Privacy Policy

Last updated 12 October 2026

Friends at Mahjong is run by Phatlinks.com L.L.C. (“Phatlinks”), a Florida limited liability company that trades as Mahjong Lexington. We collect what we need to sign you in, keep your game, and understand how people find the site and what helps them decide to join. Almost all of it stays on our own systems; the few outside services that see any of it are listed below, under “Who else sees it”. There are no ads in Friends at Mahjong, for anyone, and we do not sell your information. We do advertise Friends at Mahjong on Microsoft’s search engine, Bing, and on the website we use Microsoft’s advertising tag to count how many of the people who click those ads go on to make an account.

What we collect

Your account. A display name, and the email address or mobile number you sign in with — or both, if you give us both. If you add a profile picture we store the file. That is the whole account record.

Sign-in records. Because sign-in uses a one-time code rather than a password, each attempt writes a short-lived row containing the email address or mobile number you entered, a hashed copy of the code, the IP address and browser the request came from, and how many times it was tried. We never store the code itself in a readable form.

Your session. While you are signed in we keep a session record with your IP address, your browser's user-agent string, and when you were last active, so we can keep you signed in and spot a session that isn't you. If you mark a device as trusted, we store a token for it.

The iPhone app. When you use the iPhone app, our server gives that install a random ID, so that it can count your free game and keep you signed in. With it we note whether it is an iPhone or Android install, which account last signed in on it, and roughly when it was last used. If you allow notifications, we also store the token Apple gives the app for sending notifications to that device, which of our apps it belongs to, and when the app last sent it to us. The app asks for permission only when you choose to turn notifications on, never when it opens, and sends us the token only while you are signed in.

Friends at Mahjong Solitaire. The same account signs you in to Friends at Mahjong Solitaire, at mahjonggsolitaire.app and in its app. When you play it signed in, we keep the boards you finish (the layout, your moves, your score and how long it took), the board you are in the middle of, how far you are along its Journey, your settings for it, and the Journey destinations you buy in its iPhone app. Our product-analytics system, described below, also records your Solitaire play, apart from what you do here and against your account number only: the day you first used Solitaire, and whether your account was new then; once a day, that you used it; your first board won; each board you win and what kind it was (a Journey level with its number, Journey and edition, the Daily, or a free board); each purchase, with what was bought and in which app store, but not the price; and whether you played in the app on an iPhone or iPad, in the app on Android, or on the website. Nothing is recorded while you play as a guest. If you reached mahjonggsolitaire.app from another site or through a link with campaign tags before signing in there, we keep where you first came from (the site’s name and those tags) with your account, and it goes with your first Solitaire entry and with your purchases. When you start playing Solitaire and when you first buy something in it, our own advertising-measurement system also receives your account number, the time and, if we have it, where you first came from, so that we can measure which of our ads bring players. No other company receives any of these entries; only totals worked out from them go to the AI services described under “Who else sees it”. The Friends at Mahjong Solitaire privacy policy describes all of this in full.

Mahjong Lexington club membership. Mahjong Lexington is our own club, and a membership there includes one here. Once you have confirmed your email address, our server asks mahjonglexington.com whether that address belongs to a club member, and which membership they hold. If it does, we keep a short record with your account: the membership, a scrambled copy (a hash) of the email address the club confirmed, when the club first and last confirmed it, and, once the club tells us it has ended, when. If you also bought a membership here on the website that your club membership already covered, we note that purchase so that one of us can look at it for a refund. Nothing is refunded or sent to you automatically. If the club has no membership for your address, we keep no record of the check. None of this is shared with anyone.

How you found us and what you do here. The first time you visit, we note the website that sent you (its name, not the page you were on), any campaign tags in the link you followed, the page you arrived on, and whether you are on a phone, a tablet or a computer. Our app notes when it is first installed. As you use the website or the app we record the moments that matter: the parts of the site you open, the games you start and finish, when you reach the end of your free games, the offers you are shown, signing in, and looking at or buying a membership or an item. This is kept against a random guest ID, and joined to your account when you sign in. We keep no IP address or browser details with it. It is separate from the visit counter described below.

