PullCap — recurring payments in Bitcoin

How it works

One signature. Then it runs on its own.

The seller
Creates a plan
Price, period, duration. Gets a link and a QR code to put wherever they like: on the website, in a message, at the counter — wherever their customers go.
The payer
Signs once
Opens the link and approves from the wallet they already use: a spending cap, an end date, the right to revoke. Their wallet enforces them, not PullCap.
From then on
Payment goes out on its own

On the dates the seller chose, from wallet to wallet. We never hold the funds. And when a payment does not go through, we retry — and we can tell both sides why.

Who does what

The seller creates the plan on PullCap · we show them keys and statuses, never a name

↓ the plan
↑ active · late · suspended

PullCap the encrypted authorisation and the status

↓ the link, then: pay now
↑ signs once
checking their own page is optional

The payer a wallet, no name. Signs once, within the limits they approve.

wallet to wallet · never ours

no names · no email · nowhere to put them

Press “Explore” to watch it step by step — or tap a number to jump straight to one.

The part nobody else has built so far

When a payment does not go through

An empty wallet does not end the subscription. PullCap retries on its own, without asking the customer for anything. The authorisation is still signed, so we try again while they sleep.

If it still does not go through, the service stays on for a grace period that the seller decides. Only after that is the subscription suspended.

How long the retries last depends on the plan. On a monthly subscription it is days, on a daily one it is hours, on an hourly one, minutes — so the time the service stays on without being paid never exceeds one period.

And we know when the wallet says no. An empty wallet means the customer is late: you see them marked exactly that way, the service stays on, and we retry without asking them for anything.

A wallet that says no is marked exactly that way: wallet says no. The permission is gone — and PullCap does not claim to know whether the customer removed it or their connection broke, because from the outside the two look identical. We report it for exactly what it is. Not every wallet says so: with some wallets, if the customer removes the permission, no answer comes back — and you see it as late.

And if the grace period ends without anything arriving, the subscription is suspended: a third thing again, and we show it to you separately. Three different ways of not being paid, three different things to do — and today, on Bitcoin, nothing else tells them apart.

The pillars

Things we cannot do, even if we wanted to.

Hold your money. Every payment goes straight from the payer’s wallet to the seller’s — we do not hold it for an instant, not even in passing. Since we never have it, there is nothing we can hold back, freeze or lose.
For sellers: if you switch us off, you do not lose a single sat. For payers: your money never passes through a third party’s account.
Know who you are. No name, no email, no documents — the system does not even have a place to put them.
For sellers: if someone breaks into PullCap, they find nothing about your customers — we never had it. For payers: you have not given your identity to anyone, and there is nothing to delete.
Raise the price. The approved amount is written into the permission: neither side can change it.
For payers: you will never be charged more than you approved — and you can see that number in your wallet, the only place where it really counts. For sellers: if you change your prices, existing subscribers are unaffected — it would take a new signature.
Stop you from leaving. The permission lives in the payer’s wallet and is removed from there: you do not need us, you do not need the seller, and neither of us can prevent it.
For payers: no cancellation to negotiate, no notice period, no customer service — remove the authorisation, and from that moment not a single sat leaves. For sellers: it works the other way too — nobody can dispute a payment you have already received and take it back months later.
And one we could, but PullCap chooses not to. A signed permission could include reading the wallet’s balance: PullCap does not even ask for it. We made it a rule not to see it, to give payers more privacy — and if the payer grants only the two permissions it needs, their wallet would refuse.

If you sell

A payment that does not go through is not just an error.

Everything a seller needs, and nothing more. No dashboard to learn: six numbers and a list.

