Privacy Policy

Last updated: November 11, 2026

Majlis (مجلس) is an app for classic card games, played online with friends or offline against bots. It is published by Majlis Games, the trading name of a Brazilian individual business (MEI) ("we", "us"), which is the data controller; its legal details are at the end of this page. This policy explains what the Majlis app, its game server and this website collect, why, who sees it, how long it is kept and how you delete it, for every game on Majlis today and any added later.

The short version

• We do not sell your personal data for money. Some US state laws treat personalised ads as "selling" or "sharing" data; you can opt out at any time (see section 9).
• Players without a plan see ads from Google AdMob. Ads are personalised only if you agree, except in US states whose privacy laws give you a right to opt out instead, where you can opt out at any time; you can change your choice in Settings. Members see no ads.
• Analytics and crash reports are off until you switch them on. Notifications, offers by notification and offers by email are off until you turn them on.
• We use AI services from our hosting provider in two places: to check new profile photos for unsuitable content, and to help us answer support messages. Your data is not used to train AI models.
• Payments are handled by Apple or Google. We never see your card details.
• Majlis is for adults (18+). If you tell us you are under 18, you can only play offline.
• You can delete your account in the app, or ask us by email.

1. What we collect and why

Your account

• Guest account. When you first open Majlis you are signed in anonymously through Google Firebase Authentication, which creates a random account ID. You do not need an email to play or to buy.
• Optional Google or Apple sign-in. If you sign in with Google or (on iPhone) Sign in with Apple, Firebase Authentication stores that email address (and, for Google, the name and photo link on your Google account). With Apple we receive an Apple user ID and an email address, which may be a private relay address. Our game server does not store your email address, except if you turn on offers by email (see below).
• Age answer. The app asks whether you are 18 or older and stores your answer and when you gave it. We never ask for an ID or your date of birth.
• Display name and username. The name other players see, which you choose and can change, and an optional @handle so friends can find you by typing it exactly. There is no public directory of players.
• Profile photo (optional). Cropped and redrawn on your phone as a small square image; only the pixels are uploaded, with no location or camera data. It is stored on our game server. Before other players see a new photo, it is checked automatically by an AI safety model (see "AI" below); if the check flags it, other players keep seeing the default picture until a person reviews it. You can remove your photo at any time.

Playing

• Tables and matches. The tables you create or join, your seat, the join code and invite links (invite links expire after 24 hours). Your cards are dealt and kept on the server and sent only to you.
• Public tables. If a host makes a table public, it is listed in the app with the game, the host's display name and level, and the seats taken.
• Match results. A record of each finished online match (game, scores by seat, time), without your account ID or name.
• Points, levels and leaderboards. Points from online matches, your level and weekly points. Leaderboards show display names and ranks. Offline play stays on your phone.

Coins, the Shop and plans

• Purchases. When you buy Coins, the starter offer or a plan, the store sends us a receipt. We check it with Apple or Google and keep a record: the product, the price and currency, the store's transaction ID, the time, and later any renewal, cancellation or refund. We never receive your card number, billing address or store password.
• Coin history and items. Every change to your Coin balance (for example a daily gift, a purchase, an item bought, a refund) and the items you own and use.
• Refund information. When Apple or Google tells us a purchase was refunded, we record it so we can remove what it gave and apply the repeated-refund rule in our Terms. Apple may ask us for information about a refund request; if so we share only purchase and play-time facts about that account, never chat or personal messages.

