Apps by Joe Waldow
DE

Privacy Policy for the “Mahjong” App

Last updated: August 3, 2026

1. Who is responsible

Joe Waldow
Hasenbusch 52
25335 Elmshorn, Germany
Email: joe@waldow.app

2. The short version

Mahjong is built to be deliberately data-minimal:

  • No user account: The app works without any registration.
  • No ads and no tracking: There are no advertising SDKs, I do not build profiles about you, I do not follow you across other apps or websites, and I never share anything with ad networks or data brokers.
  • Your game progress stays yours: It lives on your device and, if you use iCloud, in your personal iCloud account. I have no access to it.
  • I use service providers for purchase processing (RevenueCat), for anonymous usage statistics (TelemetryDeck, a German company) and for the preview page of challenge links (Cloudflare). Details are below.

3. Game progress and settings

Your progress, stars, statistics, and settings are stored locally on your device. If you have iCloud enabled, Apple syncs this data between your devices (iPhone, iPad, Mac, Apple TV and Apple Vision Pro) via the iCloud key-value store. This data lives exclusively in your personal iCloud account with Apple; I can neither see nor analyze it. Apple's privacy policy applies: https://www.apple.com/legal/privacy/

4. Purchases (Full Version)

The app offers a single one-time in-app purchase (“Full Version”).

Apple: Payment is handled exclusively by Apple through the App Store. I never receive your payment details (such as credit card numbers) or your name.

RevenueCat: To process and validate the purchase (for example, so the full version can be restored after you switch devices), I use RevenueCat, Inc. (California, USA) as a data processor. The following is processed:

  • a randomly generated, anonymous user identifier (no name, no email address),
  • your purchase history within this app (product purchased, time, price region),
  • technical details such as device type, operating system version, and language setting.

This data is used solely for purchase processing, restoring purchases, and fraud prevention, plus aggregate revenue statistics. It is not linked to your identity and is not used for advertising or tracking.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and reliable purchase restoration). Transfers to the USA are based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. More information: https://www.revenuecat.com/privacy

5. Game Center (optional)

Taking part in Game Center is voluntary and begins with you signing in. As long as you are not signed in to Game Center, nothing is submitted.

If you are signed in, the app submits your results to Apple after a won game: your best time for that level, your total stars, your best streak, your daily puzzle time and your weekly stars, along with the achievements you unlocked. There is one leaderboard per level plus several overall leaderboards.

Please note: leaderboards at Apple are public. Other players can see your Game Center nickname, your Game Center picture and your times. If you use the friends feature, Apple additionally shows you the names of Game Center friends; the operating system asks for your permission for this.

The “compare times” switch in the settings controls whether the app shows you your rank after a game. It does not stop submission to Game Center. If you no longer want to send data to Game Center, sign out under Game Center in your iOS settings or disable Game Center for this app.

Apple is responsible for the processing inside Game Center; Apple's privacy terms apply. The legal basis for the submission is your consent through signing in to Game Center (Article 6(1)(a) GDPR).

You can challenge friends to a duel on the same board via a link, and they can send you their result back the same way.

What the link contains. The level identifier, the board's random seed, the time to beat, the board variant and your device's language setting. In addition — if you enter one — the sender name you chose yourself. This field is free text: if you enter your real name there, it becomes part of the link. You can always leave it empty. The link also contains a randomly generated identifier of your app installation. It serves solely to recognise your own challenge when the link comes back to you and allows no conclusion about you or your device. A result link additionally contains the time played.

How the link is sent. You choose what you send it through — for example Messages, WhatsApp or email. The privacy policy of that provider applies to the transmission. I have no influence over it and learn nothing about it.

When the link is opened. Challenge links point to mahjong.waldow.app. If the app is installed, iOS opens it directly. Otherwise — or if your messenger opens the link in its own browser — a preview page is served, hosted by my service provider Cloudflare (Cloudflare, Inc., USA, with delivery also through locations in the EU). In doing so, Cloudflare processes technical connection data as with any page request, in particular the IP address. Many messengers also fetch the page automatically to generate a preview card. The information contained in the link is used solely to display that page; I neither store nor evaluate it. No cookies and no analytics services are used there.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in presenting the link you sent yourself in a way your recipient understands and can act on. Cloudflare acts as a processor on my behalf; transfer to the USA is based on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

Where the results stay. Your challenges and their results are stored exclusively on your own devices (see section 3). There is no server that manages duels or aggregates results.

7. Anonymous usage statistics (TelemetryDeck)

To improve the app, I collect anonymous usage statistics through TelemetryDeck, a service operated by TelemetryDeck GmbH (Augsburg, Germany). The following is transmitted:

  • which age group was chosen on first launch (youth / adult / senior), because it drives the legibility defaults,
  • whether the introduction was completed or skipped, and which category was opened first,
  • that the purchase screen was shown or a purchase was completed,
  • basic technical data such as app version, operating system version, device model, language and region, screen dimensions and time zone,
  • accessibility settings such as font size, bold text, colour inversion or “reduce motion”, so that legibility can be improved for them,
  • usage history: the start of a session, session length, number of sessions and the number of days played.

TelemetryDeck specializes in privacy-friendly statistics: device identifiers are anonymized on your device using a salted, irreversible hashing scheme. No advertising ID is used, IP addresses are not stored, and neither I nor TelemetryDeck can attribute the data to a person. The statistics exist only in aggregate form (“how many”, never “who”).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the app). Because the data is anonymized, no consent is required. More information: https://telemetrydeck.com/privacy

8. Reminders (optional)

Mahjong can remind you about the daily puzzle. Only local notifications on your device are scheduled for this; there is no push server, and I send no promotional messages. You can switch notifications off at any time in the app or in your system settings. The legal basis is your consent by enabling the reminder (Article 6(1)(a) GDPR).

9. What I do NOT do

  • I do not show ads.
  • I do not track you: no following you across other apps or websites, no advertising ID, no sharing with ad networks or data brokers.
  • I do not sell data, and I do not share data with third parties (apart from the processors named above).
  • I do not collect location data, contacts, photos, or any other sensitive data.

10. Retention

The anonymous purchase data at RevenueCat is stored for as long as needed to provide the full version. The anonymous usage statistics exist only in aggregate form and cannot be attributed to a person. You delete local game data by deleting the app; iCloud data can be removed in your device's iCloud settings.

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). To exercise these rights, contact the email address above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country of your residence, your place of work or the place of the suspected infringement. For me as the controller, based in Schleswig-Holstein, Germany, the competent authority is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Because purchases are processed under an anonymous identifier only, I may be unable to match you to individual records; in that case I will assist you as far as possible (Art. 11 GDPR).

12. Children

The app is aimed at a general audience and does not collect any data beyond what is described above. That applies to children as well.

13. Changes

I will update this privacy policy if the app or the legal situation changes. The current version is always available at https://waldow.app/privacy-mahjong