Privacy policy

1. Who is the data controller

The controller of personal data is [company name], [registered address], NIP [tax ID (NIP)], REGON [REGON], [KRS / CEIDG] (“we”).

For anything about personal data, write to support@hanzigames.com.

2. In short

• The game works without an account and without your name, e-mail address or phone number.
• We show no ads, use no advertising identifiers and never sell data.
• We do not collect location and do not use the microphone, camera or contacts.
• There is no chat and no free text in the game — nicknames come from a generator.
• hanzigames.com uses no cookies and no analytics tools.
• You can delete your account and data at any time.

3. What data the app processes

Gameplay data is pseudonymous: it is tied to a random identifier, not to a name or e-mail address. The game may record it offline and send it once the device is back online.

Settings (language, sound, sky style) and local progress are stored on your device. The sky behind the game is computed on the device for the middle of Poland — we never ask for your location.

4. What data the website processes

hanzigames.com is an information site. It needs no login, has no marketing forms, stores no cookies or browser storage and uses no analytics or advertising tools.

The mini game on the site runs entirely in your browser and neither sends nor stores anything.

Each visit is automatically logged by our hosting provider’s server: IP address, date and time, the page requested, browser and system type. These logs are used only to deliver the site, keep it secure and diagnose errors, and are deleted after [log retention period].

If you e-mail us, we process your address and message in order to reply.

5. Purposes and legal bases

• Providing the service — the game, saved progress, leaderboard, moving an account (Art. 6(1)(b) GDPR, the contract formed by accepting the terms of use).
• Security and abuse prevention, bug fixing, statistics and improving levels — our legitimate interest (Art. 6(1)(f) GDPR).
• Replying to messages and handling requests — legitimate interest (Art. 6(1)(f) GDPR).
• Legal obligations, e.g. handling complaints and data requests (Art. 6(1)(c) GDPR).
• Push notifications — sent only if you enable them in your device settings; you can turn them off at any time.

6. Children

Mahjong Hanzi is a game for the whole family and we design it to be safe for children. We do not collect contact details or free text from children and we do not rely on consent to process their data (in Poland, a person can consent to such services on their own from the age of 16).

Account features — linking an Apple or Google account, deleting the account and opening external links — sit behind a parental gate. Linking an account is done by a parent or guardian.

If you think we process a child’s data improperly, write to support@hanzigames.com.

7. Who processes data for us

We work with trusted providers who process data on our behalf under data processing agreements:

• app servers and databases — Hetzner Online GmbH (Germany, EU);
• storing and delivering game files — Amazon Web Services (EU region);
• hosting hanzigames.com — Vercel Inc.;
• push notifications — Google Firebase Cloud Messaging and Apple Push Notification service;
• sign-in (only after linking an account) — Apple (Sign in with Apple) and Google;
• e-mail — [e-mail provider].

[List to be confirmed before launch (TASK-022).] We do not sell data or share it with advertisers.

8. Transfers outside the EEA

Some providers (e.g. Vercel, Google, Apple) may also process data in the USA. In that case we rely on the safeguards provided by the GDPR: the European Commission’s EU-US Data Privacy Framework decision or standard contractual clauses. Write to us for a copy of the safeguards.

9. How long we keep data

• Account data — until the account is deleted.
• Guest accounts inactive for [24 months — to be confirmed] are deleted automatically.
• Detailed gameplay data — [period to be set], after which we keep only aggregates without identifiers.
• Backups — up to [number of days] days, then overwritten.
• Correspondence — as long as needed to handle the matter and any claims.

10. Your rights

You have the right to:

• access your data and receive a copy;
• rectify your data;
• erasure (the “right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on our legitimate interest.

To exercise your rights, write to support@hanzigames.com. We reply within one month. As we do not know your name or e-mail, we may ask for details that confirm the account is yours.

You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country.

11. Deleting your account

Delete your account in the app: Settings → Account → Delete account. If you cannot access the app, follow the steps on the account deletion page. We then delete the profile, scores, leaderboard entries, linked Apple or Google accounts, notification tokens and gameplay data tied to the account.

12. Security

Connections between the app, the site and our servers are encrypted (HTTPS). Account keys are kept in the system’s secure storage (Keychain on iOS, Keystore on Android). Only authorised people can access data on our servers.

13. Changes to this policy

We may update this policy, for example when we add a feature. The current version is always on this page with the date of the last change. We will announce significant changes in the app.