Our product-analytics system. We keep a copy of this record, and of your memberships and purchases, in our own product-analytics system, which we run ourselves on our own servers. No other company provides it, or receives the entries it holds or your account number or guest ID. We do use AI services from other companies to help us analyse totals and rates worked out from those entries, such as how many people signed up in a month or what share of them went on to pay; they never receive the entries themselves (see “Who else sees it”). It gets the moments above; a note, once a day, that a signed-in account was used, on the website or in an app; invitations to a private table, sent and accepted; and, from Stripe’s records, a trial starting, a membership being paid for, renewed, changed or cancelled, and an item being bought, with the plan, the amount and the currency. Each entry is kept against your account number, or against your guest ID before you have an account; your sign-up carries both. Your sign-up, a trial starting, the first payment for a membership and each item you buy also carry where you first came from, if we have it: the website that sent you and any campaign tags in the link you followed. If you made your account through Friends at Mahjong Solitaire, your sign-up is noted here only when you first use Friends at Mahjong itself; until then, only your Solitaire play is recorded, as described above. The system never receives your name, email address, mobile number, IP address or card details.

Visits to the website. The website also counts its visits with a counter we run ourselves, on our own server. No other company provides it, and no other company receives its records; only totals worked out from them go to the AI services described under “Who else sees it”. Each time you open a page of the website, or move to another page within it, your browser sends the counter which page it is, the page’s title, the address of the page that sent you there, any campaign labels in the link you followed (the “utm_” tags), and a random visitor ID. Your browser makes up that ID the first time the counter runs and keeps it in its local storage under the name organism_aid, with the date it was made under organism_aid_at. Once the ID is 13 months old, the counter replaces it with a new random one. Until then, or until you clear this site’s data, it lets us tell that later visits come from the same browser. It is not made from anything about you, and we never attach it to your account, your name, your email address or mobile number, or your account number, even while you are signed in. The counter sets no cookies. Before a visit is stored, our server shortens your IP address to its first three parts, so it no longer points to a single connection. The server also stores your browser’s user-agent string (the line every browser sends naming itself, its version and your operating system) and the browser and operating-system family read from it. Visits from known search-engine robots are not recorded. Like every request to our servers, the counter’s requests also appear, with your full IP address, in that server’s ordinary access log.

The counter does not run at all if your browser sends Global Privacy Control or Do Not Track: then nothing is sent and no visitor ID is stored. It runs only on the website’s own pages. It does not run on the blog, in the iPhone app or on the pages the app opens inside itself, on our staff pages, or on a page reached through a private link, such as an invitation, an email confirmation or an unsubscribe link.

What we don't collect. No card details — when you buy a membership or an item, the payment is taken by Stripe and your card number is entered on their systems, never ours. We keep only what Stripe tells us afterwards: the card's brand, its last four digits, and the record of what you bought. When you buy in the iPhone app, Apple takes the payment instead, and tells us only what was bought, the price, when, and whether it later renewed, lapsed or was refunded, matched to your account by a random identifier we gave Apple for the purpose. We collect no advertising identifiers, no location data, and no contact list. On the website, Google Analytics counts visits and Microsoft’s advertising tag measures our ads, as described under “Who else sees it”, and our own visit counter counts visits, as described above. None of them runs in the iPhone app, which has no third-party analytics or advertising tags.

