What the MAHJONG! Privacy Policy

Effective Date: August 5, 2026
Last Updated: August 5, 2026

What The Mahjong LLC (doing business as "What the MAHJONG!" — hereafter "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, when we share it, and your rights and choices regarding your information.

By using What the MAHJONG!, you agree to this Privacy Policy.

1. Information We Collect

Information You Provide

Account information: name (first and last), email address, password (stored as a bcrypt cryptographic hash — never in plaintext), date of birth (used to verify you are 18+), profile photo (if uploaded), optional PIN for quick sign-in (also stored as a bcrypt hash)
Profile information: skill level, years playing mahjong, NMJL card years, bio, host status, teacher status, teacher credentials and languages spoken (if applicable), instructor bio, business logo (if you have a business profile)
Contact information: phone number, street address, city, state, ZIP code
Game information: games you post, register for, or attend; ratings you leave and receive; game statistics and outcomes
Communications: direct messages and group chat messages you send, images you share in messages, support requests, bug reports, content of reports you file against other users
Moderation records: if another user reports you or you report another user, we retain the reason, description, screenshots, and outcome of that report

Note on host, teacher, and organizer information: Skill level, host status, teacher status, teacher credentials, instructor bio, and any similar self-reported information are provided by the user and are not independently verified, vetted, or certified by What the MAHJONG!. This applies to all game and event types, including Teacher Classes, Pay to Play games, Leagues, Tournaments, Sponsored events, Charity events, and Getaways. See our Terms of Service for our full disclaimer regarding instructors, event organizers, and money exchanged between users.

Information Collected Automatically

Usage data: which screens you visit, which features you use, how long you use the Service
Device data: device type, operating system, browser type, IP address, approximate location based on IP
Security data: failed PIN login attempts and the IP address of each attempt (used solely for rate limiting and abuse prevention)
Push notification tokens: if you enable push notifications, we store a device token from OneSignal so we can deliver notifications to your device
Error and crash reports: if the app encounters an error, we collect anonymized crash reports and stack traces to diagnose and fix bugs
Cookies and similar technologies (see Section 3 below)

Information from Third Parties

If you sign in via a third-party service (e.g., Google), we receive basic profile information from that service (name, email, profile picture).

2. How We Use Your Information

Create and maintain your account
Provide, operate, and improve the Service
Show you games near you (using your ZIP code, city, or approximate IP-based location)
Allow other users to find and contact you (in accordance with your privacy settings)
Send you transactional emails (account verification, game notifications, password resets, account deletion confirmations)
Send you push notifications about games, messages, and account activity (only if you enable them)
Communicate with you about updates, new features, or important account information
Investigate and prevent abuse, fraud, harassment, or violations of our Terms of Service
Enforce rate limits to prevent spam and abuse
Comply with legal obligations, respond to legal process, and defend our legal rights
Conduct analytics to understand how the Service is used and how to improve it
Diagnose bugs and fix technical issues via anonymized error reports

Legal Basis for Processing (EU/UK Users)

If you are located in the European Union or United Kingdom, we process your personal data on the following legal bases (GDPR Article 6):

Contract: to provide the Service you have signed up for
Legitimate interests: to prevent fraud and abuse, improve the Service, and defend our legal rights
Consent: for optional communications and non-essential cookies (you may withdraw consent at any time)
Legal obligation: to comply with applicable laws

3. Cookies and Similar Technologies

We use the following categories of cookies and browser storage:

Essential (required): Supabase authentication cookies to keep you signed in; session tokens to maintain your login
Functional: browser LocalStorage to remember your last-used email and preferences
Analytics: anonymized usage tracking to improve the Service (may include Vercel Analytics in the future)
Push notification tokens (OneSignal): to deliver push notifications if enabled
Error monitoring (Sentry, when active): anonymized error and crash reports

You can disable non-essential cookies through your browser settings. Disabling essential cookies will prevent you from using the Service.

4. How We Share Your Information

With Other Users (Based on Your Settings)

Your first name and last initial are visible on game listings and your profile
Your profile photo, skill level, bio, and badges are visible on your profile to other users
Your MahjNear number (a public-facing user ID) is visible on your profile
Your ratings (as a host and as a player) are visible to other users
Your email address may be shown to a host if you join their game (so they can contact you about logistics), only until in-app messaging fully replaces this
Your phone number is NEVER shown to other users, even if you provide one
Your street address is NEVER shown publicly. If you host a game at home, only players you approve see your address
Your messages are visible only to the recipient(s) of those messages

With Service Providers

We use trusted third-party providers to operate the Service. Each is contractually required to protect your information:

Supabase — database hosting, authentication, and file storage
Vercel — web hosting and content delivery
Resend — transactional email delivery
OneSignal — push notification delivery
Google Maps — mapping public game locations
Sentry (when active) — anonymized error and crash monitoring
Apple App Store / Google Play — mobile app distribution and payments (when applicable)

For Legal Reasons

We may disclose your information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to comply with applicable law, protect the safety of any person, investigate fraud or violations of our Terms, or defend our legal rights.

In a Business Transfer

If What The Mahjong LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5. We Do NOT Sell Your Information

What the MAHJONG! does not sell your personal information to advertisers, data brokers, or any third parties. We do not share your information for cross-context behavioral advertising.

