Privacy Policy

1. Overview

Pull ("we", "us", "our") is a trading-card scanner and collection tracker developed by The CKT Group LLC. Pull lets you identify trading cards with your camera, track the cards in your collection, and see estimated market prices. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

We do not sell your personal data to third parties, and we do not use your data for advertising.

2. Information We Collect

Account information: If you choose to create an account, we collect your email address. Pull uses Google sign-in or a one-time code emailed to you. If you sign in with Google, we receive your email address and, where you permit it, your name. We never receive or store your Google password. You can use core scanning features without an account; an account is used to back up and sync your collection.

Your collection: The cards you save (card identity, set, and the estimated price at the time) make up your personal collection. If you are signed in, this is stored in your account so it syncs across your devices.

Card photos (camera): Pull uses the camera only to scan cards. Each photo is processed on your device to read the card. For cards the on-device reader cannot identify, a cropped image of the card is sent to our service for AI identification (see Section 4). We do not store your card photos on our servers.

Purchases: If you purchase Pull Pro, we receive your purchase and entitlement status (for example, whether Pro is unlocked) from the app store. We never receive your full payment-card details — those are handled directly by the Apple App Store or Google Play.

Usage data: We collect only the minimal technical information necessary to operate the service. We do not run third-party advertising or behavioral tracking.

3. How We Use Your Information

We use the information above to: identify the cards you scan; save, sync, and display your collection and its estimated value; provide and manage any Pro features you unlock; and operate, secure, and improve the app.

4. AI Processing of Card Photos

When the on-device reader cannot identify a card, a cropped image of that card is sent over an encrypted connection through our Cloudflare Worker to Google's Gemini AI, which reads the card's name and number so we can match it to a card in our catalog. The result is returned to the app.

This processing is performed only to answer the scan you initiated, and we do not store your card photos on our servers. Google's handling of the image is subject to Google's Privacy Policy. Estimated prices shown in the app are informational only and are not a guarantee of value.

5. Third-Party Services

Pull relies on the following service providers to operate. Data is transmitted over encrypted (HTTPS/TLS) connections.

• Supabase — secure authentication and database storage for your account and collection. Access is protected by row-level security so you can only access your own data.
• Cloudflare — our service that proxies scan requests to the AI provider so that our keys stay on the server.
• Google (Gemini AI) — reads card photos to identify cards. Subject to Google's Privacy Policy.
• Card data & price sources — Pull displays card information and images from public trading-card databases (such as pokemontcg.io and TCGdex) and estimated prices sourced from TCGplayer. These are used to show card details; we do not share your personal data with them.
• Apple App Store / Google Play — process any purchases. We do not receive your payment-card details.

6. Data Retention and Deletion

Your account information and collection are retained while your account is active so the app can sync your cards. You can permanently delete your account and all associated data at any time, directly in the app: go to Settings → Delete account. This removes your account and your saved collection. You can also request deletion by following the steps at stingwaveapp.com/pull-delete-account. We process verified deletion requests within 30 days.

7. Data Security

We apply technical and organizational measures to protect your data, including: encryption in transit (HTTPS/TLS) for all data sent between the app, our servers, and service providers; row-level security on your stored data so only your authenticated account can access it; and storage of API keys and secrets as server-side environment variables that are never embedded in the app. In the event of a data breach affecting your personal information, we will notify affected users and take prompt remediation steps.

8. Children's Privacy

Pull is a general-audience app and is not directed at children. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your region). If you believe a child has provided us personal information, contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above when we do. Continued use of Pull after changes take effect constitutes acceptance of the updated policy.

10. Contact

For privacy questions or to request deletion of your data, contact us at:
support@thecktgroup.com
The CKT Group LLC