This policy explains what information the Mahjong Versus iPhone app ("the app") and the mahjongversus.com website ("the site") collect, why, who we share it with, how long we keep it, and the rights you have. The short version: we collect what the game needs to work, plus product analytics and crash reports that help us fix it. We don't run ads, we don't track you across other companies' apps or websites, and we never sell your data.
Who we are
Mahjong Versus is operated by Climbing Cat LLC ("we", "us"), the controller of the personal information described here. Contact us about anything in this policy at mahjongversus@gmail.com.
Information we collect
Your account
- Sign-in identifier. If you play as a guest, the app creates a random device identifier, keeps it in your device's Keychain (so it survives reinstalling the app) and uses it to sign you in. If you use Sign in with Apple, we receive an identifier from Apple instead. We never receive your Apple ID password.
- Email address, only if you share it. Sign in with Apple lets you share your email or hide it; hiding it gives us an Apple private relay address rather than your real one. We keep whichever we receive for one purpose: confirming your identity if you contact us about your account. We don't send marketing email. Guests give us no email at all.
- Game account number. Our servers assign every account a random number. It is not your Apple identifier, email or device identifier.
- Profile. Your username, chosen avatar, and in-app preferences (for example sounds, haptics, notification choices).
Playing the game
- Gameplay records. Match results and history, the moves made in online matches (kept so games can be run, checked for fairness and recovered after a crash), results of practice hands you play against bots on your device, experience points, levels, achievements, missions and daily-reward streaks.
- Time zone offset. Your device's offset from UTC, so daily rewards and reminders reset at your local midnight. We do not collect your precise location (see Analytics below for the approximate location derived from your IP address).
- Friends. Your friend code, friend list, friend requests and room invitations.
- Reports and blocks. If you report or block a player, we keep who reported or blocked whom, the reason chosen, and the match it happened in.
- Push notifications. If you allow notifications, we store the push token Apple issues for your device so we can tell you when a friend invites you to a table.
Analytics and diagnostics
- Product analytics. Events describing how the app is used: for example app opened, sign-in, onboarding and tutorial progress, screens viewed, matches and practice hands started, finished or left (with game metadata such as mode, duration, result, faan and how many humans and bots were seated), rewards and missions claimed, friend and room actions, notification settings, reconnects, and errors encountered. Events never contain the tiles in your hand, your username, email or Apple identifier.
- Identifiers. Before you sign in, events are linked to a random analytics identifier the app creates on your device. Once you sign in, they are linked to your game account number. Each app session also gets a random session identifier.
- Approximate location. PostHog uses the IP address of each request to work out your approximate location (country, region and city), attaches it to the event, and then discards the IP address; it is not stored. Events our servers send carry no location.
- Device information. Each event carries standard technical properties such as app version, device model, operating system version, screen size, language, time zone and network type.
- Crash reports. If the app crashes, a crash report (the code location and device state at the time) is sent so we can fix it.
The website
The site uses Vercel Web Analytics to count page views. It records the page, the referring site, browser, operating system and country, without cookies and without identifying you. The site stores a single flag in your browser's session storage so the intro animation doesn't replay; it sets no cookies.
We do not collect your contacts, precise location, photos, microphone, camera, or advertising identifier (IDFA). There is no advertising in the app and nothing in it tracks you across other companies' apps or websites.
How we use it, and our legal bases
- To provide the game (performing our agreement with you): your account, running matches, scoring, history, progression, friends, rooms and notifications you ask for.
- To keep play fair and safe (our legitimate interest in a fair, abuse-free game): validating every online move on our servers, reviewing reports, and acting on cheating or abuse.
- To understand and improve the app (our legitimate interest): product analytics, crash reports, and remote settings such as temporarily switching a feature off.
- To meet legal obligations, and to answer you when you contact us.
We don't use your information for advertising, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Your choices
- Analytics. Turn off Share usage analytics in the app's Settings and the app stops sending analytics events and crash reports from that device.
