Privacy Notice

The operator identified at the end of this notice is the controller for PaperTrader’s processing of personal data. PaperTrader has not appointed a Data Protection Officer. Send privacy questions and rights requests to legal@papertrader.app and security concerns to security@papertrader.app.

• Account and authentication data: internal account ID, email address, password hash, short-lived password-reset link and token hash, linked provider, wallet public address, legacy username where present, and authentication/security records.
• Account product data: paper wallets, simulated balances, positions, completed and pending orders, trade history, preferences, and achievements. PaperTrader may also retain guest-import records and guest progress created before guest mode became read-only.
• Voluntary product feedback: your account reference, feedback campaign, selected feature, optional written review, and submission time.
• Public and community data: chosen nickname or label, profile settings, eligible leaderboard results, profile statistics, chat messages, reactions, reports, and moderation records.
• Technical and security data: IP address and request metadata in short-lived infrastructure logs, errors, timestamps, and a temporary in-memory presence identifier with the minimum route needed for live counts.
• Optional analytics: page routes, selected product interactions, browser/session information, and privacy-masked replay, but only after Analytics consent.
• Communications: privacy, legal, security, content-reporting, and support messages you send.

PaperTrader receives this data directly from you or from your browser when you choose to provide it, collects limited technical data automatically when the service is used, and creates product records from your activity.

Account credentials and the contents of non-public communications may be treated as sensitive personal data in some jurisdictions. PaperTrader uses them only for authentication, communication, moderation, security, and legal purposes. It does not use sensitive data to infer personal characteristics.

• Provide accounts, read-only guest browsing, simulated trading for eligible accounts, portfolios, and requested features: performance of the Terms or steps you request before entering them.
• Protect the service, prevent manipulation, maintain minimal live presence, and defend legal claims: legitimate interests in security, integrity, and operating the service, balanced against your rights.
• Moderate content and respond to reports: performance of the Terms, legitimate interests in a safe service, and legal obligations where applicable.
• Evaluate voluntary product votes and written feedback to prioritise and improve PaperTrader: legitimate interests in product development and understanding account-holder needs, balanced against your rights.
• PostHog product analytics and session replay: your consent. You may reject or withdraw without losing core access.
• Comply with lawful requests, accounting duties, and regulatory obligations: legal obligation.

Authentication and core paper-trading data are required if you request those features. Without them, PaperTrader cannot provide the corresponding account or trading function. Analytics is optional. Product voting and its written review field are also optional; not voting does not reduce your access to PaperTrader. Public-profile visibility and wallet-address display can be changed in Account settings; global chat content is voluntary and public to people who can access the chat.

Eligible accounts may appear on a leaderboard of up to 100 completed-spin records. Depending on current privacy settings, a PaperTrader profile can show a chosen label, join date, leaderboard rank, best spin, paper-wallet names, creation and activity dates, simulated starting/current balances, and returns. Wallet addresses are hidden by default and shown only when enabled. Profiles can be hidden. Individual holdings and trade history are not currently exposed by the public-profile screen. Leaderboard and profile routes are marked noindex and excluded from PaperTrader’s sitemap, but people with access may still view and share what is displayed.

PaperTrader uses service providers for hosting, database storage, infrastructure, email, security, analytics, and market data. Current important providers include the website host, Neon, Oracle Cloud infrastructure and Redis, PostHog EU, Resend for contact-form and requested password-reset email delivery, Cloudflare for domain email routing, Google for the monitored support inbox, Jupiter, DexScreener, and Helius or another configured Solana RPC. Providers receive only the data needed for their role. Public content is received by other users.

PaperTrader does not sell personal data, share it for cross-context behavioural advertising, disclose it for another party’s direct marketing, or use it for targeted advertising. It does not profile people to make decisions that produce legal or similarly significant effects.

Personal data may also be disclosed where reasonably necessary to comply with law, respond to a lawful authority, protect a person or the service, or establish, exercise, or defend legal claims. If PaperTrader or its service is sold, reorganised, or transferred, data may be disclosed to advisers and a prospective or actual successor subject to appropriate confidentiality, applicable law, and any required notice.

Some providers or subprocessors may process data outside Denmark or the EEA. Where GDPR Chapter V applies, PaperTrader must use an adequacy decision, approved standard contractual clauses with any needed supplementary measures, or another lawful transfer mechanism. The internal processor register records the mechanism once verified.

PaperTrader uses reasonable technical and organisational measures designed to protect personal data. No internet transmission or storage system can be guaranteed completely secure, so users should also keep their login methods and devices secure and report suspected unauthorised access promptly.

When personal data is no longer needed, PaperTrader deletes or anonymises it. If immediate deletion from a backup is not technically practicable, the data is kept outside ordinary use until the relevant backup is overwritten or deleted, unless a documented legal or security need requires restricted retention.

• Account and paper-trading data: while the account is active; inactive accounts are scheduled for deletion after 24 months, normally with 30 days’ notice where an email address is available.
• Guest access cookie: up to 30 days unless cleared earlier. New guest browsing sessions do not save wallets, trades, positions, or other product progress.
• Ordinary access logs containing online identifiers: no more than 14 days.
• Ordinary application error reports: no more than 30 days.
• Privacy-masked replay: 30 days. Raw analytics events: no more than 12 months. De-identified aggregate counts may be retained longer to measure long-term service growth.
• Account-linked product feedback: until the relevant campaign has been evaluated and no more than 12 months after submission. The account link and written review are then deleted; anonymous aggregate vote totals may be retained longer. Account deletion removes the linked feedback sooner.
• Email delivery data in Resend, including requested password-reset delivery: 30 days under its standard retention. Resolved conversations in the support inbox: no more than 12 months.
• Specific security, complaint, legal, or accounting records may be restricted and retained longer only while a documented legal need applies.

• Depending on applicable law, you may ask whether PaperTrader processes your data and request access, correction, deletion, restriction, portability, or objection. You may also have rights to limit sensitive-data use and to opt out of sale, targeted advertising, or significant profiling. PaperTrader does not currently perform those last three activities.
• You may withdraw Analytics consent at any time through Cookie settings without losing core access. Withdrawal stops future consent-based processing but does not affect the lawfulness of processing performed before withdrawal.
• PaperTrader will not discriminate against you for exercising an applicable privacy right. Some requested data may nevertheless be necessary to provide an account or requested feature, as explained above.
• Where applicable law permits it, an authorised representative may submit a request for you. PaperTrader may require proof of that authority and may verify your identity. Additional verification data will be used only to handle the request and protect against unauthorised disclosure or fraud.

Send a request through the contact form or to legal@papertrader.app. Rights are not absolute. PaperTrader normally responds within one month and will explain any lawful extension or refusal. Where the law grants an appeal right, you may appeal a refusal through the same email address; PaperTrader will respond in writing and explain the result.

You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, at datatilsynet.dk. You may also have the right to complain to another competent supervisory authority.

PaperTrader is for adults aged 18 or older. It does not knowingly offer accounts or guest mode to minors. PaperTrader does not currently make decisions based solely on automated processing that produce legal or similarly significant effects.

PaperTrader will update the date when this notice changes. Material changes will be highlighted in the service before they take effect where required. A privacy notice is information—not a request to consent to every processing activity.