Privacy Policy
Mahj is operated by Obsidian Ventures LLC, a Florida limited liability company in the United States (“Mahj,” “we,” “us,” or “our”). This policy explains how we collect, use, disclose, and retain personal information when you use the Mahj app, visit getmahj.com or our invitation pages, or contact us. For privacy questions or requests, email hello@getmahj.com.
Information we collect
- Account information. Your email address, public username, account identifier, and account creation and authentication records. If you previously supplied a personal name, we also retain that name in your private account profile. Your password is processed by our authentication provider, Supabase Auth, which stores a password hash rather than your readable password. Do not send us your password.
- Game and social information. Tables you create or join, table and group names, group membership, people you play with or add to your Circle, game actions, tiles and game state, results, scores, points, and game history. We also record session identifiers, recent app activity, and collection preferences to show relevant presence and artwork to your Circle.
- Trial information. We store your account identifier and trial start and end dates to provide the two-week no-payment trial and prevent it from restarting on login or reinstall. We also record reminder attempts and sending status to send your three-day trial-ending email once, with safe retries. A temporary copy of the recipient address is removed after the provider accepts the reminder or after the retry window expires.
- Purchase information, when purchases are available. We use purchase and subscription status, such as the product, entitlement, and renewal or expiration information made available by Apple, to provide access and display your membership. Apple processes App Store payments; we do not receive your full payment-card number.
- Technical information. Our backend and web infrastructure process network information such as IP addresses, request times, authentication events, and error or operational logs to deliver and secure the service. App preferences and authentication session information are also stored on your device so you can stay signed in and retain settings.
- Support information. If you contact us, we receive your email address, messages, and any screenshots, diagnostic details, or other information you choose to send. Avoid sending passwords, payment details, or information about other people that is unnecessary for your request.
- Invitation information. Invitation links can contain a table code, the inviter’s displayed name, and a collection selection. We process these details to display the invitation and help the recipient join the table.
The Mahj app does not request your phone number or SMS verification, upload your device’s address book, or collect precise GPS location. The app does not use advertising trackers or third-party marketing analytics. We do not sell personal information or share it for cross-context behavioral advertising.
The current getmahj.com landing page has no account-registration or information-submission form. It stores your animation-pause preference in your browser’s local storage. You can remove that preference by clearing the site’s browser data. Our hosting and delivery providers also process network requests, including IP addresses and request details, to deliver and secure the website.
How we use information
We use information to create and authenticate accounts, verify email addresses, provide password recovery, run multiplayer games, maintain results and rankings, connect players, display Circle activity, restore access to purchases, answer support requests, and investigate bugs, fraud, abuse, or security incidents. We also use it to comply with applicable legal obligations and protect the service and its users.
Account emails are used for service messages such as verification, recovery, a reminder when three days remain in your free trial, and important account or policy notices. Creating an account does not subscribe you to marketing emails.
What other people can see
Your username is a public identity within Mahj and can appear in player searches, tables, rankings, and shared game history. Choose a username you are comfortable showing to other players. Your email and private personal name are not shown in those public profile views.
Other table participants can see game information that the rules make visible, including public actions, exposures, scores, and revealed hands. Your concealed tiles are restricted during play. People in your Circle can see your recent online status and collection presentation. Group participants can see relevant group membership and shared game history.
A person who receives an invitation link, including a messaging service that generates a link preview, can read the information contained in that link. Do not share table invitations publicly unless you intend others to use them. Mahj uses your device’s sharing tools; it does not need access to your contacts to send an invitation.
Who receives information
- Other players and invitation recipients, as described above and as directed by your use of the service.
- Supabase, for authentication, database hosting, and realtime game services. It processes account, game, social, and technical information needed to provide these services.
- Resend, to deliver account emails. It processes recipient email addresses, message content, account links included in messages, and delivery records. Resend also uses subprocessors to operate and secure its service, including AI-assisted trust-and-safety processing of a small sample of emails on dedicated infrastructure it operates. Resend states that neither it nor those AI subprocessors use customer content to train or fine-tune models. Details are available in Resend’s security disclosures and subprocessor list.
- Porkbun and Google’s Gmail service, for support email. Porkbun hosts the support inbox and forwards messages sent to our contact address to our configured support inboxes, including Gmail. These services process sender and recipient addresses, message content, attachments, and delivery information. Access is limited to people handling Mahj support.