Why we hold it

To send you a sign-in code and check the one you type back.
To keep you signed in between visits.
To protect the account — rate-limiting repeated attempts, recognising a trusted device, and giving you a way back in if you lose access.
To keep the service running and diagnose faults.
To send notifications to your device from Friends at Mahjong, if you have allowed them. We don’t use notifications for marketing.
To understand how people find the site and the app, what helps them decide to join, and which sites and campaigns bring the people who sign up and pay, so we can make both better.
To recognise a Mahjong Lexington club membership, keep it counting here when mahjonglexington.com cannot be reached, avoid selling you a membership you already have, and look at one you bought twice for a refund.
To count visits to the website and see where they come from: which pages are read, and which sites, searches and campaigns bring people. We do not use visit records to advertise to you, to build a profile of you, or to follow you on other sites, and we never sell or share them.
To see which of our ads on Bing bring people who go on to make an account, so that we spend on the ones that work.

Who else sees it

Our hosting provider runs the servers this site and our visit counter sit on, and keeps ordinary server logs, which include visitors' IP addresses.

Texter, our text-message provider, receives your mobile number and the message with your code in it when you sign in by text, so that it can deliver it. If you sign in by email, it receives nothing.

A font service serves one of the typefaces on these pages. Loading a font tells it your IP address, as it would on any site using a hosted font.

Google Analytics, on the website only and never in the iPhone app, helps us count visits and see which pages people look at and which sites sent them. To do that, Google’s script sets cookies in your browser and sends Google your IP address, your browser and device type, the pages you view and what you do on them (such as scrolling or following a link), and the site that sent you. When you create an account or pay for something on the website, Google is also told that you did: for a new account, whether it was made with a sign-in code or by signing in with Mahjong Lexington; for a payment, the amount, the currency and a scrambled reference number that Google cannot match to your account or to the payment’s record at Stripe. We never send Google your name, email address, mobile number or account number. We use the reports it gives us to see how the site is used. Google explains how it handles this information at policies.google.com/technologies/partner-sites.

Microsoft Advertising, on the website only and never in the iPhone app. We advertise Friends at Mahjong on Bing, and Microsoft’s advertising tag lets us count how many of the people who click one of our ads go on to make an account. To do that, Microsoft’s script sets cookies in your browser (their names begin with _uet) and sends Microsoft your IP address, your browser and device type, the address and title of each page you open here, the site that sent you and, if you arrived through one of our ads, the click reference Microsoft added to that link. When you create an account on the website, Microsoft is also told that an account was made. We never send Microsoft your name, email address, mobile number or account number, not even in scrambled form. Microsoft can connect this to its own cookies in your browser, and so to your use of Bing and other Microsoft services, and handles it under its own privacy statement at microsoft.com/privacy/privacystatement. We use the tag only to measure our ads; we do not use it to show you ads based on what you do here. It does not run if your browser sends Global Privacy Control or Do Not Track, on our staff pages, or on a page reached through a private link.

AI services from other companies help us analyse how the site and the app are doing. We give them only totals and rates worked out from our own records, such as how many people signed up in a month, how many visits the website had, or what share of new accounts went on to pay. They never receive a record about any one person, or your name, email address, mobile number, account number or guest ID.

Stripe and Apple take payments, as described above.

Apple also delivers the notifications we send to the iPhone app, through its push notification service. To do that it receives the device’s notification token and the notification itself: its title, its text and anything the app needs to open the right screen.

That is the complete list of outside services, and we never sell your information. The record of how you found us and what you do here, its copy in our product-analytics system, the record of your Solitaire play and what our advertising-measurement system receives, and the visit counter’s records, all described above, stay on our own systems; only totals worked out from them leave, to the AI services above.

