Privacy Policy

1.What we process

• Your IP address, at the network edge, to find the country you connect from and block restricted regions. We do not store it.
• A salted, one-way hash of your network (the first part of your IP address), computed by our web server so our backend never sees the address itself. It is stored with entries, with likes on entries and with short-lived rate counters, so one network cannot flood the site. It cannot be turned back into your address.
• Your wallet public key, when you connect a wallet: your browser uses it to build transactions and sends it to our sanctions-screening endpoint before a trade, a launch or a burn. We do not store it for that.
• When you take part in the season: your wallet public key, the messages you sign, what you submit (reports, lore, memes and other images, quest proofs, links to your posts), the entries you like, and when. Signed messages prove the wallet is yours; we keep their signatures to stop them being reused.
• Your scores and ranks, computed from public blockchain data (your trades or burns) and from moderators’ decisions, and prizes paid to your wallet.
• What you upload when you launch a coin: the image, name, ticker, description and links go through our relay to pump.fun’s IPFS service and become public and permanent.
• Reports you send about a coin (the coin, the reason, your text).
• Technical logs kept by our hosting providers for security and operations, such as request times, paths, status codes and error messages.

2.What stays in your browser

Some things are kept only in your browser’s local storage and never sent to us: your acceptance of the entrance boxes (the date, the version and the boxes ticked), an RPC endpoint you may paste, and your wallet software’s own settings. Clearing your browser’s site data removes them.

3.Cookies

We use only cookies the site needs to work: on preview deployments a ph_lp cookie remembers which launchpad you are viewing. Our hosting providers may set their own strictly necessary security cookies to protect the site from bots. We use no advertising, analytics or tracking cookies, so there is no cookie banner to accept.

4.Why, and on what basis

• to provide the features you use (voting, launching, trading, the season game and its prizes): performance of our agreement with you (the Terms of Service and Season Rules);
• to keep the site secure, stop manipulation and abuse, and keep it working: our legitimate interests;
• to block restricted regions and screen sanctioned wallets, and to keep records of prize payments: our legal obligations and legitimate interests.

We never sell your data, never use it for advertising, and never build profiles of you.

5.What is public

Boards show wallet addresses and scores. Approved entries show the wallet that submitted them and their content. Prize payments show the wallet, the amount and the transaction. Anything on the blockchain (your wallet address, transactions, burns, the coins you launch and their content) is public by nature, visible to anyone forever, and outside our control.

6.How long we keep it

• rate counters: about two days;
• entries, likes on entries and their network hashes: as long as the season game runs, and at most 24 months after the season they belong to (you can ask us to remove an entry sooner);
• boards, season manifests and prize payment records: as long as the law requires us to keep them, and otherwise as long as the game runs, because they are the public proof of how prizes were paid;
• used signatures: about a day;
• reports: up to 12 months after they are handled;
• hosting logs: as set by our hosting providers, usually days to a few weeks.

7.Who else sees data

Your browser talks directly to some services to show live data and to send your transactions. They see your IP address and the requests you make, under their own privacy policies:

• our hosting providers (the web app and its backend) and their network edge;
• Solana RPC providers: by default your requests go through our relay, so the provider sees our server rather than you; if you choose your own endpoint, your browser talks to it directly;
• pump.fun (the IPFS upload of a coin you launch, through our relay);
• IPFS gateways (Pinata, Filebase) and an image resizing service (wsrv.nl) that load coin images;
• your wallet provider;

Our backend also uses, without your IP address: price services (CoinGecko, Coinbase, Kraken) for the SOL price; a sanctions-screening provider (Chainalysis, when configured), which receives wallet addresses; and Solana RPC providers.

We may disclose data when the law requires it.

8.The $PAPER coin

We do not read, collect or use your $PAPER holdings or transactions for anything: they count for nothing on the board and give no access to any feature and no rights over any data.

9.International transfers

The services above may process data outside your country, including in the United States. Where the law requires it, transfers rely on appropriate safeguards such as standard contractual clauses.

10.Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to complain to a data protection authority. Write to legal@paperhandz.fun. Because we do not know who you are, we may need your visitor id or wallet address, and for a wallet, a signed message proving it is yours. We cannot change or delete anything recorded on a public blockchain, or on IPFS.

11.Children

paperhandz is only for people aged 18 and over. We do not knowingly process data of anyone under 18. If you believe a minor has used the site, contact us.

12.Security

We keep what we store to a minimum, hash network addresses, never handle private keys, keep our backend private behind the web app, and serve the site only over HTTPS. No system is perfectly secure; if we learn of a breach affecting your data, we will act as the law requires.

13.Changes

We may update this policy. The date above shows the latest version. Significant changes will be shown at the entrance of the site.