Privacy Policy
Who we are
This policy explains how Jade Mahjong (the web game at mahjong.suils.es, its mobile apps and the servers behind them) handles your personal data. Controller: the Jade Mahjong team (info@nordicbyte.co.uk).
We act under UK GDPR and, for players in the EU/EEA, the GDPR.
What data we collect
- Account: nickname, avatar, a friend code and your preferred language. If you register with email, your email and a password stored only as a one-way hash. If you sign in with Google, Apple or Facebook, the identifier that provider gives us and, when it shares it, your email.
- Two-step verification (optional): the secret that generates your codes, kept on our servers, and your recovery codes, stored only as hashes.
- Date of birth (optional): used only to confirm that you are an adult for the 18+ Night Collection. We store the date and an adult/not-adult flag.
- Device identifier: a random ID generated by the app on your device, used to link your sessions and offline games to it.
- Game data: progress, level, experience, scores, league and ranking, games and duels played, missions, event scores, season pass progress, gold and jade movements and the items you unlock or equip.
- Social data: friend requests, friendships, duel challenges, the chat messages you exchange with friends and the notifications we send you.
- Purchases: which item you bought, the amount, the platform and a receipt or session reference. We never see your card number: payment details are entered on Stripe's page.
- Technical data: your IP address (used to limit abusive requests), the time you were last seen and error logs.
Why we use it and on what legal basis
- To provide the game, your account, multiplayer, rankings and purchases: performance of our contract with you.
- To keep the service secure, prevent cheating and abuse and limit excessive requests: our legitimate interests.
- To confirm you are an adult before unlocking 18+ content, and to let you sign in with a social account: your consent or your request, which you can withdraw at any time.
- To keep tax and accounting records of purchases: legal obligation.
Who we share it with
We do not sell your data and we do not use third-party advertising or tracking.
- Other players see your nickname, avatar, league and ranking position, and receive the messages and challenges you send them.
- Stripe processes payments. It receives the amount, the product and our internal account reference, and collects your payment details itself.
- Google, Apple or Facebook, only if you choose to sign in with them.
- Our hosting and infrastructure providers, who process data on our behalf to run the service.
- Authorities, when the law requires it.
International transfers
Some providers (for example Stripe or social sign-in providers) may process data outside the UK and the EEA. When that happens we rely on adequacy decisions or standard contractual clauses.
How long we keep it
- Account and game data: while your account exists. When you delete it, we remove or anonymise it as described on Delete account.
- Login sessions: removed 7 days after they expire or are revoked.
- Rate-limit counters (they include your IP address): about one hour.
- Security events (they may include your IP address): 90 days.
- Purchase records, without links to your identity once the account is deleted: for the period required by tax and accounting law.
Your rights
You can ask us to access, correct, delete, restrict or port your data, to object to its use and to withdraw consent. You can delete your account yourself (see Delete account) or write to info@nordicbyte.co.uk. We reply within one month. You may also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk), the Spanish data protection authority AEPD (aepd.es) or the authority of your country.
Children
Jade Mahjong is not directed at children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, write to info@nordicbyte.co.uk and we will delete it. The 18+ Night Collection stays locked until age is verified.
Security
Connections are encrypted (HTTPS). Passwords and recovery codes are stored as hashes, and the apps keep your session tokens in the secure storage of your device. No system is perfectly secure, so we also recommend turning on two-step verification.
Cookies and local storage
The web version uses your browser's local storage to remember your session and settings. We do not use advertising or analytics cookies.
Changes to this policy
If we change this policy we will update the date above and, for important changes, tell you in the app.
Contact
Questions or requests about your data: info@nordicbyte.co.uk.