← Back to Mahjor Plays Privacy Policy
Last updated: October 11, 2026
Mahjor Plays ("Service", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.
1. Information We Collect
Account Information
- Email address — used for authentication, email verification, password resets, and transactional notifications.
- Name — used for display purposes within the application.
- Password — stored as a one-way bcrypt hash (12 rounds). We never store or log plaintext passwords.
- Invitations — an administrator may invite you by giving us your name and email address. We use them only to create your account and send the invitation. If you don't accept within 30 days, we delete them; you can also ask us to delete them sooner.
Usage Data
- Last visit — when you last used the app while signed in (updated at most once an hour).
Your Games
When you finish a game against the robots, we keep its record: the deal, every move, and how it ended, with the seat you played, the robots' levels, and when it ended. We use it to review your games with you and for your statistics, and when you review a game, we keep its review with it. A game you finish while offline waits on your device, and is sent when you're back online.
Your Own Cards
When you type in a card you own (Resources, then Your cards), we keep it on your account: its name and year, the hands as you typed them, and the card built from them. It's for you alone: no other player sees it, and we don't use it to tune the robots or the advice. A card you change or delete after playing on it is kept, out of your list, so the games you played on it can still be reviewed. Your cards are also kept on your device, so you can play on them offline. Where reading a card from a photo is offered, the photo you choose is made smaller on your device, sent through our server to Claude, an AI model made by Anthropic, which reads its hands into the page for you to check, and then discarded: we don't keep it, and it isn't part of your card.
Friends' Tables
When you make or join a table to play with friends, the others at it see your account's name (or "A player" if it has none), whether you're at the table, and your moves as the table shows them, never your tiles while a game is on. We keep the table (its code, its host, who sits where, and anyone the host asked to leave), and each game's deal and every move, so a game carries on if our server restarts. Each player's finished game goes in their own Games tab, with the players' names. A table nobody has used for 30 days is deleted, with its games and moves.
The Coach's Words
When you ask the coach to write up a reviewed game, or ask it "Why?" about one of your decisions (in the Game Review, or at the table), Claude, an AI model made by Anthropic, writes the words from the game's facts (see "Data Sent to Our AI Provider" below). For "Why?" at the table, your app sends us the game so far, and we work out the decision's facts from it. We keep a write-up or a review's answer with the game, so it opens again without asking anew, and a record of each request (when, for which game, its size and its cost) to keep the coach's costs in check and count what your plan includes.
The Lessons
When you finish a lesson, we keep which one and how many of its questions you got right the first time, to show your progress in the Learn tab.
The Puzzle of the Day
When you answer the puzzle of the day, we keep your answer and its grade, to show you how everyone chose: others see only how many chose each answer, never who.
Feedback Data
When you submit feedback through the application, we collect:
- Your message and selected category.
- Browser information (user agent, viewport size, language, platform, screen dimensions, online status) — collected automatically to help debug reported issues.
- The page URL where feedback was submitted, and where you were in the app.
- Your email address (if logged in, or if you optionally provide it).
Reports
When you use "Something wrong or unclear?" on something the app told you (a Game Review's verdict, the puzzle's, or the coach's words), we keep your report: what was wrong, anything you wrote, the words it was about, and the app's version, so we can fix it.
Payment Information
Payment processing is handled entirely by Stripe. If Pro is sold through Link, a Stripe company, Link is the seller of your subscription: it collects your payment details and billing address, and any tax. We store only:
- Your Stripe customer ID and subscription ID.
- Subscription status (active, canceled, past due).
We do not store credit card numbers, bank account details, or other payment credentials. See Stripe's Privacy Policy for how they handle your payment data.
2. How We Use Your Information
- Provide the Service — run your account and the features you use.
- Authentication — verify your identity and manage your account.
- Transactional emails — send email verification, password reset links, and notices to administrators about new accounts and access requests.
- Improve the Service — see which features are used and which aren't, overall and for each account, to improve them. Only administrators see this.
- Customer support — respond to feedback and bug reports.
We do not use your data for advertising, sell it to third parties, or use it to train AI models.
