Privacy Policy for Scrap Paper Party

Last Updated: 17 August 2026

Summary

Scrap Paper Party is a free browser party game. It has no accounts, no sign-up, and no database. We never ask for your email address, your real name, your phone number, your address, or any payment details.

Almost everything the game holds about you exists only in the server's memory while you are playing, and is gone the moment your party ends or the server restarts. Scrap Paper Party does not intentionally store gameplay data in a database or write it to disk. Our hosting provider runs its own infrastructure and keeps its own operational records, which we do not control — that is described under "Third Parties."

This summary is provided for convenience. The sections below are the policy.

Who We Are (Data Controller)

For the purposes of the General Data Protection Regulation (GDPR) and other data protection laws, the data controller for this Service is:

Hanna Qumsiyeh, an individual established in Budapest, Hungary, operating the website Scrap Paper Party at https://scrappaperparty.com/

Contact: support@scrappaperparty.com

Because we are established in the European Union, the GDPR applies to this Service directly. The data protection supervisory authority in Hungary is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Contact details are in "Your Rights Under GDPR" below, along with your right to complain to the supervisory authority in your own jurisdiction.

Scrap Paper Party is an independent hobby project. It is not a company, and it has no employees. Where this policy says "we," "us," or "our," it means the individual named above.

We have not appointed a Data Protection Officer, and we are not required to. Our processing is not large-scale, does not involve systematic monitoring, and does not involve special categories of data.

What This Policy Covers

This policy covers the website and game at https://scrappaperparty.com/ (the "Service"). It explains what information the Service handles, why, on what legal basis, who else can see it, and what rights you have.

It does not cover third-party websites we link to. See "Links to Other Sites."

Information We Collect

1. Display name

When you join a party you choose a display name (up to 16 characters). It is not verified, it is not tied to any account, and it does not need to be your real name — a nickname is fine and is what we expect. It is visible to the other players in your party. It is held in the server's memory while you are playing and is discarded when your party ends.

2. Gameplay content

While a round is running, the Service handles the things you create in the game: your drawings, your typed answers and guesses, your votes, and your score. This content is shown to the other players in your party as part of playing the game. It is held in the server's memory and is discarded when the party ends.

3. Chat messages

The game includes a party chat. Messages are limited to 200 characters. Up to 60 recent messages per party are kept in the server's memory so that somebody who joins or reconnects part-way through can see what was said. This means a message you send may be shown to a player who was not in the room at the time you sent it. All chat is discarded when the party ends.

4. IP address

Your IP address is used for one purpose only: to enforce a 15-second cooldown between feedback submissions, so the feedback form cannot be flooded.

Specifically, when you submit feedback, your IP address is used as a key in an in-memory list of recent submissions. Entries are cleared automatically, and no entry survives longer than about 75 seconds. Our own code does not write your IP address to disk, does not record it in any log we keep, and does not send it to Discord or any other third party.

Separately, our hosting provider necessarily receives and processes your IP address in order to deliver the website to you, and keeps its own operational and security records of that. This happens at the infrastructure level, is governed by the provider's own terms rather than ours, and is not something we control or have visibility into. See "Third Parties."

5. Feedback (optional)

If you choose to use the feedback form, we receive the message you write (up to 1,800 characters) together with the display name you were using at the time. If you have not set a name, it is submitted as "Anonymous player." The submission also carries the version of the game you were playing and the time it was sent.

The form displays a notice asking you not to include personal information, and we ask you not to. Please do not put your email address, your real name, or anyone else's details into the feedback box.

Unlike everything else described above, feedback does not disappear when your game ends: it is delivered to a private Discord channel where we read it. See "Third Parties" and "How Long We Keep Things."

