The short version: your paper wallet, trades and journal stay in your browser's local storage. The extension never sends your record by default. If you turn on Tournament sync when joining a tournament, it sends the same verified trade chain to our server while you hold a live seat. To price the coins you trade, the extension asks public price services and our own price service for quotes. Our server logs the requests it receives and keeps those logs for up to 7 days to find bugs and abuse. The website uses cookieless Cloudflare Web Analytics.
What the extension stores, and where
Your paper wallet, settings, trade journal, session replays, verification chain, X-Ray ledger, and (if you enable them) capture frames and screen recordings are kept in chrome.storage.local - local storage inside your Chrome profile. Nothing is submitted by default. Tournament sync sends only the verified chain after you explicitly turn it on when joining. Using the extension for paper trading still requires no account and no sign-up.
API keys you add (AI coach, Forge) are stored locally and sent only to the endpoint you configured.
Network requests the extension makes
Every network call the extension can make, exhaustively.
Automatically, while you are on a supported trading page:
- Our price service (
papertrench-api.onerobby.workers.dev, since v3.22) - the extension sends the token addresses on the page and their chain, and gets back quotes. It is used as an independent second price for your fills, and prices the fill itself when no other source can. It sends no account, no cookies, no wallet or trade data - but like any web request it reaches our server from your IP address, and it tells us which tokens were looked up. - Public price APIs (Dexscreener, Jupiter) - to price the coins you trade.
- Solana RPC - public endpoints (publicnode, Solana Labs, Tatum) for on-chain prices, or your own RPC if you set one.
- The venue's own public APIs, on that venue's pages only - Hyperliquid for perps quotes; Polymarket, Kalshi and Limitless for prediction-market quotes.
Periodically:
- Update check - a plain request to GitHub's releases API (
api.github.com) up to twice a day, so you hear about fixes. On by default; switch off Check for new versions in the dashboard.
Only when you use the feature:
- Daily Spark - fetches the day's puzzle from our server; grading sends the puzzle day, its token address and your moves, with no account attached.
- Tournament sync - only after you turn it on when joining a tournament. While you hold a live seat, the extension sends your verified trade record to our server every few minutes and after each cut, using a token scoped to sync only. The plaintext is returned once and the server stores only its SHA-256 hash. The token stays in local extension storage, is not in wallet backups or debug reports, and expires after 30 days. The dashboard removes the local grant; the tournament page revokes server tokens and the local grant. Sync requests omit cookies.
- Leaderboard tab - after you link an X account and switch on Site sync, the dashboard reads the public standings from our server. No account or cookie is sent.
- AI coach and Forge - prompts go only to the endpoint you configured, with your own key.
- X's public oEmbed endpoint (hover preview cards, opt-in) - called with
dnt=1, no cookies and no login, only for post links you hover on a trading site.
Price, puzzle and leaderboard-read requests do not carry your journal or trade history. A manual leaderboard submission or opted-in Tournament sync does carry the committed fill chain so the server can verify it; it does not carry journal text, theses, replays or recordings.
What our server logs
Our API runs on Cloudflare Workers with logging switched on. Each request it receives - price lookups from the extension, Daily Spark, and everything the website sends - is logged with its time, the request URL (for a price lookup, that includes the token addresses and chain), the response, and the metadata Cloudflare attaches to requests, which can include your IP address and approximate location. We use these logs to find and fix bugs and to stop abuse. They are kept for up to 7 days, are not sold or shared, and are not used for advertising.
The website
papertrench.com uses Cloudflare Web Analytics, which counts page views without cookies or cross-site tracking (it sees things like the page, referrer, browser type and country). Signing in with X sets one session cookie, used only to keep you signed in.
The leaderboard and tournament sync (optional)
papertrench.com offers public standings recomputed from verified chains. Manual leaderboard submission and automatic tournament sync are separate opt-ins:
- Manual leaderboard submission: upload the file exported from the dashboard, or click Sync on the leaderboard page. Sync asks the extension for your record; it answers only if you enabled Site sync in the dashboard, only for papertrench.com. This manual path is never initiated by the extension.
- Tournament sync: after you choose Turn on auto-sync when joining a tournament, the extension holds a 30-day token scoped only to syncing. While you hold a live seat it asks our server which seats are active and sends the same verified chain every few minutes and after each round boundary. Requests omit cookies. Turn sync off in the dashboard to remove the local grant, or on the tournament page to revoke the server tokens and local grant.
- What a submission contains: your committed fill chain (token mints, sides, quantities, prices, timestamps, hashes), your declared starting bankroll, and your claimed summary stats. That is the whole payload — no journal text, theses, replays, recordings or browsing data.
- Signing in uses X (Twitter) OAuth. We store your X account id, handle, display name and avatar URL — nothing else from your X account, and no posting rights are requested.
- What becomes public: your current handle and avatar, verification status, and statistics derived from submitted chains. Frozen tournament cut records contain user IDs and verified figures, not frozen handles; a deleted account is shown as deleted trader and the settled standings hash remains unchanged.
- Deletion is self-serve: “delete my data” on the leaderboard page revokes your sync tokens and removes your account, record, submissions, sprint history, and tournament seats and current entries. Settled tournament hashes remain as ID-only evidence; your local wallet is not changed.
Streamer applications
If you apply to the streamer roster, we store what the form asks for: channel name and URL, platform, Discord handle, audience size bucket, the blurb you agree to publish, your private note to moderators, and how and when to reach you, plus a salted hash of your IP address for abuse triage. Only moderators can read an application. Once approved, only your channel name, channel link and blurb are shown publicly.
The X-Ray and Instant X features
Both are opt-in and off by default. X-Ray builds its account-intel card from data the X page itself already loaded in your browser session; what it keeps is a local digest (account field snapshots, post ids and dates, contract addresses), stored on your machine. Raw post text never leaves the page context, and nothing is sent anywhere. Instant X links keep a muted background viewer tab and route your own clicks into it; they read nothing from your X session and send nothing anywhere. The full technical description is in the public permissions audit.
What we collect about you
From the extension: the requests listed above, and the server logs they leave behind - never your wallet, journal or trades. From the website: cookieless analytics, the server logs, and what you submit to the leaderboard or the streamer form. We do not sell or share any of it, and there is no advertising.
Deleting your data
Local data is yours and stays local: removing the extension deletes everything it stored, and you can export or reset from the dashboard at any time. Leaderboard data (if you ever submitted) is removed with the "delete my data" control on the leaderboard page.
Changes to this policy
If a future version changes any of the above, this page will say so before that version ships, and the change will be visible in the open-source history like everything else.
September 22, 2026: added our price service (in use since v3.22.0 on September 10), the update check, Daily Spark, venue APIs, server request logs, the website's cookieless analytics, and streamer applications. The previous version of this page said the extension never contacts our server; that stopped being true with v3.22.0.
September 23, 2026: documented Tournament sync, an optional join-time grant that sends the verified chain while you hold a live seat. The manual leaderboard Sync remains separately opt-in.
Contact
Questions: open an issue on GitHub.