Privacy Policy

Last updated: 12 November 2026

This policy explains what personal data papergames.io collects when you use the website, the mobile apps and our developer services, why we use it, who receives it, where it is processed, how long we keep it and what rights you have. It sits alongside our Terms and Conditions and our Content Moderation Policy. Every company that receives personal data from us is listed, with its country and safeguard, on our Sub-processors and data locations page.

1. Who is responsible

papergames.io is operated by Poly Bytes Sàrl, Chemin de la Planche-aux-Oies 4d, CH-1000 Lausanne, Switzerland, a Swiss limited liability company. Poly Bytes Sàrl is responsible for the personal data described in this policy under the Swiss Federal Act on Data Protection (FADP) and, for players in the European Economic Area and the United Kingdom, under the GDPR and the UK GDPR.

For any question or request about your data, write to [email protected].

2. What we collect and why

Your account

• Guest account: the display name you choose or that we generate for you, and an internal account id. We give the account a random internal email address; it is not yours and we never write to it.
• Registered account: your email address, your display name and your password, which we store only as a salted hash. To register with an email address you confirm a 4-digit code that we email to you.
• Sign-in with another service: on the website you can sign in with Google, Facebook or Discord, and in the mobile apps with Google or Apple. We receive your email address, your name and your user id at that service. Apple may give us a relay address instead of your email address. From Discord we keep the profile Discord returns, and your public profile shows your Discord username and avatar.
• Your language, your sound, music, theme and haptics settings, and the avatar you pick from our catalogue.

We use this to create and run your account and to keep you signed in.

Games, ratings and your public profile

• The games you play: your opponents, the moves, the result and duration, your ratings and rating history, statistics, trophies, coins and items, the tournaments you join or organise, and when you last played.
• Your public profile shows your display name, avatar, country flag, online status, statistics, ratings, rating history and game history. Leaderboards, tournaments and game rooms show your display name.
• Any signed-in player can find your profile by searching for your display name, your account id or your exact email address. Your email address itself is never shown.

Friends and chat

• Your friend requests, friends and blocks.
• Guest and registered accounts can both chat: in a game with its other player, and in the inbox once two players are friends. Inbox messages are stored with the conversation. In-game messages are never stored.
• When you receive an inbox message and the mobile app is allowed to send you notifications, the push notification contains the sender's display name and up to the first 200 characters of the message. It is delivered through Google's Firebase Cloud Messaging and, on iPhone and iPad, Apple's push service. If your email address is verified, we also email you when the first new message arrives since you last opened that conversation. The email names the sender but does not contain the message.

Moderation and safety

• Display names, inbox and in-game messages, and tournament names and descriptions are checked automatically, including by OpenAI's moderation models. Our Content Moderation Policy explains each check.
• We keep each display-name verdict, stored under the name itself, so that the same name is not checked again for 12 months.
• Reports: who reported whom, the category, the page it was sent from and any comment. When the classifier flags an inbox message, we file a report on its sender automatically, with the flagged message as the comment.
• Warnings and bans. A ban by a moderator records the banned account's last IP address and, when we have one on record, a device identifier.
• Our moderators are papergames.io staff. To keep players safe and to provide support, staff can read any inbox conversation and can act as any account. This access is not logged.
• When you join a tournament queue, the game checks the page for known cheating scripts and tells our servers if it finds one. A detection flags the account as a cheater.

Connection and device data

• Your IP address, and the country that our network provider Cloudflare derives from it. Each time a registered account connects, we save its latest IP address and that country on the account. The country is shown as a flag on your profile.
• When you join a tournament queue, we use your IP address so that two players on the same IP address are not matched against each other.
• When you are signed in, the website and the apps store a random identifier on your device and read technical characteristics of your browser and device. They send these when they connect to our game servers, and we store them with your account. We use them to keep matchmaking fair and to protect the service against abuse, for example to detect accounts used to get around a ban or to manipulate tournament results. We keep them for up to 365 days after your device last connected, and delete them when you delete your account.
• Our servers write technical logs to troubleshoot problems. They can contain your account id, display name or email address, and our web server records the IP address of game connections.
• The sign-up, login and password reset forms are protected by Google reCAPTCHA, which analyses your browser and how you use the page to tell people from bots.

Payments

• Plans and passes are sold through Stripe. We send Stripe your email address, account id and language, and Stripe collects your payment details itself. For one-time passes Stripe also collects your name, address and, if you give one, your VAT number for the invoice. We keep the Stripe customer and subscription ids, the plan and its dates, and a record of the confirmation about your right of withdrawal that checkout asks you for. We never see your card number.
• Coins on the website are sold by Xsolla, which acts as the merchant of record. We send Xsolla your account id and email address, and keep the purchase details Xsolla sends back.
• Coins in the mobile apps are sold through the Apple App Store and Google Play. We keep the store's transaction record.

