishes, and a daily sweep deletes any video older than 24 hours whatever happened to the browser that uploaded it. We never keep your videos, we do not analyse them for anything else, and once one is deleted it is gone — to grade those cards later you would need fresh photos or a new video. If you do not ask for any grading, no video is uploaded at all.

The still pictures pulled out of the video for the cards you chose to grade are ordinary card images, kept exactly like any other photo you upload (see Retention below).

Authenticity screening

When we can identify a card confidently, we also compare your photo against the official picture of that printing and note anything that looks different. This is screening, not authentication: it produces risk indicators to look at, never a verdict about your card, and only physical inspection by a professional service can authenticate one.

The result is yours alone. It is left out of the report entirely for anyone else — including anyone you send the share link to — and it never appears on a marketplace listing, a preview image, or a search result. Our administrators can see it, which is how we check the screening is behaving and how we handle a counterfeit report about a listing.

We store the screening’s result with your grading report, and we keep a short note of anything it flagged so a person can review it. If that review decides the note is worth keeping, what we keep is a sentence about how the printing should look — not your photograph. We do not currently keep any part of a user’s picture as reference material, and we would ask you first if that ever changed. Notes we reject are deleted after twelve months. If you delete your account, anything of yours that a note was derived from is deleted with it and the note stops being linked to you.

Lawful basis for processing

Under UK GDPR, we process this data on the basis of our legitimate interest in operating the grading service you have asked us to provide — that is, using your uploaded images and a hashed identifier to generate and return a grading report, and to keep the service reasonably free of abuse. Where you have created an account, we process your email address and password hash to perform the service you signed up for.

Who processes your data

We use a small number of processors to run the service:

• Your card images are sent to Anthropic (our AI provider) for analysis, subject to Anthropic's own data-handling terms.
• Uploaded images are stored on Vercel Blob storage.
• Grading reports and related records are stored in a database hosted on Neon.

Retention

We keep uploaded images and grading reports until you ask us to delete them. There is no automatic expiry on those.

Messages between users are different: they are deleted automatically after 24 months, along with anything attached to them and any conversation left empty. Abandoned uploads that were never graded are removed after seven days.

Requesting deletion

To request deletion of your images and grading data, email contact@example.com with the share link(s) for the grading(s) you want removed. This To delete an account and everything attached to it, use the deletion endpoint described above or ask us at the same address. This is a placeholder address — the site owner must replace it with a monitored mailbox before go-live.

No sale of data

We do not sell your data to anyone, for any purpose.

Cookies and local storage

We do not use tracking or advertising cookies. If you sign in, we set one essential cookie holding your session token — it is httpOnly, so no script on the page can read it, and it is removed when you sign out. The other client-side storage we use is essential browser localStorage, which holds the edit token that lets your browser make changes to a grading you started (for example, replacing a photo). This never leaves your device except when sent back to us to authorise an edit, and it is not used to track you across sites.

International transfers

Our infrastructure providers operate servers in the United States, so your data may be processed outside the UK. Where that happens, we rely on the appropriate safeguards required under UK GDPR, such as our processors' standard contractual clauses.