Papergames uses account information to provide sign-in, save your progress and verify participation. Social connections are optional. We do not sell your personal information.
Who is responsible
Papergames operates papergames.xyz. Papergames determines the purposes of the personal-data processing described here. For privacy questions or requests about your account, contact admin@papergames.xyz.
The information we use
- Profile corrections: the profile and field reported, suggested correction, supporting links or explanation, private messages, read markers and editorial decisions. Only the requester and authorised Team staff can access the private request. These records follow our support and account-deletion review.
- Account: email address, Supabase account identifier, verification status, unique display name, name-change date and account creation date. Supabase handles email-code verification and authentication sessions.
- Participation: check-ins, project visits and exploration, upvotes, favorites, public project reviews and ratings, quest completions, XP, badges and their dates. Referral records include your code, optional profile-name aliases, referrer, invited members and qualification progress. Earlier referral aliases remain reserved to their original member so shared links keep working.
- Connected identities: the provider, its account identifier, username and basic profile information returned through the connection you authorize. Supabase may also receive your verified email and profile image from that provider.
- Badge evidence: your connected X handle, a public profile or post URL, submission dates and the editorial decision.
- Technical records: hosting and authentication providers process IP addresses, browser information and security logs to deliver and protect the service. Papergames uses hashed identifiers to deduplicate views and votes and prevent repeated rewards. These hashes are not considered anonymous while they remain linkable to an account.
- Project proposals: the information and public links you submit, your declared relationship with the project (third-party discovery or creator submission), your member identifier, submission status, editorial feedback and decision history and private correspondence between the submitting member and the editorial team. Full proposals and correspondence are visible to their author and the editorial team. If you choose to share a proposal in Paper Scouts, the team can approve a public card containing your display name, project name, short description, category, public links and listing status. Private descriptions, feedback and messages are not included. Publication of a project requires a separate editorial decision; only eligible first proposers of third-party discoveries receive the recorded discovery reward. Creator submissions receive no discovery XP or Paper Scout badge.
- Support: information you choose to include when emailing us.
We do not ask for wallet private keys, seed phrases or payment-card details. Connecting a social identity does not disclose your social-network password to Papergames.
Why we use it
| Purpose | Basis where the GDPR applies |
|---|---|
| Authenticate your account; save your profile, favorites and progress; award quests and badges. | Providing the service you request under our terms. |
| Link an optional social identity and review a social badge request you initiate. | Your consent to the optional connection and the service you request. You can disconnect the identity. |
| Prevent duplicate rewards, spam, unauthorized access and manipulation; investigate technical failures. | Legitimate interests in maintaining a secure, reliable service. |
| Answer support and privacy requests. | Providing support, legitimate interests in resolving enquiries and applicable legal obligations. |
We do not sell personal information or use it for targeted advertising. The account sign-in system sends authentication codes, not marketing campaigns.
Providers and access
Papergames operators access member records when needed to operate the service or review evidence. Signed-in visitors can see aggregate project views and upvotes, and published reviews with their author’s display name, rating and date. A referrer can see referred members’ display names and qualification progress. Referral codes and personalized aliases can be shared publicly. The site does not publish a member directory, your email address or your account dashboard.
- Supabase: authentication, sessions and linked identities. See its data-processing terms ↗ and privacy notice ↗.
- OpenAI Sites and Cloudflare: hosting, request routing, application database and image storage. See the OpenAI privacy policy ↗ and Cloudflare privacy policy ↗.
- OVHcloud: delivery of sign-in codes through the Papergames mailbox and handling of support email. Email delivery uses the recipient address.
- Your social provider: handles the authorization you request under its own policies. External project links also take you to independent services.
- Google Fonts: downloading the site’s typefaces sends ordinary network information, including your IP address and browser details, to Google. See Google’s privacy policy ↗.
Providers can process information in countries other than yours. Supabase’s data-processing terms describe its processing locations and international-transfer arrangements, including standard contractual clauses where applicable. Contact Papergames for information about the arrangements relevant to your account. All processing is not necessarily within the European Union.
Information may also be disclosed when required by applicable law or a valid legal request.