3. Third-Party Services
The Service relies on the following third-party providers:
| Provider | Purpose | Data Shared |
|---|
| Stripe and Link | Payment processing; Link may sell Pro (merchant of record) | Email, name, subscription details |
| Anthropic | The coach's write-ups and answers, and reading a photo of your own card (Claude, an AI model) | A reviewed game's facts: tiles, choices, and the review's numbers; a photo of a card you chose to have read (no personal information) |
| Resend | Transactional email | Email address, email content |
| Supabase / PostgreSQL | Database hosting | All account data |
| Cloudflare Turnstile | Bot protection | Browser fingerprint (anonymized) |
| Render | Application hosting | Server logs, request metadata |
Data Sent to Our AI Provider
When you ask for a coach's write-up or answer, we send to Anthropic, our AI provider:
- The facts of the game's review, or of the one decision you asked about: the choice you made and the better one, and the numbers behind them (chances of winning and points).
- The tiles involved, and the hands on the card that the review names.
- Instructions for how the coach writes.
- When you have a photo of your own card read: that photo, and instructions for how to write its hands down. Nothing else goes with it.
We do not send your email, name, or any personal information to Anthropic, and Anthropic's commercial terms don't allow it to train its models on what we send. See Anthropic's Privacy Policy for how they handle API data.
4. Data Retention
- Account data — retained until you delete your account or ask us to.
- Your games, with their reviews and the coach's write-ups and answers, your puzzle answers and your lesson results — retained until your account is deleted, and deleted with it.
- Your own cards — retained until you delete them or your account. One you played on is kept, out of your list, for those games, until your account is deleted.
- Friends' tables — deleted once nobody has used them for 30 days, or when their host deletes their account. Each player's copy of a game played there is their own: it stays in their Games tab, with the players' names and every move, until they delete their account, as anyone keeps the record of a game they played.
- The coach's costs — the record of each request to Anthropic (when, its size and its cost, never the words) is kept for our accounts. When your account is deleted, it's kept with nothing linking it to you.
- Feedback and reports — retained for service improvement until your account is deleted.
- Server logs — retained for 30 days for debugging and security monitoring.
- Deleting your account — delete it yourself on the Account page (click your name at the top of the app), with your password, or ask us (the Feedback form, or "Send us a message" on the sign-in page). Your account goes with everything recorded under it and your feedback. While a Pro subscription is running it can't be deleted there: cancel it in Manage Pro, and once it has ended you can delete your account, so nothing more is charged. Server logs are kept for up to 30 days, and Stripe keeps its own record of any payments.
5. Cookies and Local Storage
We use minimal browser storage:
- JWT authentication token — stored in localStorage. Used to keep you signed in. Expires after 7 days.
- User profile data — stored in localStorage for display purposes.
- Your settings — the theme, the tab you were on, and the table's settings, with how many games you've finished on this device (so hints can fade as you play), stored in localStorage on this device.
- Your own cards — the cards you typed in, so a game on one needs nothing from our server, stored in localStorage.
- Your games on this device — the game in progress, so it carries on where it was, and finished games waiting to be sent while you're offline, stored in localStorage.
- A copy of the app — its code, tile pictures and sounds, kept by your browser so the app works offline. It holds nothing about you.
We do not use tracking cookies, analytics cookies, or advertising cookies. The Cloudflare Turnstile widget may set its own cookies for bot detection purposes.
6. Your Rights
You have the right to:
- Access — view the data associated with your account through the application.
- Correction — update your account information (your name, on the Account page).
- Deletion — delete your account and all associated data on the Account page, or ask us to.
- Withdrawal of consent — cancel your account at any time.
To exercise these rights, use the Feedback form in the application or contact us via email.
7. Security Measures
We implement the following security measures:
- Passwords hashed with bcrypt (12 rounds).
- Security tokens (reset, verification) stored as SHA-256 hashes with expiration.
- HTTPS encryption for all data in transit.
- CORS restrictions limiting API access to authorized origins.
- Cloudflare Turnstile bot protection on public forms.
- Rate limiting to prevent abuse.
- JWT authentication with 7-day expiration.
8. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can delete it.
9. International Data Transfers
Your data may be processed in the United States where our servers and third-party providers are located. By using the Service, you consent to this transfer.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
- We will update the "Last updated" date at the top of this page.
- For material changes, we will notify you via email.
- Continued use of the Service after changes constitutes acceptance of the updated policy.
11. Contact
If you have questions about this Privacy Policy or wish to exercise your data rights, please use the Feedback form in the application or contact us via email.