Privacy Policy — Mahjong Axions

Publisher: AxionsLab inc. — corporation, 4-400 48e rue O, Québec (QC) G1H 5G6, Canada — NEQ 1233438649 Last updated: 4 October 2026 Contact: contact@axionslab.io

In one sentence

Mahjong Axions is played with no sign-up: no email, no name, no password. Your progress is stored on your device; our server only knows an anonymous account — a random identifier, the nickname you may choose, and your games — to compute plaques and leaderboards. We sell no data, and nothing in this game is ever paid for — in any form.

1. What is stored on your device

The game saves your progress to a file in the app's private storage on your device — a location other apps cannot read. It holds:

• your level, completed levels, coins and helpers;
• your streaks — consecutive days, consecutive wins — and your personal bests;
• your settings: sound, music, vibration, language, accessibility options;
• your player identifier, drawn at random by the game on first launch. It contains nothing about you: no name, no address, no device identifier;
• your nickname, if you chose one;
• games not yet sent to our server, and the last leaderboard received for your group (nicknames and scores), so it can be shown offline;
• whether the screen explaining advertising has already been shown to you, so we never show it twice.

Alongside that file, the game keeps the secret token of your online account (§5) and a technical log of gameplay events, capped at 2 MB, which never leaves the device.

Your advertising consent choice (§3) is stored on the device by the Google tool that collects it.

Uninstalling the game erases these files from the device. For the copy Android backup may keep in your Google account, see §6.

2. What we do not collect

We never request, read or store any of the following:

• name, postal address, email address, phone number;
• hardware device identifiers (serial number, ANDROID_ID, MAC address);
• precise location;
• contacts, photos, microphone, camera, files;
• payment details — there are no purchases in this game, so there is nothing to pay with.

The only permission the game asks you for is to show notifications (§7), and you can decline it. The technical permissions it otherwise declares — internet access, advertising identifier (§3) — give no access to any of the data above.

3. Advertising

No video is forced on you. There are no interstitials and no ads between games. The only videos in this game are rewarded videos that you choose to watch, by tapping a button that states the reward up front.

Some players also see a small advertising banner at the top of the game screen, which never interrupts play. The game's "Our promise" screen tells you whether this applies to you.

These ads are served by Google AdMob. To display them, AdMob may process your device's advertising identifier and technical information (model, system, language, country, IP address).

• Google's policy: https://policies.google.com/privacy
• Your Google ad settings: https://adssettings.google.com

Your choice. If you live where the law requires it (the European Economic Area, the United Kingdom, Switzerland among others), a Google form (UMP, User Messaging Platform) asks for your consent, purpose by purpose, before any personalised advertising. You can change it at any time: Settings → Ad preferences. Elsewhere, that form is not shown and ads may be personalised; you can limit or reset the advertising identifier in your device settings.

Declining removes no reward: videos grant exactly the same thing, they are simply less targeted. The game states this commitment itself, in its "Our promise" screen.

4. Analytics and crashes

To understand what works in the game and what blocks players, we record gameplay events. They describe actions, never people:

• app opens;
• level started, completed, abandoned or lost, and how long it took;
• helpers used, peak tray occupancy, plaques earned;
• quests, day and win streaks;
• videos requested, shown, completed or failed;
• your answer to the consent form;
• leaderboard views and season end, if leagues are open.

These events are processed by Google Firebase Analytics and attached to your player identifier (§1), never to your identity.

Consent first. Analytics starts denied — including for the events Firebase sends on its own at launch — and only opens with UMP's answer (§3): outside the areas where consent is required, it opens fully; inside them, it follows your choice, purpose by purpose (analytics, storage on the device, advertising use). Firebase applies those refusals through Google's "consent mode"; in particular, it only uses the advertising identifier if you accepted the advertising purposes.

We run no targeted advertising from this data, and we do not sell it. Identifier-level analytics data is kept for fourteen months at Google; only aggregated statistics remain afterwards.

Crashes. If the game crashes, Firebase Crashlytics receives a report: device model, system version, the technical state of the app at the time of the crash, and your player identifier, to link crashes together — never the content of your game. These reports are used only to fix the game, and are sent whatever your advertising choice.

Google's policy: https://policies.google.com/privacy.

5. Online account and leaderboards

An anonymous account. The first time the game runs with an internet connection, it opens an account on our server: it sends your player identifier (§1), and the server hands back a secret token that then proves it is really you. No email, no name, no device identifier. Our server only keeps a cryptographic hash of the token.

What the server receives:

• your player identifier;
• your nickname, if you chose one;
• each of your games: the board played and its seed, number of moves, duration, helpers used, win or not, date, your day streak and the number of videos watched that day.

From those games, the server computes your plaques, your group and your league. It receives neither your level progress, nor your coins, nor your settings, nor any device data. These uploads happen even while leagues are not open in the game: that is what lets them open without losing games already played.

Like any server, it sees the connection's IP address; it uses it only in memory, to limit the number of requests, and does not store it in its database. Traffic is encrypted (HTTPS).

Your nickname. You can choose a nickname of 3 to 16 characters — letters and digits from any script, space, hyphen, underscore — in the Profile screen. It is sent to our server and visible to the other players in your group on the league leaderboard, with your plaques and rank. Without a nickname, you appear under a default name, "Player" followed by four digits derived from your identifier. Choose a nickname that does not identify you: no full name, no contact details.

Nicknames are not filtered automatically. If a nickname seems offensive or inappropriate to you, report it to contact@axionslab.io: we can erase it, and its owner then gets the default name back. There are no messages, photos or other player-written content.

Where. This server is run by AxionsLab and hosted by Hetzner Online GmbH (Germany, European Union), at mahjong-api.axionslab.io. This data is kept for as long as the account exists: until you ask for it to be erased (§10), or at the latest twelve months after your last game — an account that has played no game for a year is erased automatically, in the same way.

6. Google backup (Android)

Android offers automatic backup of apps to the phone's Google account. When it is on, your local progress (levels, coins, streaks, settings, nickname) may be copied there, then restored on a new device. That copy is managed by Google; we have no access to it.

The online account token and the technical log are excluded: on a new device, the game gets your progress back but opens a new online account, under a new identifier.

You can turn this backup off in your device settings (under Google → Backup, depending on the model).

7. Notifications

Notifications are optional. The game offers them once, after level 3; if you decline, it never asks again. If you accept:

• a streak reminder, in the evening at 9 pm, when your day streak is at stake and today is not complete yet;
• once only, an absence reminder, on the third day without completing a day.

Never more than one notification a day. They are scheduled on the device by the game itself: no notification server, no data sent. You can turn them off at any time in your device settings.

8. Where your data is processed

• Our server: European Union (Germany), at Hetzner (§5).
• Google (AdMob, UMP, Firebase Analytics, Crashlytics, Android backup): on its own servers, which may be outside Québec and Canada, notably in the United States, under its own protection commitments: https://policies.google.com/privacy.

Your information may therefore be communicated outside Québec.

9. Children

Mahjong Axions is intended for people aged 14 and over — in Québec, the law requires a parent's consent to collect information about a child under 14. It contains rewarded advertising. We do not knowingly collect data from a child; if you believe a child has sent us data, write to us and we will erase it.

10. Deleting your data, and your other rights

In the game: Settings → Delete my data. After confirmation, the game:

• erases from the device the save, its backup copy, the token and the technical log;
• asks our server to erase everything carrying your identifier: the account, nickname, games and league group places. Without a network, the request is kept on the device and sent again at every launch until the server confirms it;
• resets the device's Firebase analytics data.

The game then starts over, under a new identifier.

Outside the game — for instance if you uninstalled it — write to contact@axionslab.io with your player identifier and your deletion code (both shown in Settings → About). The code proves the request comes from you: the identifier alone is visible in leaderboards. We erase everything carrying the identifier on our server within 30 days at most. The full procedure is on the Support → Delete my data page: https://axionslab.io/games/mahjong-axions/support.

Data already sent to Google (analytics, crashes) is erased according to its retention periods (§4). The Android backup copy (§6) is replaced at the next automatic backup; you can also delete it from your Google account.

Your rights. Depending on where you live you have rights of access, rectification, erasure, objection and portability — Québec's Law 25, the GDPR in Europe, the Digital Personal Data Protection Act in India, and equivalents elsewhere. contact@axionslab.io is how to exercise them; include your player identifier, without which we cannot tell which data is yours. We reply within thirty days.

Person in charge of the protection of personal information: Jeremy Coquet, President of AxionsLab inc., reachable at contact@axionslab.io.

You may also lodge a complaint with Québec's Commission d'accès à l'information (https://www.cai.gouv.qc.ca) or your country's data protection authority.

11. Changes

Any change to this policy will be published on this page, with its date. If a change widens what we collect, it will be announced inside the game before it takes effect — not only here.