Ads

• Who serves them. Ads are served by Google AdMob and by the ad partners that take part in Google's ad auction; Google's own consent form lists them. They receive data directly from the ad code in the app, under their own privacy policies.
• What they receive. Device and app information (model, operating system, language, app version), your IP address and the approximate location (country or region) worked out from it, ad interactions, performance and diagnostic data from the ad code (for example how long ads take to load, and errors), and your device's advertising ID — on iPhone only if you allow tracking when Apple asks; on Android you can reset or delete it in your phone's settings.
• Your choice. Where the law requires it (for example in the EU, the UK and Switzerland), Google's consent form asks you first. In US states whose privacy laws give you a right to opt out (such as California), Google's privacy options form lets you opt out of the sale or sharing of your data for personalised ads (see section 9). The app's own settings also have a "Personalised ads" switch. If you say no, you still see ads, but they are not based on your profile; Google and its ad partners may still use limited data to show, count and protect ads against fraud.
• Rewarded ads. If you choose to watch one, Google confirms the view to us with your account ID, so we can give the reward and apply daily limits.
• If you tell us you are under 18, you are not shown personalised ads.

Friends, chat and safety

• Friends. Friend requests, your friends list, the players you block, and your last-seen status (friends only; you can turn it off in Settings).
• Invite rewards. If you invite a friend or enter an invite code, we keep which account invited which, and a one-way code made from your phone's device identifier (the identifier itself is never stored). We use it only to stop the same phone collecting an invite reward twice. The code of a phone that received an invitee reward is kept for 12 months, without any account attached, even after the account is deleted; everything else about invites is deleted with your account.
• Table chat. Typed messages (up to 200 characters), quick messages and stickers are shown to the players at your table. We keep recent typed messages of each table for a short time so a report can be checked. Before your first message or photo, the app asks you once to accept the Terms and community rules.
• Filter. Messages and names are checked automatically against a word list. A flagged message is hidden; a flagged name is refused. We record when your messages were filtered, not the words.
• Reports and moderation. A report stores who reported whom, the reason and a copy of the reported name, message or photo. Reports by several different players can lead to a warning and then chat blocks, which we record with their dates. A name or photo reported by three different players is hidden automatically. Decisions beyond that are taken by a person.

Messages from us (optional)

• Notifications. Only if you turn them on, we store your device's Firebase Cloud Messaging token so we can tell you about friend requests and invites.
• Offers by notification. A separate switch, off by default and available only while notifications are on. Only if you turn it on do we send you news and offers as notifications. Turn it off at any time in Settings.
• Offers by email. Off by default. Only if you turn this on in the app, we keep the verified email address of your sign-in account to send you news and offers, with an unsubscribe link in every email. Turning it off deletes the address from that list.
• In-app inbox. Messages we send you inside the app, and whether you have read them.

Support

• Customer-support messages. When you contact us, by email, from the app or with the form on this website, we receive what you send (your message, your email address if you give one, and for in-app messages your account ID, app version and whether you use iOS or Android).
• How we use them. Our team reads every message. We may group similar reports and ideas to plan fixes and updates, with contact details removed, using the service providers listed in section 2.

AI

• Help with support messages. An AI service helps us sort and draft answers to support messages. It receives only what it needs to answer, such as the text of your message, not your email address, account ID or IP address. A person checks most answers before they are sent. Simple answers (how to play, technical problems, feedback) may be sent automatically and are marked as written with AI; anything about payments, refunds, accounts, safety or other sensitive topics always waits for a person.
• Profile-photo check. Each new profile photo (the small square image only, with no name or account details) is checked by an AI safety model so that photos with nudity, violence or other unsuitable content are not shown to other players. A photo the model flags waits for a person to approve or remove it.
• Who provides it. Both use AI services from Cloudflare, our hosting provider (see section 2). We do not use your messages or photos to train AI models, and our provider does not use them to train its models.

Analytics and crash reports (optional, off by default)

• Analytics (Google Analytics for Firebase), only if you switch it on: counts such as matches started and finished, Shop views and purchases, plus standard device information (an app-instance ID, device model, operating system, app version, language, approximate country). We do not send names, chat or cards.
• Crash reports (Firebase Crashlytics), only if you switch them on: technical details of a crash, the device model, operating system and app version.
• We do not attach your name or email to analytics or crash reports.

