1. Who we are
Asamkhya Private Limited operates Planet Mahjong and is responsible for the personal information described in this Policy. Our CIN, GSTIN, registered office and additional business address are listed above. We act as a Data Fiduciary under India's DPDP Act where its relevant provisions apply, and as a controller where applicable data protection law uses that term.
Our Grievance Officer is Abishai Fernandez. Contact hello@planetmahjong.com for general privacy requests, legal@planetmahjong.com for legal notices and grievance@planetmahjong.com for a grievance.
2. Scope and application
This Policy applies to visitors, registered players, members, event participants and people using our marketplace or community services, wherever they access Planet Mahjong. Some features are optional or unavailable in a particular app, region or release; we process their data when you use the relevant feature.
Indian privacy and online gaming law applies as relevant, including the DPDP Act and rules as their provisions come into force. Other laws may also apply, including EU GDPR or UK GDPR for the processing they cover. Section 9 explains additional regional rights. An app store's privacy label or Google Play Data safety section summarises relevant app practices; this Policy also explains website and optional service practices.
3. Information we collect
Account and member information. We use your email or phone-based sign-in details, account identifier, display name, username, avatar and preferences to authenticate you and operate your account. Adult/member verification can collect your full name, date of birth, phone number, country, city and gender choice, including a prefer-not-to-say option. These verification details are not your public player profile.
Game and community information. We process table participation, tiles and actions needed to operate a game, scored hands, claims, declarations, replays, rankings, saved results, chat and content you choose to share. Other participants can see the information the game or community feature is intended to share; concealed game information is handled according to that feature's rules.
Miss Flower and scoring inputs. We process your questions, relevant conversation history, submitted hand information, corrections and generated answers. If saved conversations are enabled, we keep conversation turns and scored-hand records so you can return to them. Camera scoring may process a photo you choose or capture. Voice input may process audio you actively record. Avoid including unrelated personal or confidential information in an input.
Real-time media. If you join table voice or an available video feature, your audio or video is transmitted to the participants permitted by that feature through our real-time media and relay infrastructure. Connection metadata is needed to establish and protect the session. Microphone and camera permissions are requested for the features that need them.
Membership and purchase information. We retain plan and offer identifiers, accepted terms and offer revisions, payment or store transaction references, purchase tokens or signed purchase evidence, verification results, currency and amount information when available, billing periods, renewals, cancellations, refunds, disputes and account-bound entitlement records. Apple, Google Play and the web payment provider process their payment credentials; we do not collect your full card or bank credentials.
Connection, device and diagnostic information. We process IP addresses, browser or app details, device and session identifiers, timestamps, errors, crash reports, latency and service activity for operation, security and debugging. iOS diagnostic reports may be uploaded through the app's diagnostic integration. Where notifications are enabled, we use device push tokens and notification preferences to deliver requested or service-related notifications.
Country review information. Where membership country checks are available, we compare the country suggested by a connection, your selected billing country and reliable country information from verified Apple or Google purchases. Unknown country evidence remains unknown. An optional browser network check briefly obtains public connection addresses for country lookup and stores country observations and review flags, rather than raw network candidates or connection addresses. This check does not use the microphone or camera.
Advertising and measurement information. When advertising runs on your account, we process ad decisions, impressions, clicks and completions; the hand credited for a watched advertisement; placement, time and delivery identifiers; your personalisation choice; your 18+ advertising confirmation, with its time and Terms version; and complaints. Providers may process IP-derived approximate location, device or advertising identifiers, cookies, interaction data and diagnostics as described in sections 5 and 10.
Events, marketplace and support. We process the registration, booking, venue, listing, enquiry, order, invoice, tax, support or complaint information needed for the service you use. A discovery listing does not by itself mean we receive a vendor's payment details. We also keep records of privacy choices, including your marketing permission and where and when you gave or withdrew it, of terms acceptance, of request handling and of security actions, as needed to demonstrate and administer those actions.
4. Purposes and lawful processing
We use information to authenticate accounts, check adult eligibility, operate games and scoring, provide requested AI and media features, preserve your chosen history, deliver and restore membership access, process permitted transactions, answer support requests and protect the Service against abuse or fraud.
We also use permitted service and diagnostic information to identify errors and improve the Service, and advertising or campaign information according to the corresponding choices and disclosures. We do not sell or rent your personal information. We do not give a direct sponsor your email, phone number, name or private chat; sponsor reporting is aggregate.
Our lawful basis depends on the processing and the law that applies. Where consent is required, we obtain it for the specified purpose; Indian law also permits certain legitimate uses and legally required processing where applicable. We do not treat every purpose as a general legitimate-interest exception under the DPDP Act. Under GDPR or UK GDPR, the relevant bases can include providing the requested contract service, consent for optional processing, legal obligations and legitimate interests in security and reliable operation, subject to your rights.
