Privacy Policy

Last updated: July 5, 2026
Effective date: July 5, 2026

1. Who we are

MatchMyMahj ("MatchMyMahj," "we," "us," or "our") is operated by an individual sole proprietor located in North Carolina, United States.

MatchMyMahj operates the MatchMyMahj website and application (the "Service"), a tool that helps mahjong players organize an inventory of accessories and discover table combinations.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to your use of the Service.

If you have questions or want to make a privacy request, contact us at matchmymahj@proton.me.

2. Information we collect

2.1 Information you provide

Account information: your email address, a password (which we store only as a salted hash, never in plain text), and optional profile details you choose to add, including your first name, last name, and a unique nickname.
Content you create in the Service: your inventory items and tags, pairwise rankings, saved tables, scheduled mahjong events, comments you leave on tables, and product suggestions you submit.
Images you upload: photos you attach to saved tables. These images are stored using unlisted URLs through our hosting provider's file-storage service. They are not intentionally exposed to search engines or publicly listed, but anyone who obtains the direct URL may be able to access the image.
Social connections: the follow relationships you create, your table-sharing preferences, and any users you block.
Support and communications: the contents of support requests or other messages you send us.

2.2 Information collected automatically

Usage and analytics data: we use Google Analytics 4 to understand how the Service is used (for example, which features are used and how new users move through sign-up). See Section 5 for details.
Security and operational data: we keep limited records needed to operate the Service securely, such as failed-login records used to rate-limit sign-in attempts, and short-lived email-verification and password-reset tokens.
Infrastructure information: our hosting and service providers may collect technical and request information, including IP addresses, as part of operating, securing, and maintaining their services.

2.3 Payment information

If you upgrade to a paid plan, payments are processed by our payment provider, Lemon Squeezy.

We do not collect or store your full payment card or bank details on our servers.

We store identifiers that associate your account with your subscription, including a customer ID, subscription ID, subscription status, plan tier, and current billing-period end date, so we can provide the features you have paid for.

Lemon Squeezy's handling of payment information is governed by its own privacy policy.

3. Cookies and similar technologies

We use cookies and similar technologies to operate the Service, maintain authenticated sessions, improve security, and understand how the Service is used.

The cookies we currently use fall into two categories:

Essential cookies: used to authenticate users, maintain signed-in sessions, and provide account functionality. These cookies are necessary for the Service to operate.
Analytics cookies: used by Google Analytics 4 to understand feature usage, measure engagement, and improve the Service.

You can control cookies through your browser settings. Blocking analytics cookies will not prevent you from using the Service, but disabling essential cookies may affect your ability to sign in or use certain features.

4. How we use your information

We use the information described above to:

create and maintain your account and verify your email address;
provide the core Service, including storing your inventory, computing matches, saving tables, running events, and enabling social features you choose to use;
process subscriptions and enforce plan features and limits;
send transactional emails, including verification emails, password resets, support replies, and certain account-related notifications;
review and respond to support requests and product suggestions;
keep the Service secure and prevent abuse, including rate-limiting sign-in attempts; and
understand and improve how the Service is used through analytics.

We do not sell your personal information.

5. Google Analytics

We use Google Analytics 4 ("GA4"), a service provided by Google, to understand how the Service is used.

5.1 What GA4 collects

GA4 collects information such as user counts, session statistics, approximate geolocation, browser information, and device information.

GA4 stores identifiers in first-party cookies, including _ga, to distinguish users and sessions.

We also send GA4 a limited number of custom events reflecting actions within the Service, such as creating an item or saving a table.

5.2 Identity — pseudonymous only

When you are signed in, we associate analytics activity with a pseudonymous account identifier (a random UUID) so we can understand retention and returning-user behavior.

We do not send Google your email address, name, nickname, or other directly identifying information as part of analytics.

5.3 IP addresses

Google Analytics uses IP addresses transiently to derive approximate geographic information but does not provide individual IP addresses within Analytics reports.

We do not intentionally send directly identifying information to Google Analytics.

5.4 Data retention

GA4 automatically deletes user-level and event-level data after retention periods configured within our Analytics settings. Our property is configured to retain event-level data for 2 months and user-level data for 14 months.

Certain aggregated reports are not affected by these retention settings.

5.5 Your analytics choices

You can prevent GA4 from collecting usage data by using Google's Google Analytics Opt-out Browser Add-on or by using browser settings or extensions that block analytics scripts and cookies.

Blocking analytics does not affect your ability to use the Service.

For more information about how Google uses data, see Google's documentation at:

https://policies.google.com/technologies/partner-sites

6. How your information is shared

We share information only as described here.

Service providers

We rely on third-party providers to operate the Service. They process information on our behalf and currently include:

Vercel — application hosting and image storage;
Neon — PostgreSQL database hosting;
Google Analytics — usage analytics;
Resend — transactional email delivery; and
Lemon Squeezy — payment processing.

Other users

Certain information may be visible to other authenticated users according to your sharing settings.

Saved tables are visible only to users permitted by your selected sharing preference (Followers, Friends Only, or Nobody).

Comments associated with a shared table are visible to users who are permitted to view that table.

Uploaded images associated with shared tables may be accessible through their direct URLs. These URLs are not intentionally exposed publicly or indexed by search engines.

Legal and safety

We may disclose information if required by law or if reasonably necessary to protect the rights, safety, or property of MatchMyMahj, our users, or others.

Business transfers

If MatchMyMahj is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

7. Data retention

Account and content

We retain your account and content for as long as your account remains active.

If you delete your account, we remove your account and associated information from our active systems, including your inventory items, rankings, saved tables, events, comments, and related records.

Limited copies of information may remain in provider-managed backups for a short period before being automatically overwritten.

Analytics data

Analytics data is retained according to the retention settings configured within Google Analytics.

Operational records

Security-related records, verification tokens, password-reset tokens, and similar operational information are temporary and expire or are removed during normal operation of the Service.

8. Your choices and rights

You may:

access and update your profile information through account settings;
delete your account;
change your sharing preferences at any time;
block other users;
opt out of analytics as described in Section 5; and
contact us regarding questions or requests relating to your information.

The emails we send are transactional in nature and may include account verification messages, password-reset emails, support replies, and account-related notifications.

We do not currently send marketing or promotional emails.

Depending on where you live, you may have additional rights regarding your personal information, including rights to access, correct, delete, or obtain a copy of your information, subject to applicable law.

To make a request, contact us at matchmymahj@proton.me.

9. Security

We take reasonable measures designed to protect your information.

Passwords are stored only as salted hashes.

Access to user content is limited through authentication and authorization controls.

Payment-card details are handled by our payment processor rather than stored on our servers.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to us, please contact matchmymahj@proton.me, and we will take steps to delete the information.

11. International users

The Service is operated from the United States, and information may be processed and stored in the United States.

By using the Service, you understand that your information may be transferred to and processed in the United States.

12. Changes to this policy

We may update this Privacy Policy from time to time.

When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice.

Your continued use of the Service after the effective date of an updated Privacy Policy is subject to the revised Privacy Policy.

13. Contact us

Questions, requests, or privacy inquiries may be sent to:

matchmymahj@proton.me