Privacy Policy

Paperpoly ("we", "us", "our") operates the paper trading simulation platform at paperpoly.io. This policy explains what personal data we collect, why we collect it, and your rights regarding that data.

• Platform operation — managing your account, displaying your portfolio, leaderboard rankings.
• Prediction model training — aggregated, anonymised bet patterns are used to develop market prediction algorithms. Individual data is never shared externally for this purpose.
• Analytics — understanding how the platform is used to improve features.
• Communications — sending account-related emails (confirmation, password reset). We do not send marketing emails without separate consent.

If you are in the European Economic Area, we process your data under the following lawful bases:

• Contract — processing necessary to provide the Service you signed up for.
• Legitimate interests — analytics, fraud prevention, improving the platform and prediction models, where these interests are not overridden by your rights.
• Consent — where we explicitly ask for it (e.g. optional features).

We do not sell your personal data. We share data only with:

• Supabase — our database and authentication provider (data stored on EU/US servers per your region).
• Vercel — hosting provider, processes request metadata including IP for routing and geolocation headers.
• Law enforcement — only where required by law and with a valid legal process.

• Account data is retained for as long as your account is active.
• Bet history and event logs are retained indefinitely to support the prediction model — but are anonymised upon account deletion.
• You can request full deletion at any time (see Section 8).

We use only essential session cookies required for authentication (via Supabase Auth). We do not use advertising cookies, third-party tracking pixels, or Google Analytics. No cookie consent banner is required as we do not use non-essential cookies.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data via your account settings.
• Erasure — delete your account and associated personal data. Anonymised bet data used for model training may be retained.
• Portability — request an export of your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any right, email privacy@paperpoly.io or use the account deletion option in Settings. We will respond within 30 days.

Paperpoly is not directed at users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

Your data may be processed in the United States (Supabase, Vercel). Both providers maintain appropriate safeguards including Standard Contractual Clauses for EU data transfers.

We may update this policy. Material changes will be communicated by updating the effective date and, where appropriate, notifying you by email. Continued use after changes constitutes acceptance.

Data controller: Paperpoly
Email: privacy@paperpoly.io