Cookies and local storage
The current application uses functional storage for sign-in and your theme preference. Favorites are saved to your member account. X posts are loaded only when you select Show post; that requests content from X and can send ordinary network information to X under its own privacy policy. We do not add advertising or audience-measurement scripts.
| Storage | Purpose | Duration |
|---|---|---|
| pg_access | Authenticate member requests; HttpOnly cookie. | Normally 1 hour, renewed during active use. |
| pg_refresh | Renew your Supabase session; HttpOnly cookie. | Up to 30 days from renewal; cleared locally at sign-out. |
| pg_social_flow | Protect the social-linking callback with a temporary PKCE flow. | Up to 10 minutes; cleared when the callback finishes. |
| pg_google_flow | Protect Google sign-in with a temporary PKCE flow; HttpOnly cookie. | Up to 10 minutes; cleared after the callback. |
| pg-theme in local storage | Remember your selected light or dark theme. | Until changed or removed by clearing site storage. |
Hosting and external authentication providers can use their own security or sign-in cookies. Their policies apply to those services. Clearing or blocking functional storage can prevent sign-in or linking. You control site storage through your browser settings.
How long records stay
Account, profile and progression records are kept while your Papergames account remains open. Badge evidence, decisions and reward claims stay with that history to explain awards and prevent repeated rewards. Signing out or disconnecting a social account does not close your Paper account.
Request closure or deletion at admin@papergames.xyz. Requests are handled manually after account ownership is verified. We delete or de-identify records covered by a valid request, subject to applicable legal obligations and exceptions. Aggregate project totals can remain.
Sign-in rate-limit records expire at the end of their short enforcement window and are cleaned up on later authentication requests. Browser-storage durations are listed above. Project proposals and editorial decisions are kept with the account while they are being reviewed or to document a listing decision. They are covered by the account deletion request process. Support messages are kept while handling the request and, when needed, to document its resolution or a related legal obligation or dispute. Provider backups and security logs follow their retention arrangements; contact us for details about a specific request.
Your choices and rights
You can change your display name once every 30 days, remove favorites, manage optional project and topic follows and their read state in Following, disconnect social identities and sign out using your account controls. A verified account is required for member features; social connections are optional. Following preferences and read versions are private account data used to build your personal feed. Favorites do not subscribe you. Following sends no emails or browser notifications; you can unfollow at any time.
Where applicable, you can request access, correction, erasure, a portable copy or restriction of processing, and object to processing based on legitimate interests. You can withdraw consent for optional linking without affecting earlier lawful processing.
Email admin@papergames.xyz from your account address and describe your request. We may need proportionate information to confirm ownership. We respond within the time limits required by applicable law. You can complain to your local data-protection authority, including the CNIL ↗ in France.
XP and badge rules automate participation rewards. They do not make decisions about employment, credit, insurance or other essential services.
Security, age and updates
Member sessions are verified server-side with Supabase. Session cookies are HttpOnly and Secure on HTTPS. Administrative access is restricted separately. No online service can guarantee absolute security; contact us if you suspect unauthorized access.
Papergames is intended for adults aged 18 or over. Contact us if you believe a child has provided personal information so we can investigate and address it.
We update this policy when processing changes. The date above identifies this version. Material changes affecting member data will be communicated through the site or another appropriate service channel.
Social accounts are optional
Connecting X, Google, GitHub or Telegram, where enabled, adds an identity to your existing Paper profile. Your email sign-in remains available. The provider presents an authorization screen before returning you through Supabase.
Supabase’s X authentication flow requests profile and verified-email information, post read access and an offline-access scope. Papergames uses this flow to establish account ownership. Its application code does not store X access or refresh tokens for subsequent social API activity.
The integration does not automatically publish posts, follow accounts, like content or send direct messages. Follow and sharing badges are separate from account linking: their public evidence is currently checked by the editorial team.
You can disconnect an identity in My profile → Connected accounts and revoke the application in the social provider’s settings. Disconnecting stops its use for new linking requests. Earned badge history and a hashed claim preventing duplicate rewards remain with your Paper account until closure or an applicable erasure request.