How long we keep it

Sign-in codes expire five minutes after we send them, and expired rows are deleted on a schedule.
Sessions lapse after two hours of inactivity, and are removed when you sign out.
How you found us and what you did here is kept for 13 months. Each moment is deleted 13 months after it happened, and where you came from 13 months after your last visit. In the copy in our product-analytics system, each entry is cleared 13 months after it happened: your account number, guest ID, where you came from and every other detail are removed, leaving only an anonymous note of what kind of thing happened, and when.
Your Solitaire play, in our product-analytics system, is cleared the same way, 13 months after each entry, and so is what our advertising-measurement system receives. Where you first came to mahjonggsolitaire.app from is kept with your account until the account is deleted.
Visit records from the visit counter are cleared 25 months after the visit: the visitor ID, the page, the shortened IP address and every other detail are removed, leaving only an anonymous note that a page was viewed, and when. The copies in the counter’s access log are deleted after about two weeks. The visitor ID is replaced with a new one after 13 months. You can remove it sooner by clearing this site’s data.
The club membership record, and any note of a purchase to look at for a refund, stay with your account, including after the club membership ends, and are deleted with your account.
Notification tokens are deleted when you sign out of the app on that device, whenever anyone signs in on it again, when you delete your account, or when Apple tells us the token no longer works (for example, after the app is deleted from the device). The app’s install ID has no time limit, because it is what stops a free game being claimed again by reinstalling the app; when you delete your account it is no longer linked to you.
Your account stays until you ask us to delete it.

Cookies

Our own cookies keep you signed in and remember you between visits, protect our forms from being sent by another site, remember that we have already checked whether you are signed in at Mahjong Lexington, and give your browser a random guest ID. The guest ID counts your free game, and lets us connect what you do here to your account if you make one; it lasts a year. On the website, Google Analytics also sets its own cookies (their names begin with _ga) to tell one visit from another; by default they last up to two years. Microsoft’s advertising tag sets its own cookies too (their names begin with _uet) to tell whether a visit came from one of our ads and led to an account; the longest-lived last about 13 months. Microsoft’s cookies are the only advertising cookies on this site, and they are not set while Global Privacy Control or Do Not Track is on.

The visit counter uses no cookie. It keeps two entries in your browser’s local storage: organism_aid, the random visitor ID described under “Visits to the website”, and organism_aid_at, the date that ID was made, so that it can be replaced after 13 months. To remove both, clear this site’s data in your browser. The counter makes a new ID on your next visit unless Global Privacy Control or Do Not Track is on.

Your choices

Write to us and we will tell you what we hold about you, correct it, or delete it and your account outright. Deleting is permanent: your account, your sign-in records, your game history, your club membership record and the record of how you used the site go, including its copy in our product-analytics system, the record of your Solitaire play there and what our advertising-measurement system received (normally within about 15 minutes), and we cannot bring them back. You can also ask us to delete that record, and its copy, on its own and keep your account. To make sure the copy goes too, we keep a short note of each such deletion, holding only your account number and guest IDs, until our product-analytics system confirms it has removed the copy, and for 35 days after that, so that we can repeat the deletion if that system is ever restored from a backup; then those numbers are removed from the note too. The visit counter’s records are never connected to your account, so we cannot find them from it, and deleting your account does not remove them.

Do Not Track, Global Privacy Control and Ask App Not to Track. These settings ask not to be followed across other companies’ websites and apps. We don’t sell your information, and we don’t use what you do here to show you ads anywhere else. On the website, Microsoft’s advertising tag is the one part that lets another company link a visit here with what it knows of you elsewhere, so we take either setting as a request to leave it out: while either is on, the tag does not run. You can also turn off personalised ads from Microsoft at account.microsoft.com/privacy/ad-settings. The iPhone app has no third-party analytics or advertising tags at all. The website uses Google Analytics, as described above; if you’d rather it didn’t count your visits, Google offers a browser add-on at tools.google.com/dlpage/gaoptout. We still keep our own record of what you do on our website and in our app, as described above. Our visit counter is different: on the website we take Global Privacy Control or Do Not Track as a request not to be counted, and while either is on, the counter does not run, sends nothing and stores no visitor ID.

Notifications. You can turn notifications off at any time in your iPhone’s Settings. Signing out of the app deletes the notification token for that device.

Depending on where you live you may have further rights — to a copy of your data in a portable form, or to object to how we use it. Ask and we will honour them; we are not going to make you prove you qualify.

