At IRL Mahjong, we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, mobile applications, and related services (collectively, the “Services”).

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

1. Who We Are

IRL Mahjong (“IRL Mahjong,” “we,” “us,” or “our”) provides a companion application for playing and scoring mahjong, including in-person score tracking, digital gameplay, and live scoreboards. This Privacy Policy applies to all users of our Services.

2. Information We Collect

We collect the following categories of information. For each category, we describe what we collect and why we collect it.

A. Account Information

When you register for an account, we collect your email address, a username, and, if you choose password sign-in, a password (stored only in hashed form). We do not request or store your legal name. An account is optional; portions of the Services can be used without one.

Why we collect it: to create and secure your account, identify you within the Services, and synchronize your data across devices.

B. User-Provided Content

We collect content you choose to submit through the Services, such as your username and profile image, friend connections, and any messages, reports, or attachments you send to our support channels.

Why we collect it: to operate the social features of the Services and to respond to your requests.

C. Third-Party Authentication

If you sign in using a third-party identity provider (such as Google), we receive limited profile information from that provider, including your email address and profile picture, along with authentication tokens used to verify your identity. We do not receive or store your real name from these providers. Your use of a third-party provider is also governed by that provider’s own privacy policy.

Why we collect it: to authenticate you securely without requiring a separate password.

D. Usage Data

We collect records of your activity within the Services, such as games played, scores, results, feature interactions, and associated timestamps.

Why we collect it: to provide core functionality (such as score history and statistics), to understand how the Services are used, and to improve them.

E. Device & Technical Information

We collect information about the devices you use to access the Services, including device model, operating system and version, application version, browser type, IP address, and, if you enable notifications, a push notification token.

Why we collect it: to deliver the Services to your device, provide push notifications you request, ensure compatibility, and diagnose technical issues.

Where the mobile application uses your camera, imagery is processed on your device and is not transmitted to our servers.

F. Cookies & Tracking Technologies

We use cookies and similar technologies (such as browser local storage) for authentication and session management, remembering preferences, and maintaining guest sessions. We do not use advertising cookies or cross-site tracking. You can manage cookies through your browser settings; certain cookies are essential to the operation of the Services and cannot be disabled.

Why we collect it: to keep you signed in and to remember your settings between visits.

G. Payment Information

The Services are currently offered free of charge, and we do not collect payment information. If we introduce paid features in the future, payments will be processed by third-party payment providers, we will not store full payment card details, and we will update this Privacy Policy before any such collection begins.

H. Communications

We collect the contents of communications between you and us, including support requests, bug reports (and any contact email you include with them), and our email correspondence with you. We also send transactional emails, such as sign-in links and verification codes.

Why we collect it: to provide customer support, deliver account-related messages, and maintain records of our communications with you.

I. Security Data

We may collect:

  • Login history
  • Failed login attempts
  • Security logs
  • Fraud detection information

Why we collect it: to protect accounts, detect and prevent fraud, abuse, and unauthorized access, and to maintain the integrity of the Services.

3. How We Use Your Information

We use the collected information to:

  • Provide, maintain, and improve the Services
  • Create and manage user accounts
  • Operate gameplay, scorekeeping, and social features
  • Send technical notices, security alerts, and support messages
  • Deliver notifications you have opted into
  • Respond to your comments and questions and provide customer support
  • Monitor usage patterns and system performance
  • Prevent fraud, abuse, and security risks
  • Comply with legal and regulatory obligations

4. Legal Bases for Processing

Where laws such as the EU or UK General Data Protection Regulation (GDPR) apply, we process your personal information on the following legal bases:

  • Performance of a contract: processing needed to provide the Services you request, such as operating your account and games.
  • Legitimate interests: processing needed to secure and improve the Services, such as security logging and fraud prevention, where those interests are not overridden by your rights.
  • Consent: processing you have agreed to, such as push notifications. You may withdraw consent at any time.
  • Legal obligation: processing needed to comply with applicable law.

5. Information Sharing and Disclosure

We do not sell or rent personal information. We may share information in the following limited ways:

  • With other users: your username, profile image, and game results are visible to other participants in your games and to users you connect with. Live scoreboards are visible to anyone with the game link.
  • Service providers: we engage trusted third parties for hosting, data storage, realtime messaging, email delivery, push notification delivery, and authentication. These providers receive only the information necessary to perform their functions and are bound by data protection obligations.
  • Legal compliance: we may disclose information to comply with applicable laws, legal processes, or government requests.
  • Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
  • Protection of rights: to protect the rights, property, or safety of IRL Mahjong, our users, or the public.

6. International Data Transfers

We store personal information on servers located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we take steps to ensure that appropriate safeguards are in place for such transfers.

7. Data Retention

We retain personal information for as long as necessary to:

  • Provide the Services and fulfill the purposes described in this Policy
  • Comply with applicable legal obligations
  • Resolve disputes and enforce our agreements

When your account is deleted, we will delete or anonymize your personal information within 30 days, unless retention is required by law. Game records shared with other participants may be retained in anonymized form so that their histories remain intact. Security logs are retained for a limited period consistent with their purpose.

8. How We Protect Your Data

We implement commercially reasonable technical and organizational safeguards to protect your information, including:

  • Encryption of data in transit
  • Hashed and salted password storage
  • Access controls and authentication on our systems
  • Security monitoring and logging

While we strive to maintain high standards of security, no online service is completely secure, and we cannot guarantee absolute protection.

9. Your Privacy Rights

Depending on where you live, you may have rights under applicable privacy laws (such as the GDPR or the California Consumer Privacy Act (CCPA)). These may include:

  • Right to access: request a copy of the personal information we hold about you.
  • Right to correct: request correction of inaccurate information.
  • Right to delete: request deletion of your personal information, subject to certain exceptions.
  • Right to portability: request your information in a machine-readable format.
  • Right to object or restrict: object to or request restriction of certain processing.
  • Right to withdraw consent: withdraw consent where processing is based on consent.
  • Right to non-discrimination: you will not be discriminated against for exercising your privacy rights.

To exercise these rights, contact us at support@irlmahjong.com. We may verify your identity before fulfilling your request. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

10. Children’s Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at support@irlmahjong.com and we will delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. The updated version will be posted on this page with a new “Last Updated” date. Material changes will be communicated through the Services or by email. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@irlmahjong.com.