Advertising that Free may include is part of the Service, as Terms section 18 describes, and is shown only to accounts that give the 18+ advertising confirmation. Personalised advertising, marketing on WhatsApp and device permissions are separate choices; emails and app notifications about our own offers can be stopped at any time (section 13). Withdrawing an optional permission may stop that feature without preventing unrelated use of the Service. Necessary account, security, billing and legal processing may continue on the applicable basis.
5. Providers recipients and optional features
Infrastructure and service providers help us host the Service, store data and media, deliver email, protect connections, send notifications and diagnose failures. These providers receive the information necessary for the relevant service. Our email delivery integration uses Zoho ZeptoMail. Optional Android notifications use Google's Firebase Cloud Messaging; Apple devices use Apple's notification services where enabled.
Google Gemini processes supported AI inputs. Miss Flower's questions and relevant recent conversation are sent to Google to generate an answer. For the optional question-routing step, up to the first 500 characters of the current question may also be sent through OpenRouter and Google; earlier messages are not sent for that routing step. Voice input is sent to Google Gemini for transcription, and cloud camera recognition sends the chosen photo for tile recognition. A local recognition path may be used where available. Provider processing may take place outside India. The relevant provider service and its applicable terms govern its processing locations and retention; section 6 explains international processing.
A raw voice recording submitted for transcription and a raw photo submitted only for a scoring scan are not retained by our transcription or scan route after processing. The resulting text, confirmed tiles, scored-hand record and conversation can be retained for the requested feature. This statement does not cover a separate photo, avatar or other file you deliberately save or share. AI providers apply their applicable service and privacy terms; our not storing a raw input is not a promise about every provider's independent retention.
Real-time table voice and available video use self-hosted LiveKit and relay infrastructure we operate. We do not record or store the live media stream as part of that feature. Other participants receive the live media you share with them. A separate recording or sharing feature, if offered, must explain its own action and permissions.
Apple, Google Play and Razorpay receive the information needed to process and verify their purchases, manage subscriptions, prevent fraud and handle refunds. Store purchase evidence is sent to our server to bind access to your Planet Mahjong account. These providers may act independently for their own store, payment, security or legal purposes under their policies.
Google Analytics 4 and Meta measurement may receive permitted website and conversion events under section 10. When advertising runs on your account, Google AdMob in the apps and Google AdSense on the web receive the information needed to choose, deliver, cap, measure and protect advertisements, including IP-derived approximate location, device or advertising identifiers, cookies and interaction data. Google uses it under its own policies, including to maintain and improve its services, and with personalised advertising it can also use it to choose advertisements based on your interests. See https://policies.google.com/technologies/partner-sites. A direct sponsor receives aggregate reporting rather than account-level activity. Providers' own policies can govern their independent advertising, payment or security processing; we do not describe all providers as acting solely on our instructions.
We may disclose information where the law requires it, to respond to lawful requests, protect safety or legal rights, investigate abuse, or carry out a business transfer with appropriate safeguards. We limit such disclosure to the relevant purpose. For questions about a recipient, contact legal@planetmahjong.com.
6. International processing
Planet Mahjong is operated from India, but hosting, AI, analytics, advertising, notification, store and payment services may process information in other countries. We do not promise that all account, audio, photo, analytics or transaction information stays in India. Google's published information on partner services is at https://policies.google.com/technologies/partner-sites and its Privacy Policy is at https://policies.google.com/privacy.
We apply the transfer requirements and restrictions that apply to the relevant processing, including notified restrictions under Indian law and, where required for EEA or UK information, an appropriate transfer mechanism or other lawful safeguard. Contact legal@planetmahjong.com for information about safeguards relevant to your data.
7. Retention and account deletion
We retain identifiable information for the requested service and only as needed for the purposes described here or a legitimate legal, accounting, security or dispute need. Your account and chosen game or conversation history remain available while the relevant account or saved feature is retained. The following rules describe removal and any continued retention after deletion.
When permanent account deletion completes, we invalidate sign-in sessions and remove or anonymise identifying account and profile details, phone-based authentication and member details, and erase saved Miss Flower conversations. We remove relevant private assets and address event, enquiry and other personal records through the deletion workflow. Some game, ledger or competition records can remain as de-identified records so other players' histories and accounting remain coherent. A retained opaque identifier is not used to restore a deleted player's profile.
Limited billing, invoice, consent, fraud-prevention, dispute and legal records may remain for their necessary purpose. Store or payment references and a restricted deletion marker prevent a recycled contact address from claiming someone else's past purchase. Retained billing records are not an active personal player profile. Statutory retention periods depend on the record and law; contact us for the treatment of a particular record. A provider may keep its own records under its policy.