- Notifications. Change them in the app's Settings or in iOS Settings at any time. Signing out removes your device's push token from our servers.
- Blocking. Block a player from their profile, a friend request, or a match; unblock them in Settings → Blocked Players.
What other players see
- Anyone you play with sees your username, avatar and level, and their copy of your shared match results. Their app also receives your game account number so the table knows who is in which seat.
- Your friends additionally see your experience points, when you joined and when you became friends, whether you are online or in a game, your lifetime statistics (including practice), and your recent match history.
- No other player ever sees your email, your Apple identifier or your device identifier.
Who we share it with
We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising. Apart from what other players see (described above) and the disclosures listed after this section, we share it only with service providers that process it on our behalf, under contracts that limit them to doing so:
- Fly.io: hosts our game servers and database in the United States.
- PostHog: product analytics, crash reports and remote settings, on PostHog's United States infrastructure. PostHog derives an approximate location from the IP address of each request and then discards the IP address.
- Vercel: hosts the website and its page-view analytics.
- Apple: Sign in with Apple, and delivery of push notifications. A friend's invitation includes the inviting friend's username.
We will also disclose information when the law requires it, to protect the safety of players, or as part of a sale or reorganisation of the business (in which case this policy continues to apply to it).
International transfers
We and our service providers process information in the United States. If you are outside the United States, your information is transferred there. Where the law requires a safeguard for that transfer (for example from the EU, UK or Switzerland), we rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism in our providers' data processing terms.
How long we keep it
- Your account, profile, progression and history: while your account exists. Your own history keeps your 200 most recent matches.
- The online-match move log: 90 days. It records seats, not accounts.
- Push tokens: until you sign out, delete your account, or the token goes unused for 60 days.
- Reports: as long as needed to handle them and to deal with repeat abuse; when the account involved is deleted, the report is kept without the deleted account's identity or any note.
- Server logs: about 30 days.
- Analytics and crash reports: up to 1 year, after which PostHog deletes them automatically; sooner on request.
- Backups: database backups are kept for up to 35 days, so deleted data can remain in a backup until that backup is deleted.
Deleting your account
Delete your account at any time in the app under Settings → Account → Delete Account, or by emailing us. Your account is hidden from other players immediately, and your email (if we hold one) and your device's push token are erased straight away. If you used Sign in with Apple, signing in again within 30 days cancels the deletion. After 30 days we permanently delete your account, profile, progression, statistics, friends and history. Because each match is shared with three other players, their own match history still shows the username you had in matches you played together. We also stop associating our analytics with your account, and on request we delete your analytics data.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you and get a copy of it, correct it, delete it, restrict or object to how we use it (including analytics), and receive it in a portable format. You can change your username, avatar and preferences in the app, and delete your account there; for anything else, email mahjongversus@gmail.com. We will verify the request comes from the account holder and answer within one month (or sooner where your local law requires). We won't treat you differently for exercising these rights.
- EU, UK and Switzerland: you may complain to your local data protection authority.
- Hong Kong: you may make a data access or correction request under the Personal Data (Privacy) Ordinance, and complain to the Privacy Commissioner for Personal Data.
- California and other US states: in the past 12 months we collected the categories described above (identifiers, internet or other electronic activity, approximate location derived from your IP address, and time zone) for the purposes above. We do not sell or share personal information and do not use sensitive personal information. You may use an authorised agent to make a request.
Security
Information travels over encrypted connections. Your session is kept in the device Keychain, online games are decided on our servers, and your opponents' hidden tiles are never sent to your device. No system is perfectly secure, but we limit who can access the data and what our service providers may do with it.
Children
The app is not directed at children. You must be at least 13, or the minimum age to consent to data processing in your country if that is higher, to use it. We do not knowingly collect personal information from children below that age; if you believe we have, contact us and we will delete it. The game involves no real-money wagering, and points have no monetary value.
Changes
If we change this policy materially, we will update this page, change the effective date above, and where appropriate let you know in the app.
Contact
Climbing Cat LLC: mahjongversus@gmail.com