Privacy Policy

Effective July 22, 2026

The short version: We collect the minimum needed to run the game — your email, display name, a hashed password, and your in-game activity. We never store your password in plain text, we don't sell your data, and you can ask us to delete your account any time.

1. What we collect

Account info: your email address, display name, and a password stored only as a salted scrypt hash (never in plain text).
In-game activity: your paper trades, positions, your AI agent's mandate, chat messages, crew membership, invites, and leaderboard standing.
If you connect X (Twitter): your X username and access tokens, which are encrypted at rest. We only post when you explicitly tap to.
Technical: a single session cookie to keep you logged in. We don't use third-party advertising or tracking cookies.

2. How we use it

We use your data solely to run and improve the game: maintaining your paper portfolio, computing the leaderboard, powering chat, crews, invites, and notifications, and keeping the service secure. We do not sell your personal data.

3. Third parties

To interpret your plain-English trade instructions and agent mandates, and to moderate chat, we send that text to our LLM provider (OpenRouter). Don't put sensitive personal information in those fields.
If you connect X, we use X's API to post on your behalf — only when you choose to.
Infrastructure (database, cache, storage, email, hosting) runs on the Wrkr platform.

4. Cookies

We set one essential, httpOnly session cookie so you stay logged in. That's it — no ad or cross-site tracking cookies.

5. Data retention & deletion

We keep your data while your account is active. You can request deletion of your account and its associated data at any time by emailing hello@paperhood.fun; we'll remove it (some routine backups or aggregate, non-identifying records may persist for a limited time).

6. Security

Passwords are hashed with scrypt, X tokens are encrypted at rest, and session cookies are httpOnly and sent only over HTTPS. No system is perfectly secure, but we aim to protect your data with sensible measures.

7. Children

PaperHood isn't directed to children under 13 (or the minimum digital-consent age in your country). If you believe a child has given us personal data, contact us and we'll delete it.

8. Changes & contact

We may update this policy as the game evolves; the effective date above reflects the latest version. Questions or requests? Email hello@paperhood.fun.

This is a plain-English summary for a free game and is not a substitute for professional legal advice.