Privacy

This explains what happens to your information if you offer us a swap, or sign up to follow the challenge. It is written to be read rather than skimmed past.

Who is responsible

Tom Barltrop, who runs this challenge as an individual, is the data controller. Contact: hello@paperclipchallenge.ai. That address reaches a real person and is the right place for anything in this notice.

If you offer us a swap

We ask for:

• your name
• your telephone number
• your email address
• the outward part of your postcode — E8, not E8 3RT — so we can work out what it would cost to come and meet you
• a description of what you are offering, and photographs where it is a physical thing
• anything else you choose to tell us in a free-text box

We ask for your full address only if a meeting is actually being arranged, and not before.

We ask for a telephone number only once the AI has accepted an offer, not when you send one. We ring you before any swap is agreed, and that call is the main thing standing between this challenge and someone being defrauded, in either direction — but it belongs to the meeting, not to telling us about something in a cupboard. Until then, email is enough.

If you sign up to follow along

We store your email address and nothing else — no name, no preferences, and no tracking of what you open or click. Nothing is ever sent to an address that has not confirmed it wants to hear from us, and every message we send carries a one-click unsubscribe. You can leave at any time and we delete the record rather than flagging it.

Why we use it

To evaluate your offer, to reply to you about it, to meet you if a swap goes ahead, and to keep an honest record of the experiment. For the email list, our basis is your consent, which you can withdraw whenever you like.

How your offer is assessed

An AI decides which swaps to recommend. The text and photographs you send are processed by Anthropic’s Claude to do that; Anthropic acts on our instructions and does not use your information for anything of its own.

No swap happens on a machine’s say-so. A person reads every recommendation, a person rings you before anything is agreed, and a person inspects the item face to face before it changes hands. Any of those can stop a swap, and when one does, the reason is published. So the decision is not a solely automated one — and a decision about whether to swap a second-hand object has no legal effect on you and nothing similarly significant.

Meeting in person

We record your name for every completed swap. Where the item is worth more than £500 we also ask to see photographic identification at the handover. It is looked at and noted. No copy is taken, no photograph of it is kept, and no number from it is recorded.

What gets published

Your email address, your telephone number and your full address are neverpublished.

If a swap with you completes, we would like to name you in the record — that record is the point of the whole thing, and it is a list of people rather than a list of objects. But each detail is agreed separately, we ask again before publishing anything, and a box ticked weeks earlier is never the last word. Saying no costs you nothing and changes nothing about the swap.

If we decline your offer, we publish that it was declined and one of a short list of neutral reasons — that it did not meet the minimum requirements, that it was outside what we can accept, that another offer was taken, or that we could not value it on the evidence available. We never publish your name alongside a declined offer, and we never publish a view about you. Our own record says what was claimed, what was observed and what followed. It does not hold conclusions about anybody’s honesty or intentions.

We publish monthly totals of how many messages arrived and how many were evaluated. Those are counts, with nothing in them that identifies anyone.

What we log

Every message reaching our form and our mail systems is logged with the time it arrived, before the AI sees it. That exists so nobody can claim we quietly dropped offers we did not fancy. It means we hold a record of your message even if nothing comes of it.

Who else can see it

The database and the file storage are Supabase, hosted in the United Kingdom. The website is hosted by Vercel. Email routing is Cloudflare. Offer content is processed by Anthropic as described above. All of them act on our instructions. We do not sell your information and we do not share it for marketing.

How long we keep it

We keep what you send us for 36 months. The challenge has no fixed end date and its record has to stay checkable throughout, which is why the period is measured in years.

After that, your name, contact details and location are deleted. A record of what was offered and how it was assessed remains, because removing it would falsify the experiment’s record — but it no longer identifies you.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. Email hello@paperclipchallenge.ai. You do not need to give a reason, and asking will never affect how your offer is treated.

We will reply within one month. If we cannot do what you have asked, we will say why.

If you are unhappy

Tell us first, at hello@paperclipchallenge.ai. We will acknowledge a complaint within 30 days and deal with it as quickly as we can.

You can also complain to the Information Commissioner’s Office at ico.org.uk, and you do not have to come to us first.

Cookies and counting visits

The public site sets no cookies. The private admin area uses a sign-in cookie, which only the operator ever encounters. Emails we send you carry no open tracking and no click tracking — the links in them go where they say they go.

Since 18 September 2026 the public site counts page views, using Vercel Web Analytics. This is a change from version 1.0 of this notice, which said there was no analytics at all. We added it because we could not otherwise tell whether anyone was reaching the site, and we would rather say so than leave the old sentence standing.

What it records, for each page view: the time, the page, where you arrived from, your approximate location from your IP address, and what browser and kind of device you are using. What it does not do: set a cookie, store anything on your device, follow you to other websites, or keep anything that identifies you. Return visits are counted using a one-way hash of the request, which is discarded after 24 hours — so we can see that forty people visited, and never which forty.

Because nothing is stored on your device, this needs no cookie banner, and there is nothing here for you to consent to or withdraw. It is separate from the offer you send us: we cannot connect a page view to a person, including to you.

Changes

If this notice changes, the previous version stays available, in the same way the rules do. We will not quietly rewrite it.

Version 1.1, 18 September 2026. Page-view counting added, and the sentence promising no analytics at all withdrawn. The telephone number is no longer collected when an offer is sent — it is asked for only if the AI accepts, which is less of your data, not more. Version 1.0 of 14 September 2026 is retained.