Last updated 11 October 2026
Mahjongg Solitaire is run by Phatlinks.com L.L.C. (“Phatlinks”), a Florida limited liability company that trades as Mahjong Lexington. Phatlinks is at 1343 Main Street, Suite 705, Sarasota, FL 34236.
This policy covers the website at mahjonggsolitaire.app and the Friends at Mahjong Solitaire app for iPhone and iPad. We collect what we need to sign you in, to keep the service running, to count visits to the website, and to understand how signed-in players use the game and what brought them to it. It all stays on our own systems, apart from the few outside services listed under “Who else sees it”. There are no advertisements in the app or on the website, we include no advertising SDK, we use no third-party analytics or third-party tracking pixels, and we do not sell or share your information with anyone for their own purposes.
Written against what the site and the app actually do today. The game and its collections are still being built; when they ship, this page changes with them, and we will not quietly widen what we collect.
Your account. A name, the email address or mobile number you sign in with, and — if you add one — a profile photo. If you create or join a team, we store the team's name and who belongs to it.
Sign-in records. You sign in with a one-time code sent to your email or, on the website, by text message to your mobile phone; there is no password. Each attempt writes a short-lived row holding the email address or mobile number entered, a hashed copy of the code, and how many times it was tried. We never store the code itself in a readable form.
Your session. While you are signed in we keep a session record with your IP address, your browser's user-agent string, and when you were last active, so we can keep you signed in and so you can end a session that isn't you.
API tokens. If you create one, we store its name, the permissions you gave it, a hashed copy of the token, and when it was last used.
Server logs. Our web server keeps ordinary access logs, which include IP addresses, for security and fault diagnosis.
Visits to the website. The website counts its visits with a counter we run ourselves, on our own server. No other company provides it, and no other company receives its records; only totals worked out from them go to the AI services described under “Who else sees it”. Each time you open a page on mahjonggsolitaire.app, or move to another page within it, your browser sends the counter which page it is, the page's title, the address of the page that sent you there, any campaign labels in the link you followed (the “utm_” tags), and a random visitor ID. Your browser makes up that ID the first time the counter runs and keeps it in its local storage under the name organism_aid, with the date it was made under organism_aid_at. Once the ID is 13 months old, the counter replaces it with a new random one. Until then, or until you clear this site's data, it lets us tell that later visits come from the same browser. It is not made from anything about you, and we do not attach it to your name, email address, mobile number or account. The counter sets no cookies. Before a visit is stored, our server shortens your IP address to its first three parts, so it no longer points to a single connection. The server also stores your browser's user-agent string (the line every browser sends naming itself, its version and your operating system) and the browser and operating-system family read from it. Visits from known search-engine robots are not recorded. Like every request to our servers, the counter's requests also appear, with your full IP address, in that server's ordinary access log.
The counter does not run at all if your browser sends Global Privacy Control or Do Not Track: then nothing is sent and no visitor ID is stored. It runs only on the website's own pages. It does not run on the blog or in the app.
Where you first came from. When you arrive at the website from another site, or through a link that carries campaign labels (the “utm_” tags), the website keeps those labels and the name of the site that sent you (just its name, such as bing.com, not the page you were on) in a cookie called first_touch. It keeps only the first such visit, and nothing at all when you come to the site directly. The cookie is encrypted, the page's scripts cannot read it, and it lasts 30 days; nothing from it is stored on our server. When you sign in on the website, we pass what it holds to friendsatmahjong.com, which runs your account, and delete the cookie. It is kept with your account only if the account has none yet and has not played Solitaire before, and is then used as described under “Our own analytics”. It is never joined to the visit counter's visitor ID.
Playing as a guest collects nothing. The app deals its first board without an account. A guest who never signs in and never turns on notifications sends us nothing at all.
Your account. Signing in on the app is an email address and a one-time code; there is no password. The account itself lives on friendsatmahjong.com, which runs the accounts for both of our mahjong apps, so one sign-in works across them. We hold the name you choose and the address you signed in with.
This device. When you sign in, or when you allow notifications, we register the device and keep an identifier for it, so that what you buy and where you have got to follow you rather than the handset. If you allow notifications we also keep the token Apple issues for them. Signing out, or turning notifications off, ends that.
What you have bought. Levels 11 to 100 of the first Journey, and each further Journey, open with a purchase. Apple takes the payment and we never see your card — what we keep is the record that the purchase is yours, so it can be restored on any device you sign in on. Each purchase is also noted in our own analytics system, as described below.
Where you have got to. When a board ends we keep the level, which layout it was, how many moves it took, how long it took and your score. It is there so your Journey is the same on every device. We do not use it to build a profile of you. The boards you win are also noted in our own analytics system, as described below, without the layout, your moves or your score.
When you play signed in, in the app or on the website, our own analytics system records:
Each entry is kept against your account number only: never your name, email address, mobile number or device, and never the website's visitor ID. If you play as a guest, nothing is recorded. Boards won and purchases from before this began are added too, at the times they happened.
We run this system ourselves, on our own servers. No other company provides it, or receives its entries or your account number. We do use AI services from other companies to help us analyse totals and rates worked out from those entries, such as how many players won a first board or what share came back a week later; they never receive the entries themselves (see “Who else sees it”).
When you start playing with your account, and when you first buy something, our own advertising-measurement system also receives your account number, the time and, if the website kept it, where you first came from, so that we can measure which of our ads bring players. We run that system ourselves too, and it receives nothing else about you.
