Privacy Policy

Introduction

MahjPassport ("we," "us," or "the app") helps players track scores, standings, milestones, events, and memories related to American Mahjong.

This policy explains what information the app collects, why we collect it, how it is used, and how you can control it.

Information We Collect

Account Information

We collect the email address you use to create your account.

Your password is handled entirely by our authentication provider, Supabase Auth, and is never visible to us in plain text.

If you sign in with Apple or Google, we receive only the identifier and email address that provider shares with us.

Profile Photo

If you add a profile photo, it is used to identify you elsewhere in the app, including standings, league rosters, and other social areas.

Unlike the other photos described below, your profile photo is publicly accessible by design, similar to profile pictures in many other apps. This means someone with the direct image link may be able to view it.

Hand and Shared Moment Photos

You may choose to upload photos of winning hands or photos shared to a league's Shared Moments.

These photos are stored in secure cloud storage and are private. They are visible only to you and, where you have joined a league or group, to other members of that league or group, subject to applicable blocking and moderation controls.

If a photo is removed through the app's reporting or removal flow, it stops being accessible immediately, including to the person who originally uploaded it.

Gameplay Data

We collect the hands, scores, league and event participation, and milestones you record in the app.

This information is used to provide features including your Passport, Journey statistics, history, event participation, and league standings.

Purchase Information

If you purchase a subscription or Hosting Credits, our payment partner, RevenueCat, and the app store through which you made the purchase — Apple App Store or Google Play — provide us with information about your subscription or purchase status.

We do not see or store your payment card information. Payment details are handled by Apple or Google.

Crash and Diagnostic Data

If the app crashes or encounters an unexpected error, we may receive diagnostic information through our error-monitoring provider, Sentry.

This information may include your device model, operating-system version, and information about the error.

Crash reports do not include your photos or gameplay content.

Referral Activity

If you use or share a referral code, we record that a referral occurred so we can determine and provide any associated reward.

What We Don't Collect

How We Use Your Information

We use the information described above:

• To operate the app's core features, including score tracking, standings, Passport and Journey statistics, events, and gameplay history.
• To process purchases and keep subscription and Hosting Credit balances accurate.
• To respond to support requests, content reports, and other requests submitted by you or other players.
• To detect, investigate, and fix crashes, errors, and technical problems.
• To maintain the integrity and security of MahjPassport.

Who We Share Information With

We share information only with service providers that help us operate MahjPassport and only to the extent needed for them to perform those services.

These providers currently include:

• Supabase — database, authentication, and file-storage services.
• RevenueCat, Apple, and Google — subscription and purchase processing.
• Sentry — crash and error reporting.
• Backblaze B2 — an independent backup copy of hand and Shared Moment photos, maintained in case something happens to our primary storage. This is a byte-for-byte backup and is not otherwise used to process or display your photos.
• Resend — used only to send our own team an internal alert if a scheduled backup process fails. We do not use Resend to send you marketing or account emails. A backup-failure alert may contain the affected file name, which can include your account identifier but not your name or email address, as well as an error message. The alert does not contain the photo itself.

Deleting Your Account or Data

Deleting Your Account in the App

You can delete your account at any time by going to:

The deletion process begins immediately and does not require any additional action from you.

Requesting Deletion Without the App

If you no longer have the app installed, or if you need help with something the in-app deletion process does not cover, email [email protected] .

Whenever possible, send the request from the email address associated with your account.

If you no longer have access to that email address, provide your account display name and enough information for us to reasonably identify the account.

You do not need to reinstall the app to request deletion.

You can also review the standalone Delete Your Account page for step-by-step instructions.

What Happens When You Delete Your Account

When you delete your account:

• Your login access is revoked immediately.
• Your display name and profile photo are removed.
• Photos of your winning hands and Shared Moments you posted are permanently deleted from both our primary storage and our Backblaze B2 backup copy.
• If you signed in using Apple or Google, we attempt to revoke that provider's access to your MahjPassport account. Revocation may not always complete immediately on Apple's or Google's systems. If it does not, contact support and we will follow up.
• Any unused Hosting Credits are forfeited. MahjPassport does not automatically issue a refund when an account is deleted. Refund requests must be made using Apple's or Google Play's applicable refund process.
• Deleting your MahjPassport account does not automatically cancel an active subscription. You must cancel the subscription separately through your Apple App Store or Google Play subscription settings if you do not want it to renew.

Information We Retain After Deletion

Certain information may be retained after account deletion where necessary to maintain the integrity of the app, prevent abuse, or preserve other users' records.

This may include:

• Historical gameplay records associated with leagues or events in which you participated. These records may be retained so other players' standings and histories remain accurate, but they are no longer linked back to your active account.
• Your underlying account record. Rather than being deleted outright, it is marked as deleted and permanently prevented from signing in again.
• The email address associated with the account is replaced with a placeholder that is not a real, working email address and does not disclose your name or contact information to other users.
• A non-identifying technical marker associated with a linked Apple or Google identity may be retained so we can prevent someone from re-registering an intentionally deleted account in order to abuse purchase-restoration functionality.
• If you were named in a moderation report, the report may retain a snapshot of the display name shown at the time the report was submitted so the historical report remains understandable.

Backups

Existing database backups are not retroactively modified when an account is deleted.

As a result, a backup created before your deletion may temporarily contain information that existed at the time the backup was created. Database backups are retained for up to 30 days, after which they age out of our normal retention process.

If a backup created before your deletion were restored during that retention period, the pre-deletion state could be temporarily reintroduced until the applicable deletion or cleanup processes run again.

We attempt to complete photo and backup deletion immediately.

If a deletion step cannot be completed immediately — for example, because a third-party storage provider is temporarily unavailable — the failure is logged so our team can complete the deletion manually.

You may contact [email protected] if you would like confirmation that the process has been completed.

Children's Privacy

MahjPassport is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Security

We use technical safeguards designed to limit access to information within MahjPassport.

Every table in our database uses row-level security, which restricts the app's client to accessing only information that the current user is authorized to access.

The application client does not have unrestricted access to the underlying database.

Your authenticated session is stored on your device using operating-system secure storage rather than plain-text storage.

No system can guarantee absolute security, but we design MahjPassport to limit access to personal information and reduce the impact of unauthorized access.

Your Rights

You can access, correct, or delete much of your information directly within the app.

For other requests concerning your personal information — including requests for access to your data or assistance with deletion — contact us using the information below.

Changes to This Policy

We may update this Privacy Policy as MahjPassport changes.

If we make material changes, we will update the effective date shown at the top of this page.

Your continued use of MahjPassport after an updated policy becomes effective means the updated policy will apply to your continued use of the service.

Contact Us

Questions about this Privacy Policy or your information?