Emails

• Service emails are sent through Twilio SendGrid: your verification code, password resets, notifications about friends and messages, purchase confirmations and cancellations.
• Marketing emails are only sent to players who have bought something from us. When you buy a plan, a pass or coins on the website, we add you to our SendGrid contacts with your email address, display name, country, language, total play time, the date you last played, the dates of your first and last tournament, your first and last shop purchase, your last purchase, the last time you opened a checkout, when your points boost ends and the date of any free trial. Every marketing email contains an unsubscribe link, and you can also ask us at any time to stop.

Analytics

• Website: Google Analytics 4 measures page views and events such as opening a checkout. Section 6 explains when it uses cookies.
• Mobile apps: Google Analytics for Firebase records screen views. Once push notifications are allowed, we set its user id to a one-way hash of your account id. Mixpanel records app launches, sign-ins, the screens you open and the games you start and finish, and, once you have played a game, links them to your account id. Mixpanel also receives device information and your IP address, which it uses to estimate your location.
• Our own records: the website and the apps send a few events to our servers, such as starting an online game, with your account id, your platform and your country.

Advertising

• The website shows ads delivered by Venatus Media Limited (United Kingdom) and the advertising partners it works with. We do not give Venatus your name, email address or account id.
• Venatus's script and the partners it loads can read and set cookies and similar identifiers, and receive your IP address, browser information and the pages you visit. They use them to choose, show and measure ads, including personalised ads.
• Ads are not loaded for players on an ad-free plan, in games embedded on other sites, or in the mobile apps.

Developer services

• If you use our API: your API keys (stored only as a hash) and their names, usage counts, and a log of each request with the IP address, headers (secret headers removed), the request and the response.
• If you play in a game created through another company's integration of our API, that company receives the result: each player's display name, score and the id the company uses for them. That company decides how it uses this and is responsible for it.

3. Legal bases

For players in the EEA and the UK, these are the GDPR legal bases we rely on. Swiss law does not require a legal basis for each use, but we apply the same reasoning.

• Contract: your account, games, chat, tournaments, purchases and service emails.
• Legitimate interests: moderation, cheat detection, bans and fraud prevention; keeping the service secure and working; marketing emails to existing customers; analytics outside the regions where consent is asked.
• Consent: analytics and advertising cookies where the consent banner is shown; push notifications; tracking in the iOS app.
• Legal obligation: keeping payment records for bookkeeping.

4. Who receives your data

• Other players see what your public profile, games, tournaments and chats show, as described above.
• Our staff, for moderation, support and operating the service.
• Service providers and partners: hosting and network, payments, app stores, email, push notifications, sign-in, bot protection, analytics, automated moderation and advertising. Each one is listed on our Sub-processors and data locations page, with whether it acts on our behalf or as an independent controller under its own privacy policy.
• Companies using our API, for games created through their integration.
• Authorities, when the law requires us to disclose data.

5. Where your data is processed

• Our application servers and our production database run on servers of OVH Hosting Inc. in Beauharnois, Canada.
• Database backups are stored with Amazon Web Services (EC2) in Canada (region ca-central-1).
• All traffic to papergames.io passes through Cloudflare's network, which is worldwide.
• Several providers process data in the United States, and some in other countries. Canada, the United Kingdom and the EU and EEA states are recognised as offering adequate protection under Swiss and EU law. Providers in the United States that are certified under the Swiss-US and EU-US Data Privacy Framework rely on it. For the others we rely on the European Commission's standard contractual clauses, which Switzerland recognises.

The Sub-processors and data locations page names the country and the safeguard for each recipient.

6. Cookies, similar technologies and consent

Always on

• Sign-in cookies set by papergames.io: Authentication and Refresh keep you signed in, and connect.sid holds your session during sign-in.
• Your browser's local and session storage keeps your settings, unfinished forms and similar preferences, and the random device identifier described in section 2. The mobile apps store your sign-in tokens and a random device id on your device.

Website analytics

• In the EU, Norway, Iceland, Liechtenstein and the UK, Google Analytics starts with analytics and advertising storage switched off. Until you consent it sets no analytics cookies, but it still sends Google cookieless measurement requests about your visit. Analytics cookies are set only if you consent.
• Everywhere else, including Switzerland, Google Analytics starts with storage switched on and sets its cookies without asking.

Website advertising

• When ads load, Venatus shows a consent banner to visitors in the EU, Norway, Iceland, Liechtenstein and the UK, and to visitors whose country it cannot determine. A link on the page lets you reopen the banner and change your choice at any time.
• If you refuse consent, the banner passes your choice to the advertising partners in its consent signal, and each partner applies it under its own policy. Venatus does not itself block ads, advertising cookies or identifiers when you refuse.
• Visitors in every other country, including Switzerland, see no consent banner. Ads, including personalised ads, and the cookies and identifiers of Venatus and its partners load without a consent step.