6. Information stored in your browser

The Service stores four small items in your browser to remember your preferences between visits. They are not sent to our server and are not remotely accessible to us:

• scrapPaperName — the last display name you used, so the box is pre-filled next time
• scrapPaperRecent — the colours you recently used in the drawing tool, so your palette is where you left it
• scrapPaperScoresOpen — whether you had the scoreboard panel open or closed
• scrapPaperMuted — whether you turned the game's sound off

These are convenience settings, held on your device and used for nothing beyond the features they belong to. They are not identifiers, they are not used to recognise or track you, and none of them is required to play. You can clear them at any time through your browser's settings for site data, and the game will continue to work — you will simply be asked for a name again and start with the default palette and sound settings.

What We Do Not Collect

To be explicit, the Service does not collect or process any of the following:

• Email addresses, phone numbers, or postal addresses
• Real names, dates of birth, or age
• Payment or card details of any kind
• Location data. Your IP address is used only as described above; we do not geolocate it, and we do not use any location API
• Device information such as your operating system, browser fingerprint, or screen size
• Analytics or usage statistics. There is no analytics package of any kind on this site — no Google Analytics, no tracking pixels, no telemetry, no behavioural profiling

Cookies and Tracking

We do not set any cookies.

We do not use advertising, advertising networks, or tracking technologies of any kind, and we do not build profiles of users or share data with data brokers.

We do not track users at all, with or without a "Do Not Track" browser setting. Because we perform no tracking in the first place, there is nothing for a Do Not Track signal to switch off. Our behaviour is the same either way.

The only information stored on your device is the four local storage preferences listed above. They stay in your browser, are never transmitted to us, and are not used to identify or follow you.

Why We Process It, and Our Legal Basis

Under the GDPR we must tell you why we process your information and on what lawful basis. We do not process your information for any purpose other than those listed here.

1. Running a game

What we use: your display name, your gameplay content, your chat messages. Lawful basis: legitimate interests, Article 6(1)(f). Why: you asked to play a multiplayer game, and it cannot work without showing your play to the other people in your party and keeping score.

2. Preventing abuse and rate limiting

What we use: your IP address, for the feedback form. Lawful basis: legitimate interests, Article 6(1)(f). Why: to keep a free service usable and available to everyone by stopping the feedback form being flooded. A similar limit applies to chat — messages are throttled to no more than one every 400 milliseconds per player — but that one needs nothing about you beyond the fact that you just sent a message.

3. Keeping the game usable for mixed groups

What we use: your display name and chat messages. Lawful basis: legitimate interests, Article 6(1)(f). Why: the game is played by strangers of different ages, so offensive words in names and chat are filtered automatically.

4. Reading your feedback and using it to improve the game

What we use: your feedback message and the display name attached to it. Lawful basis: consent, Article 6(1)(a), given by choosing to send feedback. Why: to fix problems and develop the game. You are never required to send it, and you can withdraw your consent at any time.

5. Complying with the law

What we use: whatever a valid legal obligation requires. Lawful basis: legal obligation, Article 6(1)(c).

Where we rely on legitimate interests, we have considered your rights and freedoms. The processing is limited to what a multiplayer game needs in order to function, involves no profiling and no persistent identifier, and almost all of it is erased within minutes.

Where we rely on consent (feedback), that consent is given by choosing to press send, and it is genuinely optional: you can use every part of the game without ever opening the feedback form, and nothing is withheld from you for not using it. You may withdraw your consent afterwards by contacting us, and we will delete the message from our Discord channel. Withdrawing consent does not affect the lawfulness of the processing that happened before you withdrew it, and it has no effect on your ability to keep playing.

We do not carry out any automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Who Else Can See It

Other players. The whole point of the game is that other people see what you make. Your display name, drawings, answers, guesses, scores and chat messages are shown to the other players in your party — up to ten people. Treat anything you type or draw as public to that group. We cannot control what other players do with what they see, including taking screenshots.

Third Parties

We use the following third parties. We do not sell your personal information, and we do not share it with anyone for advertising or marketing.

We deliberately keep this list short. Every font, image, script and stylesheet the game needs is served from scrappaperparty.com itself. Loading a page does not cause your browser to contact any other company — there are no font CDNs, no script CDNs, no analytics, no tracking pixels, no embedded widgets and no third-party requests of any kind. The "Support the game" button is an ordinary link that navigates you to another site if you click it, not an embedded payment widget, so no request reaches Buy Me a Coffee unless you choose to go there.