You create a plan and share it. Price, period, duration. You get a link and a QR code to put on your website, in a message, or at the counter.
Failed payments are retried automatically. You do not have to notice, you do not have to chase anyone. If the payment goes through, the subscription carries on as if nothing happened.
You know what is happening while it happens. Every subscription tells you where it stands:
- active — paying
- awaiting first payment — signed, but the first payment has not gone through yet
- late — a payment did not go through, and we are retrying
- wallet says no — the permission is gone
- suspended — the grace period ended without payment
Every subscription has a code. You see it in the dashboard and know whether your customer is paid up. If you have your own system, it can ask for itself: you generate a key, and your website, your app or your door get a single answer — paid up or not.
PullCap does not log who asks about what.
But a code says the subscription is paid, not that whoever shows it is its holder. That is fine for linking an account; on its own it is not enough for a door.
Customers who want to change plan do it themselves. You say which plan they can switch to, and your customers find the button on their page. The old plan runs to its end, the new one starts the next day: no double payments, and no gap in between.
What you collected stays collected. No chargebacks, no forced refunds, no intermediary holding back a sum six months later. The sats have arrived in your wallet, and from there nobody touches them.
A file for your accountant with only the sats that actually arrived, on the date they arrived.
Never a name, never an email. If you want your customers’ details, you ask them yourself, as you always have: they simply never pass through PullCap.

One thing to know before you start: your customers need a Bitcoin wallet that speaks NWC — and that answers even when nobody is looking at it. Any wallet that does will work: anyone who already uses one signs with it. The ones we have tested are on the wallets page. With wallets that do not speak NWC, it does not work yet. That is PullCap’s biggest limit today: it depends on which wallets adopt NWC — more and more, but not all.

If you pay

You sign once, knowing what you sign. The rest carries on without you. And it is free.

You use the wallet you already have, and that signature is valid for the whole period the seller chose — for example a year: on a monthly subscription, that is twelve payments from a single signature. When it runs out, if you want to carry on, you sign again.

You never pay PullCap anything — not even for your page. You pay the subscription to whoever sells it to you; all that remains are the fees your wallet pays: the Lightning network’s and, with some wallets, one of the wallet’s own. They do not pass through PullCap, and PullCap does not set them. Usually a few cents.

You need a wallet that speaks NWC. It is the protocol underneath all of this, and an open standard: any wallet that supports it will do, including the one you already use.
And it has to answer even when you are not using it. A subscription gets paid at seven in the morning, with your phone in your pocket: some wallets on the phone only answer with the app open, others stop after hours or days. On a monthly subscription the retries last days, so it is enough for the wallet to wake up in time; but the calmest choice is a wallet that is always on, such as a service or a node. Which ones we have tested, and how it went.
Signing takes a minute. You open the link, read four lines, approve from your wallet. You do not register with PullCap: no account to create, no password to choose, no email to give us. You already have the wallet, and it stays yours.
You approve the cap, and it is best not to lower it. We suggest a number already worked out: it covers one payment and a late retry. You can raise it — more headroom, same safety. Do not lower it below that number: the first payment would be refused by your wallet, and the subscription would stop before it started.
And the number that counts is the one in your wallet, not the one we show you: PullCap cannot see it. If you tighten it, we only find out when a payment is refused.
Revoking is yours alone. You remove the permission from your wallet and that is the end of it: you do not go through PullCap, you do not go through the seller. PullCap cannot do it for you, and cannot undo it — your wallet enforces it, not our code.
Then silence. No payment requests until the authorisation ends, no reminders, nothing to remember. It just happens — which is how a subscription should have worked from the start.
You have a page of your own. How much you pay, when the next charge goes out, all your receipts, and the exact name to look for in your wallet to revoke. If a payment does not go through, that is where you read what happened and what to do. And if you have more than one, they are all in one place.
Save the link when we give it to you: it is the reliable way back. PullCap cannot send it to you again, because it does not know who you are.
If you want to change plan, you do not pay twice. When the seller offers another one, you find the button on your page: the current one runs to its end and the new one starts the next day. No double charge, and no gap in between.

