PaperTrail privacy policy

The short version

• Nothing is recorded or sent until you press Turn on PaperTrail on the first screen.
• The list of pages you visit stays on your device. The server never receives a page address, a page title, the text of a note or your name in a form it can read.
• The server stores scrambled codes (one per friend per page), encrypted data that only you and that friend can open, your random account id and a few timestamps. It is hosted in Frankfurt, Germany (EU).
• Your friends can see when you were on the same pages they visit, how long you stayed, how far you scrolled, and what you leave for them. Only pair with people you would let see your browsing.
• Visits are deleted from the server after 30 days. Accounts that have not been used for 180 days are deleted with all their data, unless you choose to keep yours.
• You can delete a single note, remove a friend, or delete your whole account from inside the extension. Uninstalling alone does not delete what is on the server.

Who is responsible

The controller for your data under the EU General Data Protection Regulation (GDPR) is:

Janis Bögershausen
Hannoversche Straße 62B, 30629 Hannover, Germany
Email: janis@bubbly.games

PaperTrail has no user accounts with names, emails or passwords, so we do not know who you are.

What stays on your device

These are stored in your browser's extension storage on your device. Except where noted, they are never sent anywhere:

• Your page history: the address of each page you visited while PaperTrail was on, with the time. At most 30 days and at most 5,000 entries; older entries are deleted automatically.
• Your friends' keys: each friendship has its own secret key, created on your device and passed to your friend as a friend code (PT1-...) that you share yourself. The server never receives it.
• Your friend list (the names and colors your friends chose) and your settings (mode, quiet domains, whether PaperTrail is on).
• Your display name and color. They reach your friends only inside the encrypted hello described below.
• Your notes index: for each note, reaction and clue you left, the page address, the first 80 characters of the text, when you made it and the server ids of its copies. It is what the Notes tab shows and what lets you delete a note without going back to its page.
• Stickers and trails: the badges you earned, the names of trails you created, the clues you have seen and followed (at most 200, each forgotten after 30 days) and your progress on friends' trails.
• Counts of how many pages were recorded or skipped, by reason.
• Your account id and access token: a random id and a random token the server gave the extension. The token goes with each request to the server, so the server knows the request is yours. Neither is linked to your name, email or any other account.

While a page is open, the extension also keeps short-lived state for that tab in the browser's memory-only session storage, which is cleared when the browser closes.

What is never recorded

These pages are always skipped, in every mode:

• incognito and private windows (the extension is not allowed to run in them at all);
• secret-looking links, such as password resets, sign-in links and private share links;
• local addresses, such as localhost, your router and other devices on your home network;
• browser pages, files and other non-web addresses.

In Safe mode, PaperTrail also skips a built-in list of banking, health, adult and dating sites. In either mode you can add your own quiet domains, which are never recorded.

What the server receives

PaperTrail talks to its server at api.papertrail.bubbly.games only once you have turned it on. Before anything leaves your device, each page address is normalized and turned into a separate scrambled code (an HMAC-SHA256 tag) for each friend, using that friendship's key. Only you and that friend can compute the same code for the same page. Everything else that is meant for a friend is encrypted on your device with AES-256-GCM, under a key derived from the same friendship key.

What the server cannot do: it cannot read page addresses, page titles, notes, names or the details of a visit, and it cannot tell which page a scrambled code stands for. Codes for the same page are different for each pair of friends.

What the server can work out: how much and when you use PaperTrail (from the timestamps above, including the exact time a visit was recorded, which follows from its expiry time); which accounts are friends with each other and when they were on the same page, because friends use the same codes; how many friends you have; and roughly how long each encrypted item is.

Your network (IP) address reaches the server with every request, as with any website. The server never stores it in its database or logs. It is kept only in memory, to limit how many new accounts one address can create (10 per hour).

What your friends can see

A friend you have paired with can see, only for pages they visit themselves:

• that you were on the page and when (the footprints bar shows the time rounded to 5 minutes; the encrypted visit record their extension receives holds the exact time);
• how long you stayed and how far you scrolled;
• the notes, reactions and clues you left for them, with the exact time each was saved, and your display name and color;
• when you are on the same page at the same moment (Paths Crossed);
• your random account id.

Because a friend holds the key, a friend can also test whether you visited a specific page they guess, by computing its code. Your friends never get your page history as a list, and they see nothing about pages they do not visit themselves.

A friend code is the whole secret of a friendship: anyone who has it can read what you share with that friend. PaperTrail shows it once and never sends it to the server.

Invites and what the operator can see

PaperTrail is invite-only. You create your account with a single-use invite code from the operator. The server stores the code only in scrambled (hashed) form, together with a short label the operator chose for the person it is for (for example a first name), when it was created, when it expires, and, once used, which account used it. That label links your random account id to a name the operator picked.

The operator manages PaperTrail on a password- and two-factor-protected admin page. For each account it shows:

• the first 8 characters of the account id;
• the day the account was created and the hour you last used PaperTrail;
• whether "Keep my data when I'm inactive" is on;
• how many visit records and other stored items (notes, reactions and pairing messages) there are (counts only, which the server cannot tell apart);
• the label of the invite you used.

The operator cannot see which pages you visited and cannot read your notes. Admin actions (logins, invites created with their label, invites revoked, accounts deleted with the first 8 characters of their id) are kept in an audit log for 180 days. Revoked invites and expired unused invites are deleted 30 days after they were revoked or expired; a used invite is deleted 30 days after its account is deleted.

