Privacy Policy

1. Who we are

Paperplanes ("we", "us", "our") is an independent interface for practicing and visualizing BTC and ETH trades. It is not affiliated with Papertrade or Hyperliquid. Today it offers practice trading with virtual balances only. We are not an exchange, broker or custodian.

2. What data we collect

Practice session. When you open a practice, Paper Trail, Watch or Flight page, we set one cookie, pp_session, holding a random token. We store only a SHA-256 hash of that token, linked to your practice experiments: virtual balances, positions, trade history, settings and results. The cookie expires after 30 days.

X account, if you connect it. Sign-in uses Privy with X. We store your X username, display name, avatar URL (from X's image servers only) and a hash of your X account ID. We do not store your email address, Privy token or other linked accounts.

Wallet address, if you verified one. Wallet verification is currently paused. Earlier verifications stored the wallet address, the signed verification message and its time. The signature was checked and not kept, and that message never authorized trades, transactions, deposits or approvals.

Data collected automatically.

• Abuse protection: rate limits use a keyed hash (HMAC with a server-only secret) of your IP address, or a hash of your session. We do not store raw IP addresses in our database.
• Duplicate protection: a hash of each practice request so a trade cannot be applied twice.
• Analytics, only if you allow it: Google Analytics 4 loads only after you choose "Allow analytics". We send page and feature events with coarse labels (for example a leverage band or market). We do not send wallet addresses, social profiles, balances or PnL.
• Browser storage: your analytics choice, theme and aircraft preference are saved in your browser's local storage.

Data we do not collect: private keys or seed phrases, payment card details, government IDs, real funds of any kind.

3. How we use your data

• Run your practice account and save its history between visits
• Show your profile and results on public leaderboards and rides
• Prevent abuse, duplicate actions and automated misuse
• Understand aggregate usage, if you allowed analytics
• Improve the Platform

We never sell your personal data or share it for cross-context advertising.

4. Public leaderboards and shared rides

When you connect X, your settled practice results are published to the public Paper Trail leaderboard. Public entries can include your X name, username and avatar (or a shortened wallet address for older wallet entries) and summary statistics such as PAPER, PnL, cost per 1,000 PAPER, trade counts and the scenario used. Individual trade rows stay private. You can hide a result from Paper Trail at any time.

Sharing a ride is opt-in. A shared ride shows your pilot label, market, side, margin, leverage, entry, open time and, once closed, the exit, PnL, PAPER and close reason, plus how many people are watching. When you watch a ride, your profile is shown to others only if you tick the box to show it.

5. Non-custodial nature

Paperplanes never asks for, receives or stores your private keys, and it never holds or controls funds. Practice mode uses virtual balances only. If live trading is added later, trades would be signed in your own wallet or session key and executed by a third-party protocol such as Papertrade, not by us.

6. Third-party services

• Privy: sign-in with X. Privy's script loads on our pages so the sign-in button works.
• X: account connection through Privy. Avatars load from X's image servers, which receive your IP address.
• Google Analytics 4: usage analytics, only after you opt in. Advertising features are off.
• Hyperliquid: public price data. On trading and flight pages your browser connects directly to Hyperliquid's public market data feed.
• Vercel: website hosting and request routing.
• Railway: our practice API and Postgres database.
• Cloudflare: domain name (DNS) service.

Our fonts and site images are served from our own domain. Each service above has its own privacy policy. We encourage you to review them.

7. Cookies and your choices

• Analytics: use the Privacy button to change your choice at any time. Declining removes Google Analytics cookies.
• Leaderboard: hide a published result from Paper Trail.
• Rides: stop sharing a ride, or leave the "show my profile" box unticked when watching.
• Session: clearing your cookies ends access to your practice session from that browser. Export your history first.
• Delete my data: on your Profile page, delete this browser's practice account, history and anything it published. If you are signed in with X, everything published under your X account from any browser is deleted too. We then keep only a hash of your X account ID so your results are not republished automatically. Publishing again removes it.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal data, and to object to or restrict some processing. You can delete your data yourself from the Profile page. For any other request, contact us on X (section 13). We will not discriminate against you for using these rights.

9. Data retention

Price samples are kept for 48 hours, rate-limit records for up to one day and watcher presence for about one minute. Practice data that was never published is deleted automatically 7 days after its session expires, about 37 days after the session began. Published results and shared rides are kept until you delete them or we reset practice data. Signing out does not unpublish results; use Delete my data or hide them first. Our hosting providers may keep backups and logs for a limited time.

10. Security

We use reasonable safeguards, including hashed session tokens, HttpOnly cookies, verified sign-in tokens, Content Security Policy headers, rate limiting and parameterized database queries. No system is perfectly secure.

11. Children

Paperplanes is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has used the Platform, contact us and we will delete their data.

12. Changes

We may update this policy from time to time. Changes will be posted on this page with a new "Last updated" date.

13. Contact

For privacy questions or data requests, reach out via @paperplanesxyz on X.