The proof

What works today

PullCap is young, and these are the things that have actually run — not promises. Real sats, on Lightning, without anyone stepping in. We have tested it with Coinos, Zeus, Primal and Alby Hub: what we saw, wallet by wallet. The requirement, for any wallet, is that it speaks NWC and answers even when nobody is looking at it.

first     25 Sep 2026 · 21:47 UTC
last      12 Oct 2026 · 19:50 UTC
paid      407
hours     406
missed    0

407 collections in 406 hours: not one was missed. It is our 1-sat-an-hour public plan, signed once on 25 September, from one of our wallets: the previous record was 150, just below. The number is the one on the day of the update.

Try it now — 1 sat an hour →

The authorisation switches itself off after a month, and you can revoke it from your wallet whenever you like.

node      Alby Hub, on one of our computers
first     3 Oct 2026 · 08:13 UTC · in 4 s
last      12 Oct 2026 · 20:20 UTC
paid      229 out of 229, with the Lightning proof

We signed up as sellers with a node of our own: the satoshi with the code arrived in the node. Then one of our Coinos accounts signed a 1-sat-an-hour plan, and the node got paid every hour, with the Lightning proof. The keys stay on the computer: to get paid, PullCap only needs the Lightning address. It gets paid as long as the computer is on.

first     17 Sep 2026 · 19:50 UTC
last      24 Sep 2026 · 01:00 UTC
paid      150
hours     149
suspended 24 Sep 2026 · 02:50 UTC
cause     insufficient_balance

A hundred and fifty collections in a hundred and forty-nine hours: not one was missed. The extra cycle is the one from the signature, paid in the same instant. Then the payer’s wallet ran dry, and the subscription stopped by itself. The mandate was on a wallet that is not ours.

failed attempts     4    insufficient_balance
suspended           19 Sep 2026 · 02:50:13 UTC
note                grazia finita · insufficient_balance  ← grace over

Empty wallet. Four retries at growing intervals, then the grace period, then the suspension. We did not break it on purpose: it happened, and the log says which of the two it was — an empty wallet, not a cancellation.

27 Aug   4,399 s
30 Aug     826 s
 1 Sep     158 s · 126 s
─────────────────────────────────────
 2–19 Sep    3 · 2 · 2 · 3 · 6 · 4 · 3 · 2 · 3 · 2
25–27 Sep    2 · 3 · 10.1 · 3 · ~240
28–30 Sep    6 · 592 · 7 · 6 · 7
 2–10 Oct    3 · 4 · 4 · 767

The four slow ones predate the work on the first payment. We leave them here: the curve is the most honest thing we have to show, and nobody would make up a 4,399 for show.

The 10.1 is the first signature from an iPhone running Zeus, made while switching from Safari to Zeus. Done again staying on the page: 3 seconds.

The other two slow ones are the first signatures of Zeus on Android. On the 27th, with Express Graph Sync still off, Zeus held the payment: it went out after about four minutes, by hand. On the 29th Zeus answered “done” without the proof, and PullCap confirmed it at the next check, ten minutes later. The other late-September signatures, with Zeus on Android and with Primal, went through in 6 or 7 seconds, with the Lightning proof. On 2 October the first signature with Alby Hub, a node on a computer: 3 seconds, with the Lightning proof. On 3 October the first signature for a seller on Alby Hub, from a Coinos account: 4 seconds, with the Lightning proof. On 7 October the first signature with Rizful: 4 seconds, with the Lightning proof.

The 767 is from 10 October: the first signature for a seller on Rizful, from a Coinos account. Coinos refused the first attempt because the connection’s maximum fee had been left at the default, which on 1 sat comes to zero; once raised, the payment went through on the retry, with the Lightning proof.

sign-up         name + Lightning address
check           1 sat with a code in the description
then            creates the plan, shares the link, gets paid

No email, no password, no documents. Proof of ownership is one satoshi that arrives with a code written inside: you read it back from your wallet and type it in.

due        09:50        collected  by 10:00
then       the next cycle is created on its own

The check runs every ten minutes: that is usually the delay between the due time and the collection. The next cycle is born with the payment: as soon as a payment arrives, PullCap prepares the next one — so none gets lost and none gets created twice.

Times are in UTC.