Keeping it safe

The site is served over HTTPS. Sign-in codes are stored hashed with a secret pepper, so a copy of the database alone is not enough to forge one. Passwords, where an account has one, are hashed. Repeated sign-in attempts are rate-limited by both address and IP.

No system is perfect. If we ever discover a breach affecting your information, we will tell you.

Children

Friends at Mahjong is not aimed at children under 13, and we do not knowingly collect their information. If you believe a child has given us theirs, tell us and we will remove it.

Changes

If we change this policy we will update the date at the top. If a change materially affects what we collect or who sees it, we will tell account holders directly rather than quietly editing the page.

Changes so far:

6 October 2026: added Google Analytics, which has counted visits to the website since 17 September 2026, to “Who else sees it”, Cookies and Your choices; listed Stripe and Apple there too; and corrected the font services, since the site now serves most of its own typefaces.
8 October 2026: the website now also counts visits with a counter we run ourselves. See “Visits to the website”, “Why we hold it”, “Who else sees it”, “How long we keep it”, “Cookies” and “Your choices”. “Who else sees it” now says our own records stay on our own systems, rather than in our own database, since some of them are kept in our own analytics system. The app is unchanged.
11 October 2026: the page now says that our own product-analytics system keeps a copy of the record of how you found us and what you do here, together with your memberships and purchases, as it has since 19 September 2026, and how long it keeps them; in that copy, your sign-up, a trial starting, the first payment for a membership and each item you buy now also carry where you first came from. The page now also says that AI services from other companies help us analyse totals and rates worked out from our records, never the records themselves. Google Analytics is now also told when an account is created or a payment is made on the website. Visit records from our visit counter are now cleared 25 months after the visit; until then there was no time limit. See “How you found us and what you do here”, “Our product-analytics system”, “Why we hold it”, “Who else sees it”, “How long we keep it” and “Your choices”.
11 October 2026 (Friends at Mahjong Solitaire): our product-analytics system now also records your Solitaire play, against your account number, and our own advertising-measurement system is told when you start playing Solitaire and when you first buy something in it; where you first came to mahjonggsolitaire.app from is now kept with your account. An account made through Solitaire now has its sign-up noted here only at its first visit to Friends at Mahjong itself. See “Friends at Mahjong Solitaire”, “Our product-analytics system”, “Who else sees it”, “How long we keep it” and “Your choices”.
12 October 2026: the page now says that we ask Mahjong Lexington whether your confirmed email address has a club membership, and that for club members we keep a record of that membership, and note a membership bought here that the club already covered so that it can be looked at for a refund; that Apple tells us the price of what you buy in the iPhone app; and how long the club record is kept. See “Mahjong Lexington club membership”, “What we don’t collect”, “Why we hold it”, “How long we keep it” and “Your choices”.
12 October 2026 (the iPhone app): the page now describes the random ID the iPhone app’s install is given, as it has been since the app was released, and the notifications the app can now send: the token we store if you allow them, why, how long we keep it, and that Apple delivers them. See “The iPhone app”, “Why we hold it”, “Who else sees it”, “How long we keep it” and “Your choices”.
12 October 2026: we now advertise Friends at Mahjong on Bing, and the website now carries Microsoft’s advertising tag, which tells Microsoft the pages you visit and when an account is made, so that we can count what our ads lead to. This page used to say we used no advertising or third-party tracking pixels and set no advertising cookies; that is no longer so on the website. There are still no ads in Friends at Mahjong, for anyone, and the iPhone app is unchanged. See the opening paragraph, “What we don’t collect”, “Why we hold it”, “Who else sees it”, “Cookies” and “Your choices”.
15 September 2026: the previous version.

Contact

Email privacy@friendsatmahjong.com for anything on this page — questions, corrections, or deletion.

Phatlinks.com L.L.C. · 1343 Main Street, Suite 705, Sarasota, FL 34236 · friendsatmahjong.com