Render (hosting) Our website and game server run on Render. There is a distinction worth being clear about here: Scrap Paper Party's own code does not store gameplay data, but Render operates the infrastructure underneath it and processes personal data in its own right in order to run and secure the service. Its data processing agreement describes receiving, holding, using, sharing and logging personal data for those purposes. In practice this means Render receives and processes network and request information, including your IP address, and maintains its own operational logs and service records. Render acts as our processor, and what it retains is determined by its documentation rather than by us. Render is based in the United States. Privacy policy: https://render.com/privacy Data processing agreement: https://render.com/dpa

Namecheap (domain registration and DNS) The scrappaperparty.com domain is registered through Namecheap, which provides DNS resolution for it. Namecheap processes DNS queries in order to point the domain at our server. Privacy policy: https://www.namecheap.com/legal/general/privacy-policy/

Discord (feedback delivery) Feedback submitted through the feedback form is transmitted to Discord using a webhook, and appears in a private channel that only we can read. Discord is a separate service, not part of Scrap Paper Party — we do not operate it and it is not a store we control. Once your message arrives there it is held by Discord and handled under Discord's own policies, which cover the content users create and how Discord processes and retains it. Discord is based in the United States. Privacy policy: https://discord.com/privacy

International Transfers

We are established in Hungary, so the GDPR applies to this Service directly. Some of the infrastructure we rely on is based in the United States, which means two transfers outside the EEA:

• Your IP address reaches our hosting provider, Render, because it has to in order to deliver the site to you.
• Any feedback you choose to send reaches Discord, because that is where it is delivered for us to read.

Nothing else leaves the EEA. In particular, simply loading and playing the game sends nothing to any third party at all: our fonts and every other asset are served from our own domain, so no other company learns that you visited.

Both providers are based in the United States, so data reaching them may be processed outside the EEA. Each sets out its own transfer terms in its own documentation: Render's data processing agreement contains its transfer provisions, and Discord's privacy policy contains its international transfer information. Those documents, linked above, are the accurate and current statement of the mechanism each provider relies on — we would rather point you to them than paraphrase them here, because the arrangements change and theirs is the version that governs.

If you would rather not send feedback to Discord, simply do not use the feedback form — you can email us at support@scrappaperparty.com instead, and nothing about playing the game requires it.

How Long We Keep Things

We keep things for the shortest time that works, and for most of what the game handles that is measured in minutes.

• Display name, drawings, answers, guesses, scores and chat messages: held in the server's memory during play, and erased when the party ends or the server restarts. Chat keeps at most the 60 most recent messages in a party, so that somebody joining or reconnecting can see what was said. None of it is written to a database or to disk by us.

• A dropped player's seat and score: held for 30 seconds so that a lost connection can be recovered, then erased.

• IP address, for the feedback rate limit: held in the server's memory for at most about 75 seconds, then erased automatically. Not written to disk by us.

• Feedback messages: transmitted to Discord and held there for as long as they remain useful for improving the game. We delete them on request, and Discord's own retention practices apply to its copy.

• The four local storage preferences: kept in your browser, on your device, until you clear your site data. We cannot delete these for you, and we cannot read them.

• Records kept by our hosting provider: controlled by Render, not by us, and governed by its retention practices rather than this policy.

There is no database behind this Service, and Scrap Paper Party does not intentionally persist gameplay data to a database or to disk. When the server restarts — which happens routinely, because we run on a free hosting tier that sleeps when idle — everything held in memory, including any game in progress, is gone. We could not produce your old game if you asked us to, because it does not exist anywhere.

That statement is about our application. It is not a claim about our hosting provider's infrastructure, whose logging and retention are its own and described in its documentation.

Data Security

The Service is served over HTTPS, so traffic between your device and our server is encrypted in transit.