Where our advertising ledger is enabled, its retention worker removes account links after 30 days or account deletion, and removes processed event detail after 90 days. Aggregate reporting and necessary commercial records may remain. Pending device ad events are cleared when permission is withdrawn or accounts change, and expired queued events are discarded when processed. Ad complaints lose the reporter link after 30 days or deletion while the complaint can remain for moderation.
Where membership country checks are enabled, the latest country observation and mismatch evidence are retained for up to 30 days after the relevant check or last mismatch. The associated background worker removes expired records and account deletion removes these country observations. Anonymous landing-disclaimer consent logs are retained for 12 months; authenticated acceptance records follow their necessary legal and account-related purpose.
A displayed 90-day saved-solo-table resume deadline governs whether play can resume, not a general promise to erase every related result at 90 days. Completed results may remain available as described in the membership terms. Unrelated records do not inherit that resume deadline.
Backups and recovery copies may retain residual information until rotated or deleted under the applicable recovery process, with restricted use. If a backup is restored, applicable deletion requests must be reapplied. Contact us about the recovery retention applicable to a particular request.
You can request deletion in account settings or from outside the app at https://planetmahjong.com/delete-account, or email hello@planetmahjong.com. We may verify account ownership. We aim to address verified privacy requests within 30 days, or the period required by applicable law, and will explain a lawful retention exception. Deleting an app alone does not delete the account or cancel its subscription; section 8 explains billing controls.
8. Your choices and privacy rights
Contact hello@planetmahjong.com to request access to your information, correction, a copy or export, or erasure. You can also use available account and privacy controls. Under the applicable DPDP provisions, these can include access, correction and erasure, grievance redressal and nomination rights. We may verify your identity, explain an applicable exception or ask for the information needed to fulfil the request. We do not charge for an ordinary rights request.
You can withdraw an optional consent in the relevant settings or by contacting us. This does not invalidate processing already lawfully performed. If you decline a microphone or camera permission, you can use available text or manual alternatives; the feature requiring that permission will not receive a recording or photo through that action.
Account deletion does not automatically cancel every store's billing. Apple subscriptions must be managed through Apple account subscriptions. Use Google Play subscriptions or the direct provider's management controls for other recurring plans, and ask us for help if needed. Our deletion workflow can separately request cancellation where the provider supports it. Billing management, restoration, refunds and deletion are separate actions; a new purchase is not required to request deletion.
Complaints go to Abishai Fernandez at grievance@planetmahjong.com. You may also use the competent regulator or supervisory authority where the law permits. Section 17 describes the grievance route.
9. EEA UK and other regional rights
Where GDPR or UK GDPR applies, you may have rights to access, correct, erase, restrict processing, receive portable information, object to legitimate-interest processing and withdraw consent. You can lodge a complaint with the relevant EEA supervisory authority or the UK's Information Commissioner's Office. Contact us for information about the basis for a particular processing purpose or an international transfer safeguard.
We obtain the specific permission required for optional tracking or similar technologies. A device permission, including any Apple tracking permission where applicable, does not replace a separate consent required by privacy or electronic-communications law. We respect other mandatory regional rights to the extent they apply; this Policy does not waive them.
10. Cookies analytics and advertising choices
Necessary cookies and app storage support sign-in, security, preferences and recovery. Website attribution and measurement may use additional storage. Browser or device controls can limit storage, although blocking necessary storage may prevent sign-in or stop preferences from being remembered.
Google Analytics 4 measures permitted website and service events such as page visits, game activity, tutorial progress and purchases. Meta measurement can connect our campaign views to sign-ups. Events use an account or event identifier rather than your chat text; payment events can contain an amount and order reference, not card or bank credentials. Where Meta matching is enabled and permitted, email or phone can be sent as a one-way hash to help matching. A hashed identifier remains personal information and is not treated as anonymous.
The first-party pm_attr cookie records a referral or campaign attribution for our Service. The profile Privacy or Analytics control lets you opt out of the corresponding account analytics, including supported browser and server events. Google's analytics and ad consent signals default to denied for EEA and UK visitors in the current web implementation. Meta measurement has its separate account opt-out; that implementation detail does not remove any additional consent requirement applying in your location.
Free may include advertising, as Terms section 18 describes, and Gold or Platinum removes it from your own games. We do not show advertising to accounts that have not given the 18+ advertising confirmation or to accounts with Gold or other ad-free access. Your remaining choice is personalised or non-personalised advertising, in advertising settings.
