Privacy policy

Last updated: October 17, 2026

PullCheck has no accounts and no sign-in, and your binder lives on your iPhone. This page lists every moment the app goes online: what leaves your device, who receives it, why, and how long it is kept.

What stays on your device

Your collection (for each card: game, set, number, variant, condition, quantity, the price you paid and its last prices), the photos you took of your cards, your last 30 scans, one value point per day for up to a year, today's free-scan counter, your settings and your onboarding answers. PullCheck never uploads or syncs any of it; only your iPhone's own backup may include it, as with any app. Remove it with Delete on a card, Delete collection in Settings, or by deleting the app.

Your card photo and the card server

When you scan, and only after you allow it the first time, PullCheck sends the photo (resized to 1600 pixels at most) and your app language to the PullCheck card server, which runs on Cloudflare. The server hands the photo to an AI model, Google Gemini, through OpenRouter, using providers that neither keep it nor train on it. The AI only reads the card's name, number and print details; prices never come from it. Once the answer is back, the photo is not stored on the server or by those providers. The copy in your collection stays on your iPhone.

Prices, search and card pictures

A search sends the game and the words you type. A price refresh sends the game and id of each card in your collection, up to 60 at a time, and nothing about quantities, condition or what you paid. The card server looks cards up at TCGdex (Pokémon, with TCGplayer and Cardmarket prices) and YGOPRODeck (Yu-Gi-Oh!, with TCGplayer prices) and caches those public answers for 6 to 12 hours; these services see the server, not you. Pokémon card pictures load directly from the TCGdex image server or, when TCGdex has no picture of a card, from the pokemontcg.io image server; like any website, they receive your network address. Search sales opens a web search in your browser, and Share passes only the image you see to the app you choose.

Install id and daily counters

On first launch the app creates a random id that is not tied to your name, Apple ID or device. It travels with every request to the card server, along with the app version, so the server can apply its fair-use limits. The server keeps that id and the day's scan, search and refresh counts for 2 days, then they expire. Like any internet service, the server sees your network address while it answers; PullCheck does not store it or use it to identify you.

Remote settings

At launch the app downloads a small settings file from our server: whether ads are on, the card server's addresses and the free limits. Nothing about you is sent with it beyond what any web request carries. Offline, the app uses the settings it was shipped with.

Ads and tracking

The free version shows ads from Google AdMob: one when the app opens, a full-screen ad now and then after a few taps, and ad cards on some screens, never on the camera or between the shutter and your result. In the European Economic Area, the UK and Switzerland, Google's consent form asks you first, and you can change your answer later in Settings. iOS also asks whether PullCheck may track you; if you say no, no advertising identifier is used and ads are less personalized. AdMob may collect device and usage data as described in Google's own policy. With Premium, no ad is requested at all.

Premium and payments

Premium is bought through the App Store. Apple handles the payment; we never see your card details or your Apple ID. RevenueCat checks your subscription status for the app using an anonymous id and Apple's purchase receipt. Restore purchases simply asks the App Store again.

Camera and photo library

The camera opens only after you tap Start camera, and only to scan a card. Nothing is recorded in the background, and no video or sound is captured. The photo library is used only when you choose a photo, and only that photo is read. You can turn both off in iPhone Settings › PullCheck; Search keeps working without them. PullCheck asks for nothing else: no location, contacts, microphone or notifications.

Children

PullCheck is rated 4+ and needs no name, e-mail address or account. We don't knowingly collect personal information from children. If a child uses the app, a parent should make sure photos show only the card and check the ad and tracking choices. If you believe a child's data reached us, write to us and we will help.

Your choices

Delete one card or the whole collection in the app, or delete the app to erase everything at once. Withdraw your AI consent in Settings: scanning will ask again, while Search and prices keep working. Change ad choices in Settings, and tracking in iPhone Settings › Privacy & Security › Tracking. The server holds nothing about you beyond the 2-day counters, so there is no account to close.

Changes to this policy

If what PullCheck sends or keeps changes, we update this page and the date above in the same version of the app, and ask for your consent again in the app whenever it is needed.

Contact

Questions about your privacy? Write to support@pullcheck.app. We answer in English, Spanish, French and Portuguese.