The strongest protection here is structural rather than technical: we hold almost nothing. There is no database, no user accounts, no passwords, and no payment details. Gameplay data exists only in volatile memory and for minutes at a time, so there is no store of historical personal data to be breached.

The secret used to deliver feedback to Discord is held as a server environment variable and is never sent to a browser.

No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. If a breach occurred that was likely to result in a risk to your rights and freedoms, we would notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and notify affected users where required.

Children's Privacy

This section is written plainly, because it should be understandable by the people it is about.

Scrap Paper Party is made for a general audience. We do not market it to children and we do not target children in how we promote it. If that ever changes, this section changes with it — it is a description of what we actually do, not a disclaimer.

We do not ask your age. We do not collect a date of birth, we have no accounts, and we have no way to verify how old anyone is. We are telling you this rather than putting up an age box that anybody could click through, because a box like that would prove nothing and would only make this policy less honest.

1. What this means for children

Children get the same protections everyone gets here, and those protections come mainly from how little the game holds: no account, no email address, no password, no persistent record of any player, and gameplay data that is erased within minutes of a party ending.

The rule that matters most is the one we ask of every player, child or not: do not type or draw personal information about yourself or anybody else. Not your full name, not your school, not your address, not your phone number, not your email. The game never needs any of it. A nickname is all it asks for. Anything you put into a drawing, a chat message, a display name or the feedback form is seen by the other people in your party, and we cannot take it back out of their memory or their screenshots.

2. About parental consent, accurately

There is a rule in European data protection law — Article 8 of the GDPR — that comes up in policies like this one, and it is often stated in a way that is misleading. It is worth being precise.

Article 8 applies where an online service processes a child's data on the basis of consent. In that situation the child must be old enough to give that consent themselves, or a parent or guardian must authorise it. The GDPR's default age is 16, and individual countries are allowed to lower it, but not below 13. Hungary, where we are established, has not lowered it, so the age that applies to us is 16.

Here is the part usually left out. Playing the game is not based on consent. As set out under "Why We Process It, and Our Legal Basis," running a round for you rests on legitimate interests, not on consent — so Article 8's parental-authorisation rule does not turn playing into something every child under 16 is forbidden from doing. Article 8 is tied specifically to consent, and we do not use consent as the basis for gameplay.

Where we do rely on consent is the feedback form, which is entirely optional. For that feature the child-consent requirements above are the ones we consider, and a child below the applicable age should have a parent or guardian's permission before sending feedback. Nobody has to use the form. The game is complete without it, and choosing not to send feedback costs you nothing.

3. If you are a parent or guardian

If you believe a child has submitted personal information through the Service — realistically, identifying details typed into a display name, a chat message or the feedback form — email us at support@scrappaperparty.com and ask us to delete it. We will. If it was gameplay or chat, it has almost certainly been erased already; if it was feedback, it is in our Discord channel and we can remove it. You are welcome to ask us either way, and we would rather hear from you than not.

Your Rights Under GDPR (EEA and UK Users)

If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal data:

• Right of access — to ask for a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate data corrected or incomplete data completed.
• Right to erasure ("right to be forgotten") — to ask us to delete your data.
• Right to restrict processing — to ask us to limit how we use your data.
• Right to data portability — to receive data you provided in a structured, commonly used, machine-readable format, or have it sent to another controller.
• Right to object — to object to processing based on legitimate interests, on grounds relating to your particular situation.
• Right to withdraw consent — where we rely on your consent, to withdraw it at any time. This applies to feedback you have sent us.
• Right to lodge a complaint — to complain to a data protection supervisory authority. You may complain to the authority in the country where you live or work, or where you believe an infringement occurred; the full list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK it is the Information Commissioner's Office, https://ico.org.uk/make-a-complaint/.

Because we are established in Hungary, you may also complain to the Hungarian supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary Website: https://naih.hu/ Email: ugyfelszolgalat@naih.hu

You are welcome to raise the matter with us first, but you are not required to.

