How Paperlocks handles your data
Little is collected, and you can delete it.
Last changed 3 October 2026.
What we keep
Your email address or Saudi mobile number, used to send you a sign-in code and for nothing else. Your practice record: each answer you give, whether it was right, whether you said you were confident, how long it took, the questions you flagged, your badges, and any reply or problem report you write under a question. A short name for each device you sign in on, such as “iPhone, Safari”, so you can see your devices on the Account page.
What we do not keep
No password: you sign in with a code. No payment card: when payment arrives, the card is handled by a licensed Saudi payment gateway and never reaches us. No location, no contacts, no advertising identifiers. Your IP address is not stored with your account.
Before you sign in
You can practise as a guest. A random token in a cookie tells your device apart from others; it is stored only as a hash and holds nothing about you. Signing in later brings the guest’s progress with it.
What it is used for
To show you your own progress, to choose your next questions from what you have not answered or got wrong, and to award badges. The owner sees, in aggregate, which questions are answered right or wrong so the bank can be improved, and sees an account that answers faster than anyone could read or around the clock, since that is how a copied bank looks. Replies you write are read by a moderator before anyone else sees them. Nothing is sold or shared with advertisers.
Where it lives
On a server in Dammam, Saudi Arabia, in a database encrypted at rest. Sign-in emails are sent through Amazon’s email service and text messages through a Saudi provider; each sees only the address and the code. Backups are encrypted and kept by the owner.
Your controls
On the Account page you can see your devices, sign one out, sign out everywhere, and delete your account. Deleting removes your email or number, every answer, your progress, badges, replies and reports, at once and for good. A badge page you shared stops working when its account is deleted.
Sharing a badge
A badge page shows the badge, what it is for and the date, nothing about you. Post it or not; the choice is yours each time.
Questions
Write to the owner at the address shown on the home page once the site is public. An answer comes from a person.