Privacy Policy

GENERATED FILE - DO NOT EDIT BY HAND.

Source of truth: Assets/_Project/Presentation/UI/PrivacyPolicyContent.cs

Published at: https://uncommoncreations.co.uk/privacy-policy (the URL given to Google Play)

This is the same text the game shows in-app (Main Menu > Privacy). Edit the C# and

re-generate, so the hosted policy and the in-game policy can never drift apart.

----------------------------------------------------------------------

This policy explains what information Legends of Mahjong ("the Game", "we", "us") collects, why, and how you can control it. Last updated: 12 September 2026.

The short version: you never have to give us any personal information to play. Signing in with a Google account is entirely optional and only unlocks features we build on top of it later (like syncing your stats across devices) — see "Playing as a Guest" below. On the Steam release specifically, sign-in happens automatically using your Steam identity — see "Signing In Automatically on Steam" for exactly what that means and how to turn it off.

WHO CONTROLS YOUR DATA

The data controller responsible for the information described in this policy is Uncommon Creations Ltd, the company behind Legends of Mahjong. Alex Chung remains the accountable individual responsible for how your data is processed. You can reach us for any privacy question or request at contact@uncommoncreations.co.uk.

PLAYING AS A GUEST

By default, the Game plays entirely as a guest: your display name, chosen avatar, and match history are stored ONLY on your own device (in your device's local app data folder), and are never sent to us. A random, locally-generated device identifier is sent to our multiplayer relay server when you join an online match purely so it can tell your seat apart from the other players' for the duration of that match — the relay server keeps no record of it once the match ends and never links it to anything else.

WHAT WE COLLECT IF YOU SIGN IN

If you choose to sign in with Google, we receive and store: the unique identifier and email address Google's own sign-in flow shares with us, an internal account ID we generate for you, and a security session record so you can stay signed in (described in "Sessions and Security Tokens" below). Google also tells us the display name on your Google account. We do not store that on our servers at all — it is passed straight to your device and used only to fill in your in-game profile name for you, and only if you have not already chosen one yourself. You can change it at any time in the game, and doing so does not change anything at Google. We never see or store your Google password — sign-in happens entirely on Google's own page, in your own system browser, and Google only ever hands us a one-time authorization code, never your credentials.

SIGNING IN AUTOMATICALLY ON STEAM

On the Steam release of the Game specifically, signing in works differently from the Google flow above: the moment you launch the Game through Steam, we automatically recognize your Steam account and sign you in, using a one-time cryptographic ticket Steam itself provides and that we verify directly with Valve's own servers. Just like Google, we never see or store your Steam password — the same trust boundary described above applies here too, just without a separate tap.

You're always in control of this: tapping "Sign Out" in the Game's Profile panel signs you out immediately and tells the Game to remember your choice, so automatic sign-in won't happen again on future launches either — you'll play as a guest (see "Playing as a Guest" above) until you explicitly tap "Sign In" again.

If you already had an account from signing in with Google elsewhere (for example, on Android or a non-Steam Windows download), launching the Steam release for the first time links your Steam identity to that SAME existing account rather than creating a second, separate one.

SESSIONS AND SECURITY TOKENS

When you sign in, we issue a short-lived access token and a longer-lived refresh token so you don't have to sign in again every time you launch the Game. Only a one-way cryptographic hash of your refresh token is ever stored on our servers — the actual token exists only on your own device. Each time your session is renewed, the old token is invalidated and a new one issued; if an already-invalidated token is ever presented again (a sign that it may have been copied by someone else), we treat that as a possible compromise and end every active session on your account, requiring you to sign in again.

SECURITY LOGGING AND IP ADDRESSES

We keep a security log of sign-in attempts — successful and unsuccessful — including the IP address and browser/device type involved and, where an attempt resolves to a real account, which account. This exists to detect and slow down abusive patterns (for example, a script trying many sign-ins very quickly) and to give us a factual basis for investigating suspicious activity or blocking a specific account or IP address. This log is not shared, sold, or used for advertising or profiling of any kind.

