Privacy Notice

This Privacy Notice explains how YF Apps, LLC ("YF Apps", "we", "us") collects, uses, and shares personal data when you use Mahjong Pop at mahjongpop.app (the "Service"). YF Apps is the data controller for personal data processed through the Service.

1. Data we collect

• Account data — when you sign in with Google, we receive your name, email address, Google account ID, and profile picture URL.
• Subscription data — plan, status, current period end, and the Paddle customer/subscription identifiers linked to your account.
• Gameplay & product analytics — anonymous session identifier, events such as app loads, games started/finished, outcomes, ruleset/difficulty/environment/tile-style selections, and pricing interactions.
• Support communications — messages you send us and our replies.
• Technical data — IP address, user agent, and timestamps collected by our hosting and backend providers for security, abuse prevention, and reliability.

2. How we use it

• To provide, secure, and improve the Service (contract performance and legitimate interests).
• To create and manage your account and Pro entitlement (contract performance).
• To detect fraud, abuse, and security incidents (legitimate interests, legal obligation).
• To understand product usage in aggregate and improve gameplay (legitimate interests).
• To respond to support requests (contract performance / legitimate interests).
• To comply with legal, tax, and accounting obligations (legal obligation).

3. Who we share it with

• Paddle.com Market Limited — our Merchant of Record. Paddle processes payments and handles billing, tax, invoicing, refunds, and chargebacks. Paddle is an independent controller for the payment data it collects.
• Google — for authentication when you sign in with a Google account.
• Hosting and backend providers — for application hosting, database, edge functions, and email delivery.
• Professional advisers — accountants and lawyers, when reasonably necessary.
• Authorities — where required by law, legal process, or to protect rights and safety.

We do not sell your personal data.

4. International transfers

We and our providers may process personal data in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for transfers out of the UK/EEA.

5. Retention

We keep account data for as long as your account exists and for a reasonable period thereafter to comply with legal obligations and resolve disputes. Analytics events are retained in aggregate. You can request deletion at any time (see below).

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. UK/EEA residents have these rights under the UK GDPR / EU GDPR and may complain to their local supervisory authority. California residents have rights under the CCPA/CPRA. To exercise any of these rights, email privacy@mahjongpop.app. We respond within one month.

7. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege server credentials — to protect personal data. No system is perfectly secure.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember gameplay preferences. Paddle sets cookies during checkout to process your payment. We do not currently use advertising cookies.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from them.

10. Changes

We may update this notice from time to time. Material changes will be highlighted on this page.

11. Contact

YF Apps, LLC — privacy@mahjongpop.app. See also our Terms of Service and Refund Policy.