Technical data

• IP address. Your IP address reaches our hosting providers (Cloudflare and Google Firebase) whenever the app talks to them. We use it briefly to limit abuse.
• Genuine-app checks. To protect players from fake or modified apps, the app uses Google Firebase App Check, which asks Google Play Integrity (Android) or Apple App Attest and DeviceCheck (iPhone) to confirm that requests come from the genuine Majlis app on a real device. These services receive device and app information, not your game data or messages.
• Approximate location. We never use GPS. Google AdMob and, if you switch it on, Google Analytics work out an approximate location (country or region) from your IP address, for choosing and counting ads and for country-level statistics.
• On your phone. Your settings, language, consent answers, an offline match in progress and your guest sign-in are stored on your device.

Cookies and local storage (this website)

• This website (majlis-game.com) sets no cookies. It uses your browser's local storage for two small essential items: your language choice (majlis-lang) and whether you have dismissed the cookie notice (majlis-cookie-notice). Both stay on your device and are never sent to us.
• The website has no ads, no analytics, no tracking scripts, no social-media widgets and no third-party fonts. Like any web host, its host (Google Firebase Hosting) processes your IP address to deliver pages. The support and account-deletion forms, and invite pages, talk only to our own servers, and only when you use them.
• You can remove these items at any time by clearing this site's data in your browser. Ads and analytics in the app are described above.

What we do not collect

We never collect your precise (GPS) location, your contacts, your phone number, your payment card details, or any photo other than the one you choose as your profile photo.

2. Who we share it with

We do not sell personal data and we do not build profiles of you. These service providers process data on our behalf to run Majlis:

• Hosting and servers: Cloudflare, Inc. (game servers, data storage, and the AI services described above) and Google (website hosting).
• Sign-in, notifications and genuine-app checks: Google (Firebase Authentication, Cloud Messaging, App Check and Play Integrity) and Apple (Sign in with Apple, App Attest and DeviceCheck).
• Analytics and crash reports (only if you switch them on): Google (Google Analytics for Firebase, Firebase Crashlytics).
• Advertising: Google AdMob and the ad partners in Google's ad auction, and, if you allow it on iPhone, Apple's advertising identifier.
• Payments: Apple (App Store) and Google (Google Play).
• Email: an email hosting provider for our support mailboxes.
• If we switch on offers by email, an email delivery provider will receive the addresses of players who opted in. We will update this page before we do.

Other players see your display name, photo, level, chat messages at your table, leaderboard rank and (friends only, unless you turn it off) last-seen status.

We may also disclose data if the law requires it, to answer a lawful request from an authority, or to protect players from abuse or fraud.

3. How long we keep it

• Account, profile, friends, points, Coins, items and age answer: until you delete your account (guest accounts: see the next line).
• Guest accounts (never signed in with Google or Apple): Guest data is removed after 180 days without using the app online: the account and its game data are deleted. Signing in keeps it. We do not delete a guest account that has a purchase or a plan, or a message or report we are still handling.
• Purchase, plan and refund records: kept for as long as tax and accounting law requires (in Brazil, 5 years), even after you delete your account; they are then no longer linked to your account.
• Rewarded-ad records: until you delete your account.
• Invite links: 24 hours.
• Support messages, emails, ad reports and ideas you send us: We keep your messages for up to 12 months after we have answered them, to help you and improve the game, then we delete them. Messages we have not answered yet are kept until we do. If we still need a message to finish a fix or to deal with a legal, refund or safety matter, we may keep it longer and delete it when that is done.
• Player reports: We keep reports about a player's photo, name or message for up to 12 months to keep the game safe, then we delete them. Reports we have not reviewed yet are kept until we do, and we may keep a report longer while we are still dealing with a safety matter about that player. Warnings and chat blocks are kept until the account is deleted, even after the reports behind them are gone.
• If you delete your account, your support messages, the emails you sent from the address linked to it, and reports by or about you are deleted too, unless we must keep something for a legal claim or an authority's request.
• Table chat: recent messages only, never longer than 30 days.
• Match results: kept without your account ID or name.
• Your username: reserved for 180 days after you delete your account, not linked to any account, so nobody can impersonate you.
• Analytics data: 2 months. Crash reports: about 90 days.
• Backups kept by our hosting provider may hold deleted records for up to 30 days.

