Website Privacy Policy

1. Who is responsible for your data

The controller of your personal data is GForces sp. z o.o., with its registered office at Al. Bieszkowicka 52, 80-178 Gdańsk, Poland, registered with the District Court Gdańsk-Północ in Gdańsk, VII Commercial Division of the National Court Register (Sąd Rejonowy Gdańsk-Północ w Gdańsku, VII Wydział Gospodarczy KRS), under KRS number 0000246596; NIP (tax identification number): 5832920423; share capital: PLN 50,000. Contact us at info@mahjongfactory.com about your data. This policy covers the website. The offline iOS app has a separate privacy policy.

2. Information we process and why

• Accounts: your email address, username, account role, verification status, account timestamps, acceptance of the terms and login tokens. If you set a password, we store its hash, not the password itself. We use this information to provide your account, authenticate you and send account-related messages (GDPR Article 6(1)(b), performance of our agreement).
• Game results: the game layout, an identifier for the attempt, completion and recording times, elapsed playing time in seconds, removed and remaining tiles, hints used, points and final score. Results are associated with your account when you are logged in. These records support the game and its statistics. Account-linked processing necessary to provide this service is based on GDPR Article 6(1)(b). Guest results have no account reference.
• Security and support: technical request information such as IP addresses and server logs, and correspondence you send us. We use this to protect the service, investigate faults, answer requests and establish or defend claims where necessary (GDPR Article 6(1)(f), our legitimate interests). Where processing is necessary to fulfil a legal obligation, including responding to data protection requests, we rely on GDPR Article 6(1)(c).

Providing account details is voluntary, but an email address and username are necessary to register. You may play without registering. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Game scoring is part of gameplay.

3. Cookies, preferences and analytics

We use the _app_key session cookie for session and security functions. If you choose to stay logged in, _app_web_user_remember_me remembers your login for up to 14 days and may be renewed during use. Your browser also stores game preferences under mahjong_options in local storage until you clear them. You can clear these through your browser settings; blocking essential storage may prevent login or saving preferences.

The website loads Plausible analytics from plausible.gforces.pl to understand website use and improve the service. We host Plausible ourselves on the same server as the website in Frankfurt, Germany. It also loads fonts from Google Fonts; your browser contacts Google's servers and sends technical connection information such as your IP address when doing so.

4. Hosting and recipients

The service uses Amazon Web Services, including an RDS database and SES for account emails, in the Frankfurt region. Authorised operators and providers supporting hosting, email delivery and analytics may process information as needed to provide those services. We may disclose information where required by law. Public game statistics show summary figures rather than your email address.

A database hosted in the EU does not by itself exclude processing outside the European Economic Area by other providers or their support teams. Where such transfers occur, an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, are required. Contact us for information about the safeguards applicable to your data.

5. Account deletion and retention

We keep your account details while your account remains open. To request deletion, email info@mahjongfactory.com, preferably from your registered address. We may verify account ownership before acting. Deleting the account removes its credentials and login tokens. We keep game results for statistics after removing their account reference; they no longer link to your deleted account in the live database.

Server logs and backups are retained for 7 days. Deleting a live account does not immediately remove historical copies from backups; those copies expire within the 7-day backup retention period. If we restore a backup, we reapply account deletions before returning the restored service to use.

Information needed to handle your request, comply with legal obligations or resolve a dispute may be retained for those purposes. Retention must be limited to what is necessary for the relevant purpose.

6. Your rights

You may request access to and correction of your personal data, erasure or restriction of processing, and portability where applicable. You may object to processing based on legitimate interests on grounds relating to your situation. If processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Write to info@mahjongfactory.com to exercise these rights. We normally respond within one month. If a lawful extension is needed because of the complexity or number of requests, we will explain it within that month. You can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent supervisory authority.

7. Updates

We will update this page when our processing changes and inform account holders of material changes. A privacy policy update does not itself constitute consent to a new purpose of processing.