Legal information
Privacy policy
This policy describes the processing of personal data carried out on the PAPER CRIME website, in accordance with Regulation (EU) 2016/679 of 27 April 2016 and the French Data Protection Act of 6 January 1978 as amended. It applies to every page of the site and to the features of the investigation companion.
1. Data controller
The data controller is the publisher of the site, whose identity and contact details appear in the legal notice. Any request concerning personal data may be addressed to contact@papercrime.com.
2. Data processed, purposes and legal bases
Playing without an account. Reading progress — the moment of the timeline reached, the file checks performed, the hints consulted and the results obtained — is stored in the browser's local storage. A technical cookie holds the same progress server-side, for the sole purpose of checking that a requested hint matches the declared progress. Legal basis: the controller's legitimate interest in providing the service requested.
Creating an account. An email address, a technical identifier, creation and sign-in dates, along with the related progress and results, are processed. Purposes: authentication, synchronising progress between devices, keeping results. Legal basis: performance of the service you subscribe to.
Messages sent through the contact form. The name and email address provided, the subject and the content of the message are processed. Purpose: handling and following up on the request. Legal basis: legitimate interest in answering the messages received.
Audience measurement. The site uses an aggregated audience measurement solution covering the pages viewed and traffic sources. It sets no advertising cookie, performs no cross-site tracking and receives neither email address, nor progress, nor result. Legal basis: legitimate interest in measuring the audience of the site.
Release alert. The “Notify me” form of an upcoming case processes the email address entered and the case concerned. The address is only recorded after a click on the confirmation link sent to it (double opt-in). Purpose: announcing the release of the case in a single message. Legal basis: consent, which can be withdrawn at any time through the unsubscribe link included in every message or by writing to us.
No automated decision-making and no profiling are carried out. Apart from the release alert requested and confirmed by the reader, no commercial prospecting is carried out. Data is neither sold nor rented to third parties.
3. Recipients
Data is intended for the publisher and, strictly as required to operate the service, for its technical providers acting as processors within the meaning of Article 28 GDPR: hosting of the site, hosting of the application database and delivery of email. Account and progress data is hosted within the European Union. Where a transfer outside the European Union is necessary, it is governed by the standard contractual clauses adopted by the European Commission.
4. Retention periods
Progress stored without an account: kept in the browser until the reader clears it; the related technical cookie expires twelve months after it is set at the latest. Account data and related progress: kept for the lifetime of the account, then deleted within thirty days of its closure. An account inactive for three consecutive years is deleted after prior notice. Contact requests: kept for twelve months after the reply. Release alert: address kept until unsubscription, and at the latest twelve months after the release of the case concerned; an unconfirmed request is not kept. Audience measurement: aggregated data only, with no individual records kept.
5. Cookies
Only cookies strictly necessary to the service are set: the progress cookie described in section 2; a language preference cookie, which remembers the language of the site last viewed, valid for twelve months; and, for readers with an account, the session cookies that keep them signed in. As these cookies are exempt from prior consent, none is requested. A few interface flags with no personal data (for example, a message already shown) are kept in the browser's local storage. No advertising or social network cookie is used.
6. Security
Exchanges with the site are encrypted using TLS. Access to data is limited to authorised persons, and the providers selected offer appropriate guarantees in terms of security and confidentiality.
7. Your rights
Data subjects have the right of access, rectification, erasure, restriction of processing, objection and portability, as well as the right to give instructions concerning the fate of their data after their death. The My account area shows the progress recorded; progress kept without an account can be erased at any time by clearing the site data in the browser. Any request for access, rectification or erasure of account data should be sent to contact@papercrime.com and is handled within the one-month period set out in Article 12 GDPR. Data subjects also have the right to lodge a complaint with the competent supervisory authority.
8. Minors
The service is not aimed at children under the age of fifteen. No data concerning them is knowingly collected without the authorisation of the holder of parental responsibility.
9. Changes
This policy may be amended to reflect changes to the service or to the regulatory framework. Any substantial change is announced on this page. Last updated: 11 September 2026.