Apps by Joe Waldow
DE

Privacy Policy for the “Mahjong” App (Android)

Last updated: August 3, 2026

1. Who is responsible

Joe Waldow
Hasenbusch 52
25335 Elmshorn, Germany
Email: joe@waldow.app

2. The short version

Mahjong is built to be deliberately data-minimal:

  • No user account: The app works without any registration.
  • No ads and no tracking: There are no advertising SDKs, I do not build profiles about you, I do not follow you across other apps or websites, and I never share anything with ad networks or data brokers. The app explicitly removes the Android advertising ID permission from its manifest.
  • Your game progress stays yours: It lives on your device and, if you use Play Games or Android's app backup, in your personal Google account. I have no access to it.
  • I use service providers: for purchase processing (RevenueCat), for a small set of fully anonymous usage statistics (TelemetryDeck, a German company), and for the preview page of challenge links (Cloudflare). Details are below.

3. Game progress and settings

Your progress, stars, statistics, and settings are stored locally on your device. Two optional Google mechanisms can copy them into your own Google account:

  • Play Games Saved Games: If you are signed in to Play Games, the app stores your progress as a saved game so it is available on your other Android devices. The data lives in your personal Google account; I can neither see nor analyze it.
  • Android app backup: If you have Android's backup enabled in your system settings, Android copies app data to your Google Drive backup and restores it onto a new device. This is a Google system feature; I neither control it nor receive the data. Your cached purchase status is deliberately excluded from this backup.

Google's privacy policy applies to both: https://policies.google.com/privacy

4. Purchases (Full Version)

The app offers a single one-time in-app purchase (“Full Version”).

Google: Payment is handled exclusively by Google through the Play Store (Google Play Billing). I never receive your payment details (such as credit card numbers) or your name.

RevenueCat: To process and validate the purchase (for example, so the full version can be restored after you switch devices), I use RevenueCat, Inc. (California, USA) as a data processor. The following is processed:

  • a randomly generated, anonymous user identifier (no name, no email address),
  • your purchase history within this app (product purchased, time, price region),
  • technical details such as device type, operating system version, and language setting.

This data is used solely for purchase processing, restoring purchases, and fraud prevention, plus aggregate revenue statistics. It is not linked to your identity and is not used for advertising or tracking.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and reliable purchase restoration). Transfers to the USA are based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. More information: https://www.revenuecat.com/privacy

5. Play Games (optional)

Participation in Google Play Games is voluntary and begins when you sign in. Play Games may sign you in automatically when the app starts if your device is set up for it. As long as you are not signed in, nothing is submitted.

If you are signed in, the app submits your results to Google after a won game: your best times, your total stars, your best streak, and the achievements you have unlocked. Play Games also stores your saved game in your Google account (see section 3). On leaderboards, your Play Games player name, your profile picture and your times are visible to other players.

The “Compare times” switch in Settings only controls whether the app shows you your rank after a game. It does not stop the submission to Play Games. If you no longer want to send data to Play Games, sign out of Play Games in your device's Play Games settings.

Google is responsible for the processing inside Play Games; Google's privacy policy applies: https://policies.google.com/privacy The legal basis for the submission is your consent given by signing in to Play Games (Article 6(1)(a) GDPR).

You can challenge friends to a duel on the same board via a link, and they can send their result back to you the same way.

What the link contains. The level identifier, the board's random seed, the time to beat, the board variant, and your device's language setting. In addition — if you enter one — the sender name you chose yourself. That field is free text: if you put your real name in it, it becomes part of the link. You can always leave it empty. The link also carries a randomly generated identifier for your app installation. It exists solely so your own challenge can be recognised when the link comes back to you, and it allows no conclusions about you or your device. A result link additionally contains the time that was played.

How the link is sent. You choose how to send it — Messages, WhatsApp, email or anything else. That transmission is governed by the respective provider's privacy policy. I have no influence over it and learn nothing about it.

When the link is opened. Challenge links point to mahjong.waldow.app. If the app is installed, Android opens it directly. Otherwise — or if your messenger opens the link in its own browser — a preview page is served, hosted by my service provider Cloudflare (Cloudflare, Inc., USA, delivered from locations including the EU). As with any page request, Cloudflare processes technical connection data, in particular the IP address. Many messengers also fetch the page automatically to generate a preview card. The information contained in the link is used solely to display that page; I neither store nor evaluate it. No cookies or analytics services are used there.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in presenting the link you sent yourself in a way your counterpart understands and that helps them find the app. Cloudflare acts as a data processor for me; transfers to the USA are based on the European Commission's Standard Contractual Clauses and/or, where the provider is certified, the EU-US Data Privacy Framework.

Where results stay. Your challenges and their results are stored exclusively on your own devices (see section 3). There is no server that manages duels or aggregates results.

7. Reminders (optional)

If you switch on the daily reminder, the app schedules a local notification on your device. Nothing is transmitted; there is no push server involved.

8. Anonymous usage statistics (TelemetryDeck)

To improve the app, I collect anonymous usage statistics through TelemetryDeck, a service operated by TelemetryDeck GmbH (Augsburg, Germany). The following is transmitted:

  • which age group was chosen on first launch (youth / adult / senior), because it drives the legibility defaults,
  • whether the introduction was completed or skipped, and which category was opened first,
  • that the purchase screen was shown or a purchase was completed,
  • that the request for a Play Store rating was shown,
  • basic technical data such as app version, operating system version, device model, language and region, screen dimensions and time zone,
  • accessibility settings such as font size, bold text, colour inversion or “reduce motion”, so that legibility can be improved for them,
  • usage history: the start of a session, session length, number of sessions and the number of days played.

TelemetryDeck specializes in privacy-friendly statistics: device identifiers are anonymized on your device using a salted, irreversible hashing scheme. No advertising ID is used, IP addresses are not stored, and neither I nor TelemetryDeck can attribute the data to a person. The statistics exist only in aggregate form (“how many”, never “who”).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the app). Because the data is anonymized, no consent is required. More information: https://telemetrydeck.com/privacy

9. Rating request via Google Play

After a few won games, the app may ask you to rate it in the Play Store. The rating dialog is provided by Google itself (Play In-App Review); the app contacts Google Play for this. I only learn that the dialog was shown, not whether or how you rated. Google is responsible for the processing inside Google Play. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in receiving feedback about the app.

10. What I do NOT do

  • I do not show ads.
  • I do not track you: no following you across other apps or websites, no advertising ID, no sharing with ad networks or data brokers.
  • I do not sell data, and I do not share data with third parties (apart from the processors named above).
  • I do not collect location data, contacts, photos, or any other sensitive data.

11. Retention

The anonymous purchase data at RevenueCat is stored for as long as needed to provide the full version. The anonymous usage statistics exist only in aggregate form and cannot be attributed to a person. You delete local game data by uninstalling the app. A Play Games saved game can be deleted in the Play Games app; an Android backup can be removed in your Google Drive backup settings.

12. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). To exercise these rights, contact the email address above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country of your residence, your place of work or the place of the suspected infringement. For me as the controller, based in Schleswig-Holstein, Germany, the competent authority is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Because purchases are processed under an anonymous identifier only, I may be unable to match you to individual records; in that case I will assist you as far as possible (Art. 11 GDPR).

13. Children

The app is aimed at a general audience and does not collect any data beyond what is described above. That applies to children as well.

14. Changes

I will update this privacy policy if the app or the legal situation changes. The current version is always available at https://waldow.app/privacy-mahjong-android