A practical note on exercising these rights. Because the Service has no accounts and keeps no records, in most cases there is nothing of yours for us to find: by the time you contact us, your gameplay data has already been erased, and your IP address stopped existing in our memory within about a minute of your using the feedback form. That is a deliberate design choice, and it means most requests can be answered honestly with "we no longer hold anything about you."

The realistic exception is feedback you have sent, which sits in our Discord channel. To have it removed, email us with enough detail to identify the message — the display name you used and roughly when you sent it — and we will delete it.

We may need to ask you for information to confirm which data is yours. We will respond within one month, as required by GDPR Article 12(3). If a request is particularly complex we may extend this by a further two months, and will tell you if so. Exercising these rights is free.

Your Rights Under California Law

CalOPPA

In accordance with the California Online Privacy Protection Act:

• You can visit and read this site without giving any information at all. To play a game you need only choose a display name, which need not be — and should not be — your real name. No account or email address is required.
• Our Privacy Policy link contains the word "Privacy" and is reachable from the footer at the bottom of every screen, as well as from the site's information panel.
• We will notify users of changes to this policy by posting the revised policy on this page and updating the "Last Updated" date at the top.
• Because we hold no persistent record of any user, there is no stored profile to review or correct. If you have sent feedback and want it changed or removed, contact us at support@scrappaperparty.com.
• We do not honour Do Not Track signals in any special way, because we do not track users at all — with or without such a signal, we behave identically.

CCPA/CPRA

Scrap Paper Party is free to play. It charges nothing and sells nothing. It does accept voluntary donations through Buy Me a Coffee, so it is not accurate to say the project has no income at all — but donations are gifts, not sales, and they are not income derived from anybody's personal information.

The California Consumer Privacy Act, as amended by the CPRA, applies to an entity that meets one of a set of thresholds: an annual gross revenue figure that is adjusted for inflation, buying or selling or sharing the personal information of 100,000 or more California consumers or households in a year, or deriving 50% or more of its annual revenue from selling or sharing personal information. On our present scale we do not meet any of them — the donation income is far below the revenue threshold, we are nowhere near 100,000 California consumers, and we derive none of our revenue from personal information, because we do not sell or share it at all. We therefore do not believe the Act currently applies to us. That is our assessment of our current position rather than a permanent legal conclusion, and if the project's scale changes we will reassess it.

Independently of whether the Act applies: we do not sell your personal information, we do not share it for cross-context behavioural advertising, and we never have. There is no financial incentive attached to any data described in this policy. If you are a California resident and want to make a request about your information, contact us and we will treat it in the same way as the requests described in the section above.

Links to Other Sites

The "Support the game" button is a link, not a payment form. Nothing about paying happens on our site: there is no embedded checkout, no payment widget and no donation field anywhere in Scrap Paper Party. Clicking the button takes you to our page on Buy Me a Coffee (buymeacoffee.com), a separate service operated by a separate company, and everything after that point happens there rather than here.

If you choose to donate, any name, email address, card or billing details you enter are collected and handled by Buy Me a Coffee and its payment processor under their policies. Scrap Paper Party does not receive your card or payment details at any point, and has no access to them. We cannot see them, store them, or refund a payment, because the transaction never touches our server.

We are not responsible for the content or privacy practices of any third-party site, and we recommend reading the privacy policy of any site you visit. Buy Me a Coffee's is at https://buymeacoffee.com/privacy-policy.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last Updated" date at the top. Where a change is significant, we will make a reasonable effort to draw attention to it in the game itself.

Changes take effect when posted. We encourage you to review this page from time to time.

Contact Us

For any question about this policy, or to exercise any of the rights described in it:

• By email: support@scrappaperparty.com
• Through the feedback button in the game, though please remember that feedback is delivered to Discord and is not a private channel for personal data

This document describes the actual behaviour of the Scrap Paper Party software as built. It is provided for information and does not constitute legal advice. Laws differ by country and change over time; if you need certainty, consult a qualified lawyer in your jurisdiction.