Last updated: 21 October 2026
Who we are
Open Paperless ("we", "us") runs openpaperless.com and is the controller of the personal data described here under the UK GDPR and the Data Protection Act 2018. Contact us about privacy at [email protected].
The short version
- You can play every game without giving us any personal data.
- If you create an account we keep your name, email, UK phone number and a hashed password on our own server.
- All forms are processed server-side. Your data is never shown in the page, kept in public tables or exposed in any query.
- We never ask for, collect or store payment details.
- We do not sell your data or use it for advertising.
What we collect
| Data | When | Why |
|---|---|---|
| First and last name, email, UK phone number | You create an account | To run your account and keep it secure |
| Password (stored only as a one-way bcrypt hash) | You sign up with email | To let you sign in. We cannot see your password |
| Name, verified email and Google account ID | You use Google sign-in | To sign you in with Google |
| Coins, XP, level, games played, last sign-in | You play while signed in | To show your progress and daily bonus |
| Name, email, topic and message | You use the contact or Player Care form | To answer you and act on requests (for example a break) |
| Form log entries (date, form, email, outcome) | Any form is submitted | Security, fraud prevention and fixing problems. Passwords are never logged |
| Session cookie | You sign in | To keep you signed in |
Our legal reasons
- Contract: to provide your account and the services you ask for.
- Legitimate interests: to keep the Site secure, prevent misuse, answer messages and improve our games.
- Legal obligation: where the law requires us to keep or share information.
- Consent: for any optional cookies, which you can change at any time.
How we protect your data
Security is built into how the Site works:
- Server-side processing. Sign-up, sign-in, account, contact and Player Care forms all post to our own server. Nothing is stored in your browser except a session cookie and simple preferences.
- Private storage. Each account is held in a protected file in a server folder that is blocked from web access. File names are derived from a one-way hash of your email, so they cannot be guessed.
- Hashed passwords. Passwords are stored using bcrypt and cannot be reversed. Repeated wrong passwords temporarily lock the account.
- Encryption in transit. The whole Site uses HTTPS (TLS). Email from our forms is sent through an encrypted (STARTTLS) mail connection.
- Data minimisation. The page only ever receives what it needs to show you (for example your name, coins and level), never your password hash or Google ID.
Who we share it with
We share personal data only with service providers who help us run the Site, under contracts that protect it:
- our web hosting provider (stores the Site and account files);
- our email delivery provider (delivers messages from our forms to our inbox);
- Google, only if you choose Google sign-in.
We may also share data if required by law or to protect our users. We never sell personal data.
International transfers
Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to keep it protected.
How long we keep it
- Account data: while your account is open. Deleting your account removes its file from our server straight away.
- Contact and Player Care messages: up to 24 months, then deleted.
- Form logs: up to 12 months.
- Break and restriction requests: as long as needed to honour them.
Your rights
You have the right to access, correct, delete or restrict your data, to object to processing, and to data portability. To use any of these, email [email protected] or use our contact form. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Under 18s
The Site is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
We may update this policy. The date at the top shows the latest version, and important changes will be highlighted on the Site.