Loaded only when you use them

• Google reCAPTCHA, on the sign-up, login and password reset forms.
• Stripe, when you open a checkout or manage your plan.
• Xsolla, in the coin shop.
• Cloudflare Stream, for the video on the Gruppo pricing page.
• YouTube, for the video on the Games as a Service pricing page, only after you press its play button, and from YouTube's privacy-enhanced youtube-nocookie.com domain.
• Google, Facebook, Discord, Apple and Firebase, when you sign in with them.

Mobile apps

• The apps show no ads.
• Google Analytics for Firebase runs on Android without asking. On iPhone and iPad it only stores analytics data if you allow tracking when the app asks.
• Mixpanel runs on Android, iPhone and iPad without asking.

We do not respond to Do Not Track signals.

7. How long we keep data

• Account, profile, settings, coins and friends: until you delete your account.
• Inbox messages: the messages you sent are deleted with your account. The messages other players sent you stay in their conversations.
• Games and rating history: kept with no end date, also after an account is deleted. A game keeps the display names its players had.
• Reports and warnings: 2 years.
• Ban records with an IP address or a device identifier: 2 years from the ban. The account itself stays banned.
• The device identifier and device characteristics sent when you connect to our game servers: up to 365 days after your device last connected. They are deleted when you delete your account.
• Display-name verdicts: 12 months.
• Email verification codes: 1 hour.
• API request logs: 90 days.
• Our own analytics events: 13 months.
• Payment records, including the record of a withdrawal waiver: at least 10 years, as Swiss bookkeeping law requires.
• Tournament activity feeds: 7 days.
• Live session data: up to 24 hours. Matchmaking queue entries, which hold your IP address: 2 minutes.
• Game results sent to companies using our API: 30 days in our webhook system.
• Backups: our backup store keeps the two most recent copies of the database, and our server keeps the seven most recent copies of the webhook database. An older copy is deleted when a newer one replaces it.
• Server logs: kept on our servers for troubleshooting, with no fixed period yet.

Providers that act as independent controllers keep data under their own policies.

8. Deleting your account

You can delete your account at any time from your account settings. Deleting it cannot be undone. It does the following straight away:

• It cancels any running Stripe subscription at once, without a refund for the rest of the period, and deletes your Stripe customer record. Stripe keeps its own invoices and payment records.
• It erases your account and profile, your coins and items, your friends, the inbox messages you sent, the tournaments you created, your sign-in links, your devices registered for push notifications, and the device identifiers and device characteristics stored with your account.
• It deletes the stored verdict for your display name, unless another account uses the same name.
• Reports you filed are kept, but your account id on them is replaced with a random id.
• It deletes the Firebase sign-in user behind a Google, Apple or Facebook sign-in, and removes you from our SendGrid contacts if you were on them.

We keep, for the periods in section 7:

• Reports made against you, warnings and bans, to prevent abuse.
• Your payment records, without your email address, name, phone number or IP address, and the record of any withdrawal waiver you gave at checkout.
• Your past games, with the display name you had, and your rating history.
• Conversations with the messages other players sent you, and the notifications addressed to you.
• Analytics events, API request logs and webhook results, until they expire.
• Copies of your data in backups, until they are replaced.

Deleting your account does not erase what Mixpanel holds: it keeps the app events linked to your account id. Write to [email protected] and we will ask Mixpanel to erase them.

Deleting your account does not revoke Sign in with Apple. You can remove papergames.io from the apps that use Sign in with Apple in your Apple ID settings. Data held by Google Analytics, Firebase Analytics, the app stores, Xsolla, the sign-in providers and the advertising partners is governed by their own policies.

9. Your rights

You can ask us to:

• tell you what data we hold about you and give you a copy;
• correct it (you can change your display name yourself in your account settings);
• delete it;
• stop or restrict a use of it, including marketing emails, which you can stop at any time;
• send data you gave us to you or to another service in a common machine-readable format;
• withdraw a consent you gave, without affecting what happened before.

Some decisions are taken automatically, such as replacing a display name that the classifier rejects, or hiding or removing a flagged message. You can ask for a person to review any such decision and give your point of view.

Write to [email protected]. We may ask you to confirm that the account is yours, and we answer within 30 days. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EEA or the UK, to your local data protection authority.

10. Children

Players aged 13 or older can hold an account on their own. Children under 13 may only use papergames.io with the permission of a parent or a teacher, who is responsible for the child's use. We do not ask for your age or date of birth, and children's data is processed in the same way as everyone else's. A parent or teacher can ask us to see or delete a child's data by writing to [email protected].

11. Security

Connections between your browser or app and papergames.io are encrypted. Passwords are stored only as salted hashes, and the sign-in cookies cannot be read by scripts on the page. No system is perfectly secure, so please use a password you do not use anywhere else.

12. Changes to this policy

When we change this policy, we publish the new version on this page and update the date at the top.

13. Contact

Poly Bytes Sàrl. Email: [email protected].