Privacy policy

This notice covers the Paperwhales website, accounts, shared city, creation tools and connected posting features. The service is provided by Paperwhales (Independent Developer), represented by Earthia One and based in Cantabria, Spain, who acts as the data controller for this service. Privacy requests and questions go to Paperwhales888@gmail.com; Contact & reporting lists all official channels.

Account services process your email, authentication identifiers and profile information supplied through email or social sign-in. The service also processes display names, guest identifiers, preferences, prompts, lyrics, messages, creations, tower records, reactions and queue activity that you provide or generate.

Multiplayer features exchange presence and movement information. Service infrastructure can process IP addresses, request details, security logs and error diagnostics. Local settings, drafts, saved clips and crash diagnostics may be stored in your browser. Recordings or staged upload pieces are processed when you use recording and posting features.

We process information to provide requested accounts and creation services, preserve drafts, operate multiplayer and radio, manage uploads, prevent abuse, investigate faults and answer requests. Where applicable, providing a requested service relies on contract necessity; proportionate security and service maintenance rely on legitimate interests; legally required processing relies on legal obligations.

Camera and face tracking features are in early development and not fully working yet. Optional camera and microphone access uses separate permission controls. Where consent is the applicable legal basis, you can withdraw it for future processing. Browser permission alone is not a substitute for any consent required by law. Non-essential tracking, if introduced, needs an appropriate notice and any required consent before it runs.

Public creations, tower writing, chosen display names and shared-city interactions may be visible to other players and appear in live broadcasts. Finished music may appear on Paperwhales radio, YouTube, other live channels and archives as explained in Music rights.

Unfinished song progress and posting queues are restricted to the relevant player and authorized administrators for support and moderation. Do not include secrets or sensitive personal information in prompts or public content. Camera and microphone sharing use separate controls; avoid capturing other people without appropriate permission.

Prompts, selected source material and related creation instructions are sent to contracted AI processing services to produce writing or music. Only submit material you are comfortable sending for that processing. AI services are not confidential professional advisers; do not put passwords, payment details, medical records or another person's private information into a prompt.

Hosting, authentication, storage, security and AI vendors process data needed for their services. Authorized administrators may access restricted records for operational support, safety and rights complaints. We may disclose information when lawfully required or necessary to protect users and the service. This notice does not promise that provider processing occurs in a particular country or that every vendor excludes training use; request current recipient and processing details through the contact channels.

Data may be processed outside your country. Where GDPR or similar rules apply, any restricted transfer requires an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses. Ask for applicable transfer details and safeguards.

Connected posting and live features use YouTube API Services. A channel connection can store authorization tokens, channel identifiers and permissions needed to upload or manage authorized broadcasts; posting records include titles, descriptions, scheduling, video identifiers, errors and public statistics. Connecting the city channel is an authorized administrative feature, not permission to access every player's Google account.

YouTube's Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (https://policies.google.com/privacy) apply to their services. You can revoke access through Google account permissions at https://myaccount.google.com/permissions and request removal of associated stored authorization data. Revocation stops future authorized access but does not itself delete videos already published.

Retention depends on the record: account records support the account, public creations support the city and archives, and logs and upload pieces support security, troubleshooting and completion. Data should be kept no longer than necessary for the stated purpose or applicable legal obligations. Exact category-specific retention periods have not yet been confirmed; request details before submitting material requiring a guaranteed deletion date.

Access restrictions and account-scoped records help protect private information, but no online service can guarantee absolute security. Browser storage can be cleared by you or by your device and is not a guaranteed backup. Deletion requests are assessed alongside legal requirements, rights claims, archives and backup constraints.

Depending on your location, you may request access, correction, erasure, restriction, portability or object to certain processing. You may withdraw consent where processing relies on it and complain to your local data-protection authority. We may reasonably verify your identity without collecting unnecessary information. Where GDPR applies, requests are normally answered within one month, subject to lawful extensions.

Use Contact & reporting to request private handling of a privacy or account-removal request. Do not publish identity documents or credentials in a social comment. Public recipients and third-party platforms control their own copies; we cannot guarantee erasure of independent copies, but will act on our own lawful obligations.