- OpenAI Sites and Cloudflare, to host and deliver getmahj.com. They process requests and technical information needed to deliver and secure the website. Hosting does not give them access to your Mahj account or private game database. OpenAI’s processing of personal information hosted on our behalf is governed by the applicable Sites Data Processing Addendum.
- Apple, when you download the app, make an App Store purchase, or participate in TestFlight. Apple handles its own account, payment, and platform information under Apple’s Privacy Policy. TestFlight may make beta feedback and crash information available to us through Apple’s developer tools.
- Legal and safety recipients, when disclosure is required by law or reasonably necessary to address fraud, security threats, or violations affecting our users or service.
- A successor business, if Mahj is involved in a merger, acquisition, or asset transfer, subject to applicable law and continued protection of your information. We will provide notice where required.
We limit provider access to information needed for the relevant service and require protection equivalent to this policy under applicable provider agreements and data-protection obligations. Supabase and Resend provide data-processing terms governing their handling of information on our behalf. We do not authorize unrelated uses of your Mahj information.
We do not authorize our service providers to use your information for their own advertising. Third-party sites or services you choose to open have their own privacy practices.
Retention and account deletion
We retain your account and related information while your account exists and as needed to provide the service. Shared game records support participants’ history and scores. Support messages and operational records are retained only for as long as reasonably needed for their purposes, including resolving requests, security, and any applicable legal obligations.
Resend’s current Free plan retains email content and delivery logs for 30 days, with provider backups retained for seven days. Deleting a Mahj account does not itself erase previously sent emails or provider logs. Support correspondence and authentication or security records are separate from your active account profile and may require separate handling of a deletion request.
Supabase’s current Free plan has a one-day retention window for API and database logs. Our production configuration does not write authentication audit logs to a separate database table. These operational logs are distinct from account and game records. Hosting and email providers may also retain limited service or security records under their applicable retention policies.
You can initiate permanent deletion from Profile → Settings → Delete Account. Deletion removes your account credentials, private profile, email, username, Circle relationships and presence, membership links, entitlement record, trial and reminder records, and personal points record from the active account system. Shared games and other participants’ results remain, with your account link removed from historical player seats and the seat label replaced by “Deleted player.” Shared table and group names are not automatically rewritten by account deletion and may contain information previously supplied by participants. During an unfinished game with other players, a computer takes your seat, retaining the tiles and public game actions needed to continue, without your account identity or personal points. If no other human player remains in that game, the unfinished game and its private data are removed. This retained game history is not a recoverable account.
If you cannot access your account, email hello@getmahj.com for help completing your request. We may verify that you own the account before acting. Removing the app from your device does not delete your account.
Limited information may remain where retention is legally required or necessary to resolve an existing legal claim, and deleted information may remain in protected backups until those backups expire under the applicable retention cycle. Such information is not used to reopen your deleted account. Screenshots, messages, and other copies independently retained by recipients are outside our control.
Account deletion does not cancel an Apple subscription. Manage or cancel an active subscription through Apple’s subscription settings. Apple may retain payment records under its own policies.
Your choices and privacy requests
You can update your email, password, and username in account settings. You can stop sharing new information by ceasing use and request account deletion as described above. If a feature requests device permission, you can refuse it or change it in your device’s settings.
Depending on your location and the laws that apply to us, you may have rights to access, obtain a copy of, correct, delete, or restrict use of your information, object to certain processing, or withdraw consent where consent is the basis for processing. Send requests to hello@getmahj.com. We will respond within the time required by applicable law, may verify your identity, and will explain any lawful limitation. Where applicable, you may use an authorized agent, appeal a declined request by contacting us, or complain to your local privacy regulator. We will not discriminate against you for exercising applicable privacy rights.
Security and processing locations
We use safeguards designed to protect information, including encrypted connections to the production backend, authentication controls, and access restrictions for private account and concealed game information. No service can guarantee absolute security.
Our providers may process information in the United States and other countries where they operate. Where applicable law requires protections for international transfers, we use the required safeguards, including appropriate contractual protections. Contact us for information about safeguards applicable to your data.
Prerecorded voice announcements
Some voice announcements were created using AI tools during development. These prerecorded announcements play on your device. Mahj does not send your account or gameplay information to an AI provider to generate or play these announcements.
Changes and contact
We will update the date above when we change this policy. For material changes, we will provide an appropriate notice in the app or by email, and obtain consent where required before applying a new use of personal information.
Privacy contact: Obsidian Ventures LLC, Florida, United States
Email: hello@getmahj.com.