Non-personalised advertising is the default. Personalised advertising runs only where you choose it and have agreed through the provider's consent message (on the website and in the Android app) or Apple's App Tracking Transparency permission (on iOS). We do not ask for Apple tracking permission unless personalised advertising is offered on iOS. Non-personalised and contextual ads may still use IP-derived approximate location, device or app identifiers, cookies, interaction signals and diagnostics for delivery, frequency limits, measurement and fraud prevention. Google privacy options are shown, or can be reopened, where required and available. See https://policies.google.com/technologies/ads. We do not represent a non-personalised ad as collecting no information.
Our own ad delivery records are linked to your account for frequency limits, crediting a watched advertisement once, reporting and abuse prevention. During a test (Terms 7.14), accounts are assigned to groups at random, and we compare first-party activity such as return visits, completed hands and purchases between groups. Direct sponsors receive aggregate results rather than an account's activity.
An explicit Report this ad action sends the selected reason and ad reference to our moderation team even if advertising measurement is off. Visiting an advertiser or third-party site is governed by that site's own practices. We do not read private chat to build sponsor marketing profiles.
11. Adults only
Planet Mahjong is for people aged 18 and older. We request adult/member verification details where applicable and refuse an underage result rather than offering a parental-consent route to play. We do not knowingly admit children. We show advertising only to accounts that have confirmed they are 18 or older (Terms 3.4) and have not failed an adult eligibility check.
If you believe a child has provided information, contact hello@planetmahjong.com. We will review and restrict the account and delete or otherwise address the information as required by applicable law, retaining only records that have a legitimate legal or safety basis.
12. Safety information
We process age-verification outcomes, play-time information, player reports, moderation decisions and relevant game evidence for safety and fair play. Available play-time limits prevent new games from starting instead of interrupting a hand already in progress. You can use the reporting and chat controls offered at the table or contact us about misconduct.
The Service is for adults and does not offer a parental-consent route to play. For available safety controls and help, see your account settings, https://planetmahjong.com/fair-play and https://planetmahjong.com/wellbeing.
13. Marketing communications
We send offers and news on WhatsApp only if you have ticked the marketing line, which stays unticked until you choose it, where it is offered in the Terms prompt, at signup or in Account; we record where and when you gave or withdrew it. We do not send offers by SMS without a separate permission. Account holders may also receive emails or app notifications about our own memberships, offers and events, which you can stop at any time with one click. We do not enrol you in WhatsApp marketing merely because you accepted the Terms or bought membership. You can withdraw a permission through an unsubscribe link, the Account marketing control, the relevant settings or hello@planetmahjong.com; on WhatsApp, tapping "Stop promotions" or replying "Stop promotions", "STOP" or "unsubscribe" withdraws your WhatsApp marketing permission. Necessary sign-in, security, payment and service communications, such as a notice that your Gold days are ending, continue whatever your marketing choice; a notice that also carries a price or an offer is marketing. Device notification controls also apply to push notifications.
14. Security
We use technical and organisational safeguards appropriate to the information and service, including encrypted transport, access controls and measures to investigate abuse and operational failures. Access to member verification and other private records is limited to the relevant service and authorised work. No online service can guarantee absolute security. Contact hello@planetmahjong.com promptly about a suspected account or data issue.
15. Personal data breaches
If a personal data breach occurs, we investigate, contain it and take remedial action. We notify affected people and the competent authorities where required by applicable law, including the relevant DPDP provisions as they apply. A required notice will describe the nature of the incident, relevant information and available protective steps to the extent known. We may use your account contact or an appropriate service notice to reach you.
16. Policy changes
We publish the current Policy at https://planetmahjong.com/privacy with its last updated date. We will give an appropriate notice of a material change and obtain a fresh specific consent before a new use where the applicable law requires it. Continuing to use the Service does not replace a consent that must be given explicitly. The Policy does not retrospectively make an earlier undisclosed use lawful.
17. Grievance Officer and contact
Our Grievance Officer is Abishai Fernandez, Asamkhya Private Limited. Email grievance@planetmahjong.com, or send a letter to either business address above. Legal notices go to legal@planetmahjong.com; ordinary support and rights requests can go to hello@planetmahjong.com. We aim to acknowledge grievances within 24 hours and resolve them within 15 days, subject to a shorter applicable legal deadline.
If your online gaming grievance is unresolved or you are dissatisfied, the Online Gaming Authority of India's route under rule 20 of the Promotion and Regulation of Online Gaming Rules, 2026 may apply. That rule provides a 30-day period for approaching the Authority in the circumstances it describes, with further appeals under the applicable procedure. You may also complain to the competent data protection authority where relevant, including an EEA supervisory authority or the UK's Information Commissioner's Office.
Indian law applies to this Policy subject to mandatory rights where you live. Disputes are addressed under the Terms, with Mumbai as the agreed arbitration seat and court jurisdiction to the extent permitted by law. No clause removes a non-waivable consumer, privacy or regulatory remedy. Current complaint instructions are at https://planetmahjong.com/grievance.