4. Deleting your account

In the app: Profile → Account → Delete account, then confirm. Without the app: email support@majlis-game.com — see majlis-game.com/delete-account.

Deleting removes your sign-in account, names, photo, age answer, points and levels, Coins and Coin history, items, friends, blocks, notification tokens, inbox, offers-by-email choice, rewarded-ad records, reports by or about you, your chat messages and your seat at every table. Purchase, plan and refund records stay only as section 3 explains, no longer linked to you. Your Coins, items and plan benefits are lost and not refunded (see our Terms). A store subscription is not cancelled by deleting; cancel it in your Apple or Google account.

5. Your choices and rights

• Personalised ads, analytics and crash reports: in the app, Settings › Privacy (the "Personalised ads" switch is there). In the EEA, the UK, US states with privacy laws (such as California) and other places where Google's consent form applies, Settings also has a "Privacy options" row that reopens Google's ad consent and opt-out form. On iPhone, tracking: your phone's Settings → Privacy & Security → Tracking.
• Notifications, offers by notification and offers by email: Settings, or your phone's settings. Every offers email has an unsubscribe link.
• Last-seen status, display name and photo: Settings and Profile.
• Block or report a player from the table or your friends list.

Wherever you live, you can ask us to access, correct, delete or give you a copy of your data, or object to how we use it. Email support@majlis-game.com. We answer within 15 days, and at the latest within one month. We may ask you to confirm the request from inside the app or from the email linked to your account, so we do not give your data to someone else.

6. Brazil (LGPD)

• Legal bases. Performance of a contract for your account, matches, purchases, Coins and items; consent for personalised ads, analytics, crash reports, notifications and offers; compliance with legal obligations for purchase records; and legitimate interest for safety, moderation, fraud prevention and technical data.
• Your rights (LGPD art. 18): confirmation, access, correction, anonymisation, blocking or deletion, portability, information about sharing and about refusing consent, and withdrawal of consent.
• Complaints: you can petition the Autoridade Nacional de Proteção de Dados (ANPD).
• International transfer: our providers may process data outside Brazil, including in the United States, under their contractual safeguards.
• Person in charge (encarregado): support@majlis-game.com.

7. European Union, EEA, UK and Switzerland (GDPR)

• Controller: the business named at the end of this page. Contact: support@majlis-game.com.
• Legal bases (GDPR art. 6(1)): (b) contract — your account, matches, purchases, Coins and items; (a) consent — personalised ads, analytics, crash reports, notifications and offers, which you can withdraw at any time in Settings without affecting what happened before; (c) legal obligation — purchase and tax records; (f) legitimate interests — keeping Majlis safe and working: moderation, fraud and abuse prevention, security and technical data. Non-personalised ads also rely on our legitimate interest in funding the free game.
• Your rights (GDPR arts. 15–22): access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests), and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects. Our automatic filter and report counts can only hide content or block chat for a limited time; anything more is decided by a person, and you can ask for a review.
• Transfers: we are based in Brazil and our providers process data in the United States and other countries. Transfers rely on the European Commission's standard contractual clauses or, for providers certified under it, the EU–US Data Privacy Framework.
• Complaints: you can complain to the data protection authority of the EU country where you live or work, or where you think the problem happened.

