Privacy Policy
Effective 2026-08-14. This page describes what palworldprices.com actually stores and does, written by the person who runs it and checked against the code that runs the site. If what the site does changes, this page changes with it — see "Changes" at the bottom.
Who we are
palworldprices.com publishes honest, completed-sale price data for the Palworld Trading Card Game. It is a one-person project. Questions about this page, or anything below: contact@palworldprices.com.
Accounts (optional)
You never need an account to look up a price. Signing in exists to give you a posting identity in the community chat, and for account features we add later.
Your card watchlist lives only in your browser's local storage — it is never sent to us and doesn't require an account.
Today the only working sign-in is Sign in with Google. When you use it, we store:
- Your Google account email — only if Google reports it as verified — plus an internal account id we generate.
- Your Google account's subject identifier: an opaque per-app id Google assigns you, not a password or a token you'd recognize, tagged as coming from Google.
- When your account and sign-in sessions were created, and when a session expires.
We ask Google for the openid email profile permission, but we only ever read your subject id and verified email out of what Google sends back. We do not store your Google profile name or photo, even though Google's response includes them.
Signing in never shows us your Google password. The flow is a redirect to accounts.google.com; Google hands our server a one-time code, which we exchange directly with Google for your email and subject id — your password never reaches palworldprices.com in any form.
The sign-in cookie itself is HttpOnly, Secure, and SameSite=Lax — a signed, opaque session reference. No script on any page, ours or anyone else's, can read it, and by itself it carries no email or Google data, only a signed session id and expiry.
Signing in by emailed link ("magic link") exists in the code but is switched off end-to-end right now — see "Email" below.
Community chat
The community chat is a separate room, linked from the footer of every page. Anyone can read it; posting requires being signed in.
When you post a message, we store the message text, your account id, a computer-generated pseudonym (like "Trainer4821" — the same one every time, but never your real name, Google name, or email), and when you posted. Your Google name and email never reach the chat room's own storage at all; the room only ever sees your account id.
If a message is reported, we store which message, the reporting account's id, the reason given, and when. If a moderator hides a message, or mutes or bans an account, that action — what was done, to what, by whom, and why — is recorded permanently in an append-only log; a mistaken action is reversed by adding a new entry, never by editing or deleting the old one, the same rule this site uses for price corrections.
Posting also writes one operational log line recording your account id, the new message's id, and the timestamp. That is used only to measure genuine chat activity and is not shown publicly.
Anti-abuse
Requesting an email sign-in link, posting your first chat message of a session, and reporting a chat message each run a Cloudflare Turnstile check first — an anti-bot challenge from Cloudflare, the only third-party script this site loads anywhere. It exists to stop automated abuse, not to track you; see Cloudflare's own privacy policy for how Turnstile itself works.
Analytics
Cloudflare, who hosts this site and runs its infrastructure, aggregates ordinary traffic and threat metrics (request volume, bot filtering) the way any host does to keep a service running. That is not a tracking script embedded in the page — it is how the infrastructure operates.
Separately, we run our own first-party usage beacon, seen by nobody but us. On specific actions — looking up a price, opening the chat page, posting, and similar — your browser sends our own server a short signal containing: which named action happened (from a small fixed list), a coarse "have we seen this browser before" bucket (first visit / returning this week / returning three-plus weeks), whether it's a new day or week for you, and a one-word guess at how you arrived (like "search" or "direct"). That is the entire payload.
The beacon carries no name, email, account id, or IP address, and no timestamp finer than the day. It is folded immediately into one counter document shared by everyone who took that action that day — there is nothing in it, or kept from it, that identifies you individually. If your browser sends Do Not Track or Global Privacy Control, we send no beacon at all, no exceptions. The same non-identifying aggregate tallies are also recorded through Cloudflare's own analytics service (Workers Analytics Engine), which hosts this site's infrastructure.
No third-party ad trackers, no ad-network scripts, no ads anywhere on this site.
We store an email address only if you typed it in yourself: signing in with Google (above), or asking for an email sign-in link.
Email sign-in ("magic link") is switched off in the code right now — the check happens before a link is ever created, so asking for one today creates nothing and sends nothing. If a digest or email sign-in is switched on later, we will only send to addresses you gave us, and never for marketing without a separate, logged consent.
What we never do
- We never sell your personal data.
- We never share it with anyone else, except Cloudflare — who runs the servers, database, and chat room this site is built on, as any host necessarily does to operate a service — or when the law requires it.
Affiliate links
Buy-intent pages (like Buy and per-card buy boxes) carry eBay Partner Network affiliate links, disclosed right there on those pages: "Some links are eBay affiliate links — if you buy through them, palworldprices.com earns a small commission at no extra cost to you. It helps support the site and keep it running. We never monetize the receipts behind our prices."
That last line is a real rule, not a slogan: any sold-listing receipt link we publish is never affiliate-wrapped. A wrapped link carries only standard eBay campaign identifiers (which campaign, which page sent you); we do not attach or send eBay any personal information of yours. Once you are on eBay, eBay's own privacy policy and terms apply.
The store
A separate storefront for physical Palworld TCG inventory, store.palworldprices.com, is built into this project but is not live yet — this section describes what it will do once it is, reviewed for accuracy ahead of launch rather than after (Store D2, docs/SPEC-STORE-V1.md §8).
The store runs on Shopify, which is both the storefront platform and the payment/order processor: if you place an order, Shopify collects and stores what shipping and payment require — your name, shipping address, and email — under Shopify's own privacy policy, the same pattern this page already uses above for Cloudflare Turnstile and Google. Order records are kept for as long as Shopify's own order-history defaults retain them, for receipts, returns, and tax records.
The store is run by the same operator who builds this price tool, and the two stay one-directional by construction: prices on this site come from independent eBay and Mercari sold listings, never from the store's own sales, and the store's sales are never fed back into those prices. Buying from the store supports the site, but it never changes what the price tool shows you.
YouTube channel automation
The PalworldPrices YouTube channel is operated with a private tool, built and run solely by the channel owner. Its use of YouTube API Services is limited to the owner's own channel — uploading the owner's own videos and reading the owner's own channel analytics.
- Today, video publishing is done by hand in YouTube Studio. API-based publishing exists in the tool but is not active — it turns on only after Google's API compliance review of this tool is complete.
- Channel analytics are read only under the owner's own consent, for the owner's own channel.
- Aggregated data it derives is stored locally on the owner's own machine.
- It does not collect, store, or share any third-party YouTube user data.
Google Privacy Policy: policies.google.com/privacy. You can review or revoke this tool's access to a Google account at security.google.com/settings/security/permissions.
Deletion & questions
Email contact@palworldprices.com to have your account data deleted, or to ask anything about this page. There is no self-serve "delete my account" button yet — that is a real gap, and the honest state of things today, not a hidden one. One email is all it takes: we delete your stored email, identity link, and sessions by hand.
Changes
When what this site does changes, this page changes with it, and the effective date at the top moves. We do not quietly edit history here any more than we quietly edit a price.