Where your data is stored

• The PaperTrail server runs on Fly.io in its Frankfurt, Germany region.
• Its database is Neon Postgres, hosted on Amazon Web Services in Frankfurt, Germany (eu-central-1).

Both are processors acting on our behalf, and your data is stored in the European Union. Both companies are based in the United States.

How long things are kept

On the server:

• Visits: 30 days after they were recorded, then deleted automatically.
• Notes, reactions, clues and hellos: until you delete them, remove the friend they were left for, delete your account, or your account expires. They do not expire on their own.
• Your account: an account that has not been used for 180 days is deleted together with all its visits, notes, reactions, clues and hellos. "Used" means the extension contacted the server with your token. The server checks for such accounts every 10 minutes.
• Keep my data when I'm inactive: if you turn this on (Privacy, Account), your account is never deleted for inactivity. If you then uninstall the extension without deleting your account first, your notes and account stay on the server indefinitely, because no one has your token (the key to your account) any more, so no one can delete them.
• Live Ping codes and rate-limit counters: in the server's memory only, while needed.

On your device:

• Page history: 30 days, at most 5,000 entries. Remembered clues: 30 days, at most 200.
• Everything else: until you remove it, delete your account, or uninstall the extension.

Backups

The database provider keeps point-in-time backups. Data you delete, or that expires, can remain in those backups for up to 6 hours before it is gone for good. Backups are only used to restore the service after a failure.

How to delete your data

• Delete one note, reaction or clue: on the page, open the note or clue and choose Delete (for a reaction, use its remove button), or use Delete next to it in the popup's Notes tab. Every copy (one per friend) is deleted from the server for good. If the server cannot be reached, PaperTrail hides it and keeps trying.
• Remove a friend (Friends, Remove): PaperTrail asks the server to delete your visits and your notes, reactions and clues under that friendship's codes, for every page in your local history and every page in your notes index, plus your hello. Then it deletes the friend and their key from your device. Visits on pages that are no longer in your local history are not found this way and expire within 30 days. Your friend keeps their own posts and key until they remove you.
• Delete my account (Privacy, Account, Delete my account; you type DELETE to confirm): the server deletes your account and every visit, note, reaction, clue and hello you ever stored, for every friend, at once. Then PaperTrail erases everything it stored on this device. This cannot be undone.
• Turn PaperTrail off (Privacy, Turn PaperTrail off): recording, footprint lookups and Live Ping stop at once. Your friends, keys and stickers stay on the device, and what is already on the server stays until it expires or you delete it. If an invite is still waiting for your friend's reply, PaperTrail keeps checking for that reply (and sends that friend your hello once) until the friend is paired or removed.
• Uninstalling removes everything PaperTrail stored on your device, including all keys and your token, but it does not delete anything on the server. Visits then expire within 30 days, and the rest is deleted when the account expires after 180 days, unless you turned on "Keep my data when I'm inactive". To remove everything, use Delete my account before you uninstall.

Logs

The server writes one line per request with the time (to the second), the method, the route pattern (such as /v1/visits/:id, never the actual address requested), the response status and how long it took, plus lines about the server starting, stopping and errors (only the type and code of the error). Logs never contain page addresses, codes, tokens, account ids, IP addresses, request bodies or error messages.

What PaperTrail does not do

• It does not sell, rent or share your data, and it shows no ads.
• It does not use your data for anything except showing you and your friends each other's footprints, notes and Paths Crossed.
• It contains no analytics, crash reporting or third-party trackers, and loads no code from outside the extension.
• It does not run in incognito or private windows.

Legal bases

We process your data under these legal bases of the GDPR:

• To provide the service you asked for (Article 6(1)(b)): storing your account, visits, notes and settings, and showing them to the friends you paired with. PaperTrail records nothing until you turn it on after reading what it does.
• Our legitimate interest in running a safe and reliable service (Article 6(1)(f)): using network addresses in memory to limit abuse, keeping the logs described above, keeping backups, and deleting accounts that are no longer used.

What PaperTrail stores on your device is necessary to provide the service you asked for.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. You can stop PaperTrail at any time by turning it off or deleting your account. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

Most of these you can exercise yourself in the extension: delete notes, remove friends, turn PaperTrail off, or delete your account. Your page history and the readable text of your notes exist only on your device and your friends' devices; the server holds only what "What the server receives" lists, and cannot read the encrypted parts. For anything else, write to janis@bubbly.games. Because PaperTrail does not know who you are, we can only act on a server account if you can show that it is yours (the account id and token are in your browser's extension storage).

Children

PaperTrail is not meant for children under 16. We do not ask for anyone's age, name or contact details.

This website

papertrail.bubbly.games is a static website served by the same PaperTrail server, on Fly.io in Frankfurt, Germany. It sets no cookies, runs no scripts and loads nothing from other sites. Your network (IP) address reaches the server with each request, as with any website, but is not stored: the server's log records only the time, the kind of request, its result and how long it took, never which page you opened and never your address.

Changes to this policy

When PaperTrail changes what it stores or sends, we update this policy before the new version of the extension is released, publish it at https://papertrail.bubbly.games/privacy and change the date at the top.

Contact

Janis Bögershausen, Hannoversche Straße 62B, 30629 Hannover, Germany, janis@bubbly.games