8. Saudi Arabia and the United Arab Emirates

• Saudi Arabia. If you are in Saudi Arabia, the Personal Data Protection Law (PDPL) applies to how we handle your data, even though we are based abroad. Your data is processed outside the Kingdom by the providers in section 2, for the purposes in this policy, with contractual safeguards. You have the right to be informed, to access and get a copy of your data, to correct it, to have it deleted, and to withdraw consent. Write to support@majlis-game.com. You can also complain to the Saudi Data and AI Authority (SDAIA).
• United Arab Emirates. If you are in the UAE, you have similar rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and you can use them the same way.

9. United States (California and other states)

If you live in California or another US state with a consumer privacy law, these points apply to you too.

• What we collect. In the last 12 months we collected these categories of personal information, from you, from your device and from Apple or Google, for the purposes in section 1: identifiers (account ID, username, IP address, your device's advertising ID, and the email address of a Google or Apple sign-in); commercial information (purchases, Coins and plans); internet or other electronic activity (play, chat, ad interactions, and analytics and crash reports if you switch them on); approximate location worked out from your IP address; visual information (your profile photo, if you add one); and your age answer. We disclose them to the providers in section 2 and keep them as section 3 says.
• Selling and sharing. We do not sell personal data for money. But when ads are personalised, Google AdMob and the ad partners in Google's ad auction use your device's advertising ID, IP address and app activity to choose ads, and US state laws may treat this as a "sale", as "sharing" for cross-context behavioural advertising, or as "targeted advertising". We do not otherwise sell or share personal data, and we do not use or disclose sensitive personal information for any purpose that gives you a right to limit it.
• Do Not Sell or Share My Personal Information. To opt out, open the app's Settings › Privacy. Where Google's privacy options form applies (including California), tap "Privacy options" and choose not to allow the sale or sharing of your data. Elsewhere, keep the "Personalised ads" switch off; it is off unless you switch it on. On iPhone, ads are not personalised unless you allow tracking when Apple asks (change it in your phone's Settings → Privacy & Security → Tracking); on Android you can delete your advertising ID in your phone's settings. After you opt out you still see ads, just not personalised ones. You can also email support@majlis-game.com and we will help.
• This website sells or shares nothing and has no cookies, ads or trackers, so there is nothing to opt out of here, and a Global Privacy Control signal from your browser needs no further action on this site.
• Your rights. You can ask to know what personal information we collected, used and disclosed about you, to get a copy of it, to correct it, to delete it, and to opt out as above. We will not treat you differently for using these rights: no different prices, no lower quality, and ad rewards never depend on your choice.
• How to ask. Email support@majlis-game.com, or use the form on our support page. We check the request comes from you (from inside the app or from the email linked to your account) and answer within the times in section 5. Someone you authorise can ask for you with your signed permission; we may still ask you to confirm your identity with us directly.
• Appeals. If we refuse a request, you can appeal by emailing support@majlis-game.com with "Appeal" in the subject. A person reviews it and answers within the time your state's law allows; if we still refuse, you can contact your state's attorney general.
• Under 16. Majlis is for adults, and players who tell us they are under 18 never get personalised ads, so we do not sell or share the personal information of anyone we know is under 16.

10. Age

Majlis is for adults aged 18 and over. If you tell us you are under 18, the app lets you play only offline against bots on your phone: no online tables, chat, friends or purchases, and no personalised ads. We do not knowingly collect personal data from children. If you believe a child is using the online features, email support@majlis-game.com and we will act on it.

11. Security

All traffic between the app and our servers is encrypted (HTTPS/TLS). Cards are kept on the server so nobody can see them early. Purchases are checked with Apple or Google before Coins or plans are given. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the authorities as the law requires.

12. Changes

If we change this policy we will update the date above and tell you in the app when a change is significant. Where we rely on your consent, we ask again before using your data in a new way.

13. Contact

support@majlis-game.com — in English or Arabic.

Data controller: Majlis Games (trading name of a Brazilian individual business, MEI) · CNPJ 51.533.319/0001-13 · Brazil · App: Majlis · support@majlis-game.com