No advertising identifiers. No third-party analytics. No third-party tracking cookies. No location data. No contact lists. No card details. Purchases in the app are taken by Apple on their own systems; all we are told is that they went through. Nothing is sold on the website.
To sign you in and keep you signed in. To protect the account — rate-limiting repeated attempts and giving you a way back in if you lose access. To keep the service running and diagnose faults.
To count visits to the website and see where they come from: which pages are read, and which sites, searches and campaigns bring people. That tells us which pages and channels are working. We do not use visit records to advertise to you, to build a profile of you, or to follow you on other sites, and we never sell or share them.
To see how signed-in players use the game: how many play each day, whether new players reach a first win and keep coming back, which Journeys are played and bought, and which sites, campaigns and ads bring players who stay, so that we can improve the game and how we tell people about it. We do not use these records to advertise to you, to build a profile of you, or to make decisions about you, and we never sell or share them.
Our hosting provider runs the servers this site and our visit counter sit on, and keeps ordinary server logs, which include visitors' IP addresses.
The provider that delivers our text messages receives your mobile number and the one-time code when you choose to sign in on the website by text, so that it can deliver the message.
The service that hosts our web fonts serves the typefaces on these pages. Loading a font tells it your IP address, as it would on any site using a hosted font.
Apple takes the payment for purchases in the app and tells us only that each is valid, and delivers the notifications you have allowed. They never pass us your card, and we never pass them anything about you.
AI services from other companies help us analyse how the website and the game are doing. We give them only totals and rates worked out from our own records, such as how many people played in a week, how many visits the website had, or what share of new players went on to buy a Journey. They never receive a record about any one person, or your name, email address, mobile number or account number.
That is the complete list of outside services, and we never sell your information. The visit counter's records, our own analytics system and our advertising-measurement system, all described above, stay on our own systems; only totals worked out from them leave, to the AI services above.
Sign-in codes expire shortly after we send them, and expired rows are deleted on a schedule. Sessions lapse after inactivity and are removed when you sign out. Your account stays until you ask us to delete it, or until you delete it yourself. Visit records from the visit counter are cleared 25 months after the visit: the visitor ID, the page, the shortened IP address and every other detail are removed, leaving only an anonymous note that a page was viewed, and when. The copies in the counter's access log are deleted after about two weeks. The visitor ID is replaced with a new one after 13 months. You can remove it sooner by clearing this site's data.
Entries in our own analytics system are cleared 13 months after they happened: your account number, where you came from and every other detail are removed, leaving only an anonymous note of what kind of thing happened, and when. The same applies to what our advertising-measurement system receives. Where you first came from stays in the first_touch cookie for at most 30 days, or until you sign in. Once it is kept with your account, it stays there until the account is deleted.
Every cookie on this site is our own. They keep you signed in, remember you between visits, and protect our forms from being submitted by another site. One more, first_touch, remembers where you first came from, for up to 30 days or until you sign in, as described under “Where you first came from”. There are no advertising or third-party cookies on this site.
The visit counter uses no cookie. It keeps two entries in your browser's local storage: organism_aid, the random visitor ID described under “Visits to the website”, and organism_aid_at, the date that ID was made, so that it can be replaced after 13 months. To remove both, clear this site's data in your browser. The counter makes a new ID on your next visit unless Global Privacy Control or Do Not Track is on.
You can delete your account yourself, from your account page — or in the app, from Delete your account in the menu, which opens that same page. Deleting is permanent: your account, your sign-in records and your profile go, and we cannot bring them back. The entries about you in our own analytics system and our advertising-measurement system go too, normally within about 15 minutes. To make sure they go, we keep a short note of each such deletion, holding only your account number, until our analytics system confirms it has removed them, and for 35 days after that, so that we can repeat the deletion if that system is ever restored from a backup; then the number is removed from the note too. The visit counter's records are never connected to your account, so we cannot find them from it, and deleting your account does not remove them. You can also write to us and we will tell you what we hold about you, correct it, or delete it.
Do Not Track, Global Privacy Control and Ask App Not to Track. These settings ask not to be followed across other companies' websites and apps. We never do that, for anyone: nothing about you is shared with, sold to, or used by another company. On the website we also take Global Privacy Control or Do Not Track as a request not to be counted. While either is on, our visit counter does not run, sends nothing and stores no visitor ID. These settings do not change the first_touch cookie, which goes only to our own systems.
Depending on where you live you may have further rights — to a copy of your data in a portable form, or to object to how we use it. Ask and we will honour them; we are not going to make you prove you qualify.
The site is served over HTTPS. Accounts have no passwords. One-time codes are stored hashed. Repeated sign-in attempts are rate-limited.
No system is perfect. If we ever discover a breach affecting your information, we will tell you.
Mahjongg Solitaire is not aimed at children under 13, and we do not knowingly collect their information. If you believe a child has given us theirs, tell us and we will remove it.
If we change this policy we will update the date at the top. If a change materially affects what we collect or who sees it, we will tell account holders directly rather than quietly editing the page.
Changes so far:
Write to us from our help and support page for anything on this page — questions, corrections, or deletion.
Phatlinks.com L.L.C. · 1343 Main Street, Suite 705, Sarasota, FL 34236 · mahjonggsolitaire.app
Mahjongg Solitaire is an independent gaming resource and is not affiliated with, endorsed by, or sponsored by the National Mah Jongg League.