407collections in a row, one an hour, from a single signature

0times anyone had to step in

2:50the time, in UTC, a subscription closed itself

The first merchants

We are looking for the first ones.

Anyone selling subscriptions to customers who already pay in Bitcoin: paid communities and content, courses, software, coworking spaces, gyms. And anywhere people pay for a period rather than for a single thing.

You handle names (if you want to), as you always have. Every subscription has a code: if your system needs a customer record, you keep it and link it to that code. PullCap does not know it and does not need it — but nothing stops you.

It works best where there is already a flow. If you have customers who come back every month, this puts them on autopilot: they do not have to sign every time, and you stop hoping they remember.

You will be among the first, so there are still things to fix — and we will fix them together. That is not a polite formula: we find out what does not work from your customers, not from our tests.

One thing to check first: your customers need a wallet that speaks NWC and answers even when nobody is looking at it; you need a Lightning address that is always reachable, where the payments arrive: a service that keeps it on for you, or better still a node of your own. The ones we have tested, and on which side, are on the wallets page.

What it costs

Free up to five subscriptions. Above that, a monthly fee in tiers based on the number of active subscriptions — never a percentage of what you collect.

We could not take a percentage even if we wanted to: the sats never pass through PullCap. This is the shape and it will not change; the figures we will set with the first merchants — because a price picked at a desk, with nobody having paid it, is a made-up number.

If you run a platform and want to offer recurring payments to the people who work on it, the maths is different. Write to us and we will talk.

And for payers it is free, always. They pay the subscription to whoever sells it — PullCap gets not a single sat from them, not even for their page.

info@getpullcap.com Or find us on Nostr

Questions

The ones worth asking.

If you sell

What if PullCap shut down?

The authorisations are enforced by your customers’ wallets: PullCap keeps only an encrypted copy, so it can request the payments. If we shut down tomorrow, nobody would lose a satoshi and nobody would be charged again — the collections would simply stop.

What you would lose is the record: who paid what, and since when. That is why the export exists, and why it is worth downloading now and then.

And your customers would lose their page. Not the way out: the permission is removed from the wallet, and that needs no page of ours.

What if my customers do not have a compatible wallet?

Then today they cannot subscribe with you — and that is the biggest limit we have. The way out is short: a wallet that speaks NWC and answers even when the phone is in a pocket — there are several, free ones included.

It is a real limit and we are not pretending otherwise: today it leaves out anyone whose wallet does not support it. It depends on which wallets adopt NWC, and that is not something we get to decide.

Can I change the price later?

For new subscribers, yes: you create a plan with the new price and share that link.

For those who have already signed, no. The amount they approved is written into the permission in their wallet, and neither you nor we can raise it. It is not a limitation we chose: it is what makes the signature worth something.

What do you see of my customers?

We show you where each subscription stands: active, awaiting first payment, late, wallet says no, suspended. Never a name — there is none in our system, because we never ask for one.

We cannot link a subscription to a person, because we never knew. If you need to know who it is, you ask them — and it stays between you.

How long until I collect the first payment?

For now, sign-up is by invitation: write to us and we will open access for you. Then you create a plan and share the link: the first customer who signs pays within seconds, while still on the page.

You need one thing to start: a Lightning address where you already receive payments. No password, no documents.

Does it work for a transport pass, or access to a facility?

The shape is the right one — weekly, monthly, yearly, with an end date. The payment side already works today, and every subscription has a code your system can query.

What is not there yet is getting through the gate. The code says the subscription is paid, not that whoever shows it is its holder: at a turnstile you need a credential that cannot be photographed, and a fixed code — even a barcode — can be.

We know how it would be done, and we are working on it: a code that changes every time, checked by the gate without asking us anything — so nobody builds up a record of who went where and when. It is not ready yet. If you have a case like this, write to us: it is the kind of thing we want to build with someone, not alone.

If a customer stops paying, do I have to do anything?

No. If the payment can still go through, we retry on our own, with timings that adapt to how often the subscription is paid; if the permission is gone and the wallet says so, we flag it to you. Your customer gets no message and signs nothing again.