6. Your Rights and Choices

Access the personal information we hold about you
Correct inaccurate or incomplete information (you can edit your profile in the app)
Delete your account and associated personal data (available in-app: Profile → Delete My Account)
Block any user who makes you uncomfortable
Opt out of promotional emails and push notifications (transactional emails required for account function cannot be disabled)
Data portability: request a copy of your personal data in a machine-readable format

To exercise any of these rights, use the in-app controls or contact us at support@whatthemahjong.com.

Account Deletion Details

When you delete your account from within the app:

Your profile enters a 7-day grace period. During this window, you may sign back in to restore your account.
After 7 days, your profile, DMs, personal photos, group memberships, and stored files are permanently deleted from our active database and storage.
Games you posted as a host in the past are anonymized (reassigned to a "Former Host" placeholder) so other players' game statistics remain intact.
Future games you posted are cancelled and RSVP'd players are notified.
Direct messages you sent are removed. Recipients may still see the conversation from their side until they delete it.
Moderation records against you (if any) are preserved for platform-safety purposes with your user ID anonymized.
A minimal audit-log entry (email, timestamp, whether you were banned at deletion) is retained for fraud prevention and legal compliance.

7. Data Retention

We retain your information as follows:

Active account data: retained while your account is active
Deleted account data: soft-deleted for 7 days (grace period), then permanently purged from active database and file storage
Deletion audit log: minimal record (email, timestamps, ban status) retained up to 2 years for fraud prevention
Moderation records (reports): retained up to 2 years or until resolution, whichever is later
Backup snapshots: encrypted database backups may retain deleted data for up to 90 days before rotation
Legal-hold data: retained as long as required by law, court order, or ongoing investigation (up to 7 years for financial and legal records)
Anonymized analytics: may be retained indefinitely as they no longer identify you

8. Security

We use industry-standard security measures to protect your information, including:

Encryption of data in transit (HTTPS/TLS 1.2+)
Encryption of data at rest (Supabase managed encryption)
Password storage using bcrypt cryptographic hashing (never plaintext)
PIN storage using bcrypt cryptographic hashing
Row-Level Security (RLS) on all database tables
Rate limiting to prevent brute-force attacks
Access controls and audit logging
Regular security reviews and updates

However, no system is 100% secure. You are responsible for keeping your password and PIN confidential. If you suspect unauthorized access, contact us immediately at support@whatthemahjong.com.

If we become aware of a data breach affecting your personal information, we will make reasonable efforts to notify you without undue delay and in accordance with applicable law. Notice may be provided by email to the address associated with your account, by in-app notice, or by posting on our website. We will also notify applicable authorities where required by law.

9. Children's Privacy

What the MAHJONG! is not directed to and may not be used by anyone under 18 years old. We restrict our platform to adults because our Service facilitates in-person meetings at private residences. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it promptly and terminate the account. If you believe a person under 18 has provided us with personal information, please contact us at support@whatthemahjong.com.

10. International Users and Data Transfers

What the MAHJONG! is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

If you are in the European Union, United Kingdom, or another jurisdiction with data-transfer restrictions, by using the Service you consent to your data being transferred to the United States. We rely on your consent and legitimate interests (GDPR Article 46 lawful bases) for these transfers. If you do not consent, please do not use the Service.

11. European Union / United Kingdom Residents (GDPR)

If you are located in the European Union or United Kingdom, you have the following rights under GDPR:

Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure / "right to be forgotten" (Article 17)
Right to restrict processing (Article 18)
Right to data portability (Article 20)
Right to object to processing (Article 21)
Right to withdraw consent at any time
Right to lodge a complaint with your national data protection authority

To exercise any of these rights, contact us at support@whatthemahjong.com. We will respond within 30 days.

12. California Residents (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to know what personal information we collect, use, disclose, and sell
Right to delete your personal information
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information (we do not sell or share)
Right to limit use of sensitive personal information
Right to non-discrimination for exercising your privacy rights
Right to opt out of automated decision-making (we do not use automated decision-making that affects your legal rights)

Categories of personal information we collect (per California disclosure requirements): identifiers (name, email, IP address), commercial information (games attended), internet activity (usage data), geolocation data (approximate, from IP or ZIP code), audio/visual (profile photos, DM images), professional information (teacher/host status), and inferences from the above.

California "Shine the Light" Law: California residents may request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

To exercise these rights, contact us at support@whatthemahjong.com. We will verify your identity before responding and respond within 45 days.

13. DMCA Copyright Notices

If you believe content on the Service infringes your copyright, please send a DMCA notice to our designated agent:

DMCA Agent
What The Mahjong LLC
7924 Preston Rd Ste 300
Plano, TX 75024
Email: support@whatthemahjong.com

Your notice must include: (a) your signature, (b) identification of the copyrighted work, (c) identification of the infringing material and its location, (d) your contact information, (e) a statement of good-faith belief that use is not authorized, and (f) a statement under penalty of perjury that the information is accurate.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the changes.

15. Contact

If you have questions about this Privacy Policy or how we handle your information, contact us at:

What The Mahjong LLC
7924 Preston Rd Ste 300
Plano, TX 75024
Email: support@whatthemahjong.com

By creating an account on What the MAHJONG!, you acknowledge that you have read and understood this Privacy Policy.