Privacy Policy
What we collect
Your email address, username, password (stored as a salted hash - we can never read it), optional ZIP code, and the card lists you build. That's it. No trackers, no ad networks, no selling data.
How we use it
Email is used for account verification, password resets, and trade notifications (offers, messages, confirmations). Your ZIP code powers distance-based matching and is never shown publicly - other users see at most your town and state, and you can hide even that in Settings.
What's public
Your username, your For Trade and Wishlist lists, your confirmed trade count, and your reviews are visible to anyone with your profile link - that's the point of the platform. Your email, ZIP, and exact location are never public.
Cookies
We use exactly one cookie: a login session cookie, which is strictly necessary for the site to work (it keeps you signed in). We use no advertising, tracking, or third-party cookies, which is why there's no cookie banner. Our visitor analytics (self-hosted Umami) are cookieless and don't identify you. Fonts and card images are served without sending your data to advertising networks.
Your rights (GDPR / UK GDPR)
If you're in the EU, UK, or anywhere else: you can access, correct, export, or delete your data at any time. Profile details are editable in Settings; for a full export or deletion, email [email protected] from your account email and we'll handle it promptly. We process your data only to run the service you signed up for (contract) and to keep the platform safe (legitimate interest).
Data removal
Want your account and data deleted? Email [email protected] and it's gone.
Card data and prices
Card data and images come from the Pokemon TCG API; market prices from TCGplayer via that API. RarePull Trades is not affiliated with Nintendo, The Pokemon Company, or TCGplayer.