You decide one thing only, when you create the plan: how long to keep the service on for someone who has not paid. After that, the subscription suspends itself — and stays suspended: to resume, the customer has to sign again. If their wallet pays after the suspension, you see it marked in the dashboard: what to do about it is up to you.

If you pay

How much does PullCap cost me?

Nothing. You pay the subscription to whoever sells it to you, and you give us nothing — not even for the page where you see your payments.

The one who pays us is the seller, not the buyer. The only cost left is the fees your wallet pays: the Lightning network’s and, with some wallets, one of the wallet’s own. Usually a few cents, as in any Bitcoin payment.

Can they take more than I owe?

No. When you sign, you approve a maximum cap, and above that number your wallet refuses: it is not a promise we make, it is a refusal that comes from a system we do not control.

And the approved amount is written into the permission: neither the seller nor we can raise it.

The cap renews itself every period — it is not a total that runs out. You sign once and never have to touch it again.

What if I lose the link to my page?

You can get it back, if you kept your wallet’s connection string. You paste it, the browser computes its fingerprint — the string never leaves your computer — and we give you a new link; the old one stops working at the same moment, which is also what to do if the link ended up where you did not want it. We do not keep the link: there is only a fingerprint, and you cannot work back from it.

But it has two limits, and we will tell you both. Many wallets show you the string only once, when you create the connection, and do not let you copy it again afterwards. And it only works while the subscription is alive: if it is suspended or expired there is no page left to give back, and carrying on takes a new signature anyway.

What if I want to stop?

Open your wallet, find the connection, and remove it. You will find its exact name on your page. From that moment nothing more goes out, and you do not have to send a cancellation to anyone.

And nobody can put it back for you — not us, not the seller.

What if a payment does not go through?

It does not end there. Your page tells you which of these three cases it is:

“Payment did not go through” — with the reason: your wallet did not have enough, the limit on the connection ran out, or the wallet did not answer. We retry: you lose nothing and you do not have to sign again. If it goes through in the meantime, the subscription carries on as if nothing happened.

“Payment pending” — we have stopped retrying, and the service stays on until a date you see written there. If it was the balance, top up before then.

“Suspended” — the service stops and we stop asking. We do not charge you anything owed from before, and it does not restart on its own: to carry on, ask the seller for the link and sign again. But if your wallet, when it wakes up, pays the last request left pending, we find it and you see it on your page: once, never more. To find it we have to be able to ask your wallet: if you remove the connection, we no longer can.

And if the permission is gone, that is something else, not a failed payment: when the wallet says so, we tell them apart, and the seller sees it marked as “wallet says no”. An empty wallet and a wallet that says no are not the same customer — and on Bitcoin nobody else tells them apart.

Do I have to sign up anywhere?

No. There is no PullCap account. Your page opens with the link you receive when you sign, and nothing else: nothing to remember, nothing to recover by email.

If you sign up to several subscriptions, you find them all in one place — and that list lives in your browser, not with us. That is why we cannot know how many you have, or with whom.

Your wallet, on the other hand, is a relationship between you and whoever provides it — if it asks you for a username, a password or anything else, that stays between you, and we have nothing to do with it. The same goes for whatever the seller asks you for their service: that concerns them, and it never reaches us.

If you clear your browser data, the list goes, the subscriptions do not: each link keeps working, and you rebuild the list by pasting them in.

What can you see of my wallet?

Two things only. The permission you sign asks to pay for the subscription and to check the status of an invoice. Not the balance, not the payment history: PullCap does not ask for those permissions, and if you grant only those two, your wallet would say no to everything else.

Wherever it can, PullCap picks the tool that shows it nothing. To check whether an authorisation is still alive, it asks the wallet for the status of a control invoice that matches no payment: if the wallet answers that it does not know it, the connection is there; if it refuses, it is gone. We learn nothing else about your wallet.

Bitcoin subscriptions, on time and without surprises.

Collecting is not the problem.