Privacy Policy
2026-08-18
This policy explains how Mahjong Hub (mahjonggame.org) handles personal data. The site is a free browser game. There is no real-money gambling, points cannot be cashed out, and four-player tables are you versus computer opponents — not other people.
Who we are
Mahjong Hub is operated at mahjonggame.org. For privacy requests email [email protected]. We do not have a separate in-game messaging channel for legal notices.
What we collect
If you play as a guest we store progress, item counts and settings on your device (local storage). We do not require an account to play.
If you sign in we receive the name, email and avatar your Google, Facebook, X or email provider shares with us, plus a session cookie so you stay signed in. We store points, item inventory, daily-challenge streak and solitaire progress on our database (hosted by Neon Postgres).
Our host (Vercel) and, if you consent, Google Analytics 4 may process IP address, browser type, language, approximate region and pages you open. We do not try to identify you from that traffic data.
We do not collect payment card numbers. We do not run a shop checkout on this site yet.
Why we use data (GDPR legal bases)
Providing the game and account: contract / legitimate interest — so you can play, keep a streak, and restore progress on another device.
Security and abuse prevention: legitimate interest — rate limits, login sessions, and append-only point ledgers.
Analytics cookies and similar identifiers: consent. They stay off until you accept them in the cookie banner.
Advertising cookies and rewarded-video identifiers: consent. No advertising SDK is loaded until you opt in and an ad network is actually connected.
Legal requests: legal obligation if we must respond to a lawful demand.
Cookies and similar storage
Necessary: sign-in session, cookie-consent choice, accessibility settings, add-to-home-screen dismiss, and guest solitaire progress. The site cannot remember your privacy choice or keep you signed in without these.
Analytics: Google Analytics 4 (measurement ID) only after you opt in.
Advertising: none today. If we add a rewarded-video network later, it will use the Advertising category and will not run on a rejected choice.
Details and a way to change your mind are on the Cookie Policy page.
California and similar US state laws (CCPA/CPRA)
We do not sell personal information for money. Analytics and future ads can count as “sharing” for cross-context advertising. You can refuse that sharing with Reject non-essential, the Cookie settings link, or a Global Privacy Control (GPC) signal in your browser.
You may request access or deletion of account data by emailing us from the address on the account. We will not discriminate against you for exercising these rights.
Your GDPR rights
If EU/UK/EEA law applies you may request access, correction, deletion, restriction, portability, and objection to legitimate-interest processing, and you may withdraw consent at any time without affecting play of the game.
You may complain to your local data protection authority. We would rather fix the issue first — write to us at the address above.
Children
Mahjong Hub is a general-audience game and is not directed at children under 13 (or under 16 where that is the digital-consent age). We do not knowingly collect data from children. If you believe a child created an account, email us and we will delete it.
Processors and international transfers
Vercel hosts the website. Neon hosts the database. Auth.js talks to Google, Facebook, X or your email provider when you choose that sign-in method. Google Analytics runs only with consent.
These providers may process data in the United States or other countries. Where GDPR applies we rely on their published transfer tools (such as Standard Contractual Clauses).
Retention
Guest device data lasts until you clear site data. Account records last while the account exists. Sessions expire. Point and item ledgers are kept to prevent cheating and restore balances. You can ask us to delete an account; we will drop personal identifiers and may keep aggregated, non-identifying gameplay counts.
Changes
We will update the date at the top of this page when the policy changes. Continued use after a material change means you should review the new text. Last updated 2026-08-18.