Privacy Policy

1Information We Collect

When you register and interact with PaperEx, we collect minimal information necessary to operate and protect your simulated trading workspace:

• Account Information: Your email address, optional display name, avatar URL (for OAuth accounts), account creation timestamp, and email verification status. For password-based credentials, passwords are salted and cryptographically hashed with bcrypt (10 rounds) — plain-text passwords are never stored, logged, or visible to anyone. For accounts authenticated via Google OAuth, we receive profile identifiers directly from Google; passwords are not created or stored.
• Simulated Trading Records: Virtual orders, filled positions, simulated transaction history, portfolio balances, and leaderboard standings. All trading records on PaperEx reflect virtual paper trades.
• Technical & Usage Logs: IP addresses, browser user agent, session identifiers (Auth.js session tokens), and API request timings used for security defense, rate limiting, and performance optimization.
• Support Communications: Inquiries, bug reports, or feedback submitted via email or our in-app 24/7 Simulator Help modal.

2How We Use Your Information

Your information is processed for specific, transparent purposes:

• Platform Operation: To manage your account, maintain virtual wallet balances, execute simulated orders via our worker engine, and render real-time portfolio statistics.
• Authentication & Verification: To send single-use 6-digit OTP verification codes via transactional email (auth@paperex.trade) and prevent unauthorized account takeovers.
• Security & Infrastructure Defense: To detect malicious abuse, mitigate DDoS attacks, enforce rate limits, and maintain high availability across our Oracle Cloud infrastructure.
• Platform Improvements: To diagnose latency anomalies and optimize trading terminal rendering performance.

3Third-Party Infrastructure & Data Processors

To deliver a modern, resilient web application, we integrate with trusted third-party service providers under strict confidentiality:

• Resend: Used exclusively for delivering transactional emails (registration OTP codes, verification links). We transmit only the recipient email and the one-time code. No marketing newsletters are sent.
• Oracle Cloud Infrastructure: PaperEx is hosted on dedicated Oracle Cloud Ampere A1 ARM compute in an isolated Docker environment. Databases and worker engines are not exposed directly to the public internet.
• Google OAuth (Optional): When you choose to authenticate using Google, we receive only your basic profile information (verified email, display name, and avatar image URL) to establish your account session. We do not access contacts, Google Drive, or private Google service data.
• Binance Market Feeds: We stream public ticker, orderbook, and mark-price data directly from Binance public WebSocket and REST endpoints. Because your browser establishes direct client-side network connections to Binance to receive live price feeds, Binance receives standard connection metadata (such as your client IP address and user-agent header). However, no PaperEx account records, user identity, email addresses, or simulated trading activities are ever shared with Binance.

4Cookies & Local Browser Storage

PaperEx uses minimal cookies and browser storage strictly required for platform function:

• Essential Session Cookies: Encrypted, HTTP-only session cookies generated by Auth.js to maintain your authenticated login state across page refreshes.
• Browser LocalStorage: Client-side browser storage used solely to store your workspace UI preferences, such as selected trading pair favorites, chart interval selection (e.g., 1m, 15m, 1h), and order book layout modes.

We do NOT use cross-site tracking cookies, invasive third-party analytics pixels, or targeted ad trackers.

5Data Security & Encryption

We employ defense-in-depth security measures to protect your account and application integrity:

• All web traffic, WebSocket streams, and API requests are encrypted in transit via TLS/HTTPS (Caddy ingress proxy with automatic SSL certificate renewal).
• User passwords are encrypted with bcrypt using 10 salt rounds before persisting to PostgreSQL.
• Database connections are routed through PgBouncer connection pooling with strict network isolation inside private Docker networks.
• Rate-limiting guards protect API endpoints against automated credential stuffing and brute-force attacks.

6Data Retention & Account Deletion (GDPR & Global Rights)

Under applicable data protection laws (including the EU General Data Protection Regulation - GDPR), you retain full sovereignty over your personal data:

• Right to Access & Rectify: You can view your active account email and session details directly within the platform. To request rectification, account correction, or an export of your account data, simply email contact@paperex.trade.
• Right to Erasure (Account Deletion):You may permanently delete your account, authentication credentials, and virtual trading history directly from your account menu in the platform navigation at any time ("Delete Account"). Alternatively, you can submit a deletion request by emailing contact@paperex.trade from your registered email address.
• Retention Period: Your account records are retained as long as your account remains active or until you request deletion.

7Children's Privacy

PaperEx is not intended for or directed toward individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a minor has provided us with personal information, please contact us immediately so that we can remove the data.

8Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our platform features, security architecture, or legal obligations. When updates occur, the "Effective Date" at the top of this document will be updated accordingly. Continued use of PaperEx following any changes signifies your acceptance of the revised policy.

9Privacy Officer & Contact Information

If you have any questions, concerns, or data privacy requests, please feel free to reach out to our team: