Game Set Mahj Privacy Policy

Game Set Mahj LLC ("Game Set Mahj," "we," "us," or "our") respects your privacy and is committed to handling your information responsibly. This Privacy Policy describes how we collect, use, share, and protect information about you when you use our website at gamesetmahj.com or related services (the "Service"). By using the Service, you agree to this Privacy Policy. If you don't agree, please don't use the Service. This Privacy Policy is incorporated into and forms part of our Terms of Service.

1. Information We Collect

We collect information in three main ways: information you provide to us, information we collect automatically when you use the Service, and information from third parties.

1.1 Information you provide to us

When you create an account, use the Service, or communicate with us, you may provide us with:

• Account and profile information: full name, email address, password (if applicable), date of birth, profile photo, skill level, mahjong style preferences
• Contact information: phone number (optional, opt-in for host visibility), city, ZIP code
• Group and game information: groups you create or join, games you schedule or RSVP to, items you commit to bringing, members you invite, table assignments
• Messages and content: messages you send in group chats and game chats, comments, and other content you post on the Service
• Application data: information you provide when applying to be a founding member, including how many groups you play in and your role (player, host, both, teacher/organizer)
• Communications: information you send when you contact us by email, including the content of your messages
• Newsletter sign-ups: email address and any preferences you provide when subscribing to our newsletter
• Payment information (when applicable): if and when we introduce paid features, payment details will be collected and processed by third-party payment processors (such as Stripe). We don't store full credit card numbers.

1.2 Information we collect automatically

When you access or use the Service, we automatically collect certain information, including:

• Device and connection information: IP address, browser type and version, operating system, device identifiers, time zone, language preferences
• Usage information: pages and features you access, actions you take on the Service, time and date of your visits, the website you came from, links you click
• Authentication and session information: cookies, session tokens, login activity, and authentication state
• Email engagement: whether you open emails we send and whether you click links in them

We use cookies and similar technologies, including Google Analytics, to collect some of this information. See Section 5 for more about cookies.

1.3 Information from third parties

We may receive information about you from third parties, including:

• Authentication providers: if you sign in using Google or another authentication provider, we receive basic profile information from that provider
• Email service providers: information about email deliverability, opens, and engagement from services like Resend and Flodesk
• Payment processors (when applicable): information about your transactions (we don't see full payment details, but we receive confirmations and metadata)
• Analytics providers: aggregated data about how the Service is used, including from Google Analytics

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account
• Process and respond to your requests, RSVPs, invitations, and messages
• Verify your age and eligibility to use the Service
• Send you transactional emails (account confirmations, magic links, RSVP notifications, game reminders, host actions)
• Send you marketing emails about Game Set Mahj, including our newsletter (you can unsubscribe at any time)
• Personalize your experience and show you relevant content
• Improve, develop, and test new features and services
• Monitor and analyze usage trends, performance, and effectiveness
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues
• Enforce our Terms of Service and other policies
• Comply with legal obligations and respond to legal requests
• Process payments and manage subscriptions (when applicable)
• Communicate with you about updates, changes to our policies, and important announcements

3. How We Share Information

We share information in limited circumstances, as described below. We don't sell your personal information.

3.1 With other users

Some information is visible to other users by design:

• Your name, profile photo, and skill level are visible to other members of any group you join
• Your RSVPs, game attendance, and items you've claimed are visible to other group members
• Your messages in group chats and game chats are visible to other members of that group
• If you opt in to share your phone number with hosts, hosts of groups you join can see it for coordination purposes
• If you're a host, certain group management information about your groups (member lists, settings) is visible to you and any other members as appropriate

Be thoughtful about what information you share in profile fields, messages, and group content.

3.2 With service providers (sub-processors)

We share information with third-party service providers that help us operate the Service. These providers are bound by confidentiality obligations and are only allowed to use the information to provide services to us. Current sub-processors include:

• Supabase: database, authentication, and backend infrastructure
• Lovable: hosting and platform infrastructure
• Resend: transactional email delivery
• Flodesk: marketing email and newsletter management
• Namecheap: domain registration
• Google Analytics: usage analytics
• Stripe (when applicable): payment processing
• Twilio (when applicable): SMS messaging

This list may change over time. We update this Privacy Policy when we make material changes.

3.3 For legal reasons

We may disclose information if we believe it's necessary to:

• Comply with a law, regulation, legal process, or governmental request
• Enforce our Terms of Service or investigate potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of Game Set Mahj, our users, or the public

3.4 Business transfers

If Game Set Mahj is involved in a merger, acquisition, sale of assets, financing, or bankruptcy, your information may be transferred as part of that transaction. We'll notify you via email or a prominent notice on the Service before your information is transferred.

3.5 With your consent

We may share information for other purposes with your consent.

4. Data Retention

We keep your information for as long as we need it to provide the Service and for the purposes described in this Privacy Policy. Specific retention periods include:

• Account data (name, email, DOB, profile): retained while your account is active. If you delete your account, we delete this data within 30 days, except as required by law
• Group, game, and RSVP data: retained for the life of the group. If a group is deleted, this data is removed within 30 days
• Message content (group and game chats): retained for the life of the group
• IP addresses and security logs: 90 days
• Email logs and deliverability data: 90 days
• Newsletter subscribers (after you unsubscribe): email retained for 30 days for compliance, then deleted
• Payment records: 7 years (required by U.S. tax law)
• Backup data: 30 days after deletion (standard backup cycle)

In some cases, we may retain information longer if necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

5. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, understand how you use the Service, and personalize your experience.

5.1 Types of cookies we use

• Essential cookies: required for the Service to function, including authentication and session management. These can't be disabled without breaking the Service
• Functional cookies: remember your preferences and settings
• Analytics cookies: help us understand how users interact with the Service, including through Google Analytics

5.2 Managing cookies

Most browsers let you control cookies through their settings. You can usually block, delete, or be alerted when cookies are set. Note that blocking essential cookies will prevent you from using key features of the Service. You can also opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

6. Your Rights and Choices

6.1 Accessing and updating your information

You can access and update most of your account information directly in the Service through your profile and group settings. If you need help, contact us at hi@gamesetmahj.com.

6.2 Deleting your account

You can delete your account directly through the Service, or request that we delete your account by contacting us at hi@gamesetmahj.com. We'll delete your account and associated data within 30 days, except as required by law (for example, payment records). Some content you've contributed (such as messages in group chats) may remain visible to other group members even after your account is deleted, but it will no longer be associated with your name.

6.3 Downloading your data

You may request a copy of your personal data in a portable format (JSON) by contacting us at hi@gamesetmahj.com. We'll provide your data within the timeframe required by applicable law (generally 45 days).

6.4 Email preferences

You can opt out of marketing emails (including our newsletter) by clicking the unsubscribe link in any marketing email or by contacting us. You can't opt out of essential transactional emails (account verification, security notifications, and important changes to the Service) while you maintain an account.

6.5 State-specific privacy rights

Depending on where you live, you may have additional privacy rights under state law. We honor these rights for residents of all U.S. states with applicable privacy laws, including California, Colorado, Connecticut, Utah, and Virginia. These rights generally include:

• The right to know or access: request information about what personal data we collect about you, how we use it, and with whom we share it
• The right to delete: request that we delete your personal data, subject to certain exceptions
• The right to correct: request that we correct inaccurate personal data
• The right to portability: request a copy of your personal data in a portable format
• The right to opt out of sale or sharing: we don't sell your personal information. To the extent any of our analytics or advertising activity is considered "sharing" under California law, you have the right to opt out
• The right to opt out of profiling: we don't use automated decision-making or profiling that produces legal or similarly significant effects
• The right to non-discrimination: we won't discriminate against you for exercising your privacy rights

To exercise any of these rights, please contact us at hi@gamesetmahj.com. We'll respond within the timeframe required by applicable law (generally 45 days). We may need to verify your identity before processing your request.

6.6 Authorized agents

In some states, you can use an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization.

6.7 Appeals

If we deny your request, you may appeal our decision by contacting us at hi@gamesetmahj.com with the subject line "Privacy Appeal." We'll review the appeal and respond within the timeframe required by applicable law.

7. Children's Privacy

The Service is not directed to children under 13. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at hi@gamesetmahj.com and we'll take steps to delete that information.

Users between 13 and 17 may use the Service only with the permission of a parent or legal guardian, who must agree to our Terms of Service on the user's behalf. Some features of the Service (including paid features) may require users to be 18 or older.

We collect date of birth at signup to verify age eligibility. Users who indicate they are under 13 are blocked from creating an account.

8. Data Security

We use reasonable technical and organizational measures to protect the information we collect, including encryption in transit (HTTPS), authentication safeguards, and access controls on our systems. Our backend is provided by Supabase, which maintains industry-standard security practices including encryption at rest.

However, no system is perfectly secure. We can't guarantee that information will never be accessed by unauthorized parties. Please help protect your information by using a unique email account, keeping your account credentials secure, and notifying us at hi@gamesetmahj.com if you suspect unauthorized access to your account.

In the event of a data breach affecting your personal information, we will notify you within the timeframe required by applicable law (generally 30–90 days, depending on jurisdiction).

9. International Data Transfers

Game Set Mahj is based in the United States, and our service providers may be located in the United States or other countries. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to these transfers.

10. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications. We're not responsible for the privacy practices of these third parties. When you leave the Service, we encourage you to read the privacy policies of any third-party sites or services you visit.

11. Marketing Communications and CAN-SPAM

If you've signed up for our newsletter or other marketing emails, we'll send you periodic communications. We follow the requirements of the U.S. CAN-SPAM Act, including:

• Identifying our messages as marketing where required
• Including our physical mailing address in marketing emails
• Honoring opt-out requests promptly

To unsubscribe from marketing emails, click the unsubscribe link in any email or contact us at hi@gamesetmahj.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by posting the updated Privacy Policy on the Service and, where reasonable, by emailing you. The updated Privacy Policy will indicate when it was last revised.

Your continued use of the Service after changes take effect means you accept the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or our privacy practices, please contact us:

Game Set Mahj LLC
410 17th St
Denver, CO 80202
Email: hi@gamesetmahj.com

— End of Privacy Policy —