Being honest about its limits: this log helps us detect and throttle abuse aimed at individual accounts or sign-in attempts. It does not, on its own, protect against a large-scale flood of traffic aimed at our servers generally — that kind of protection comes from our hosting provider's own network-level defenses, not from anything in this log.

WHY WE PROCESS YOUR DATA

We process the information above for two reasons recognized under data protection law: to provide the account/sign-in feature you've actively chosen to use (this is necessary to perform that feature, and you consent to it by choosing to sign in), and to protect the security of accounts and our servers, including the sign-in audit log described above (our legitimate interest in keeping the service secure and available, weighed against your own privacy — kept to what's genuinely needed for that purpose, and never used for anything else).

WHAT WE DON'T YET COLLECT

As of this version of the Game, your match results and gameplay statistics are stored ONLY locally on your own device, even if you're signed in — we do not currently receive or store them on our servers at all. A future update may add the ability to sync your stats to your account across devices; if and when that happens, this policy will be updated first, and it will remain something you can opt out of by simply not signing in.

THIRD PARTIES WE USE

We rely on a small number of third-party services to provide the Game's online features, each acting on our instructions as a data processor:

• Google, to let you sign in without creating a separate password for us. Your interaction with Google's own sign-in page is covered by Google's own privacy policy, not ours.

• Valve (Steam), on the Steam release, to let us verify your Steam identity for the automatic sign-in described above. This happens through a direct server-to-server call to Valve's own systems — covered by Valve's own privacy policy for that part of the exchange, not ours.

• Neon, who host the database holding your account, session, and security-log records.

• Fly.io, who host the servers our Game's account and multiplayer features run on.

We don't sell your data to anyone, and we don't use it for advertising.

WHERE YOUR DATA IS STORED

Account, session, and security-log data is currently stored in a database hosted in the United Kingdom (London). If our hosting setup ever changes to store data outside the UK/EU, we'll update this section and put appropriate safeguards in place first.

HOW LONG WE KEEP YOUR DATA

Session records are kept until they expire or are revoked, plus a short additional period to allow reuse-detection (see "Sessions and Security Tokens"). Security sign-in log entries are kept for up to 12 months, after which they're deleted automatically. Your account record itself is kept until you ask us to delete it.

YOUR RIGHTS

Wherever you're located, you can ask us to: give you a copy of the personal data we hold about you; correct it if it's wrong; delete your account and everything tied to it; restrict or object to how we're using it; or receive it in a portable format. If you signed in with Google, you can also simply stop signing in at any time — nothing about playing the Game requires it. On the Steam release, tapping "Sign Out" achieves the same thing and is remembered for future launches too (see "Signing In Automatically on Steam"). If you're in the EU or UK, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office) if you think we've gotten something wrong.

DELETING YOUR ACCOUNT OR DATA

You can delete your account yourself, at any time, from inside the Game: Main Menu, Profile, Delete Account. That permanently removes your account, your Google or Steam sign-in link, and every signed-in session, and it cannot be undone. Your match history and profile stay on your own device, because they were never sent to us in the first place.

You can also request deletion without installing the Game, at https://uncommoncreations.co.uk/delete-account. For a copy of your data, or to ask us to correct it, email contact@uncommoncreations.co.uk from the address you signed in with if possible. We aim to respond within 30 days.

CHILDREN'S PRIVACY

The Game is not directed at children under 16, and we don't knowingly collect personal information from anyone under that age through the sign-in feature. If you believe a child has signed in and shared personal information with us, please contact us and we'll delete it.

CHANGES TO THIS POLICY

We may update this policy as the Game changes — most notably if we ever start storing gameplay statistics on our servers (see "What We Don't Yet Collect"). We'll update the "Last updated" date above whenever we do.

Questions, requests, or concerns about your privacy: contact@uncommoncreations.co.uk.

Privacy Policy

This website uses cookies.