Privacy Policy
This policy describes what the Mafia app and web client collect, why, who can see it, how long we keep it, and how to make us delete it. It is written to be read, not to be survived.
The short version. We ask for a phone number so you can sign in, and we keep the record of the games you play. Your voice is relayed live to the people at your table and is not recorded or stored. We show no advertising, we run no analytics or tracking SDKs, and we do not sell or rent your data to anyone. We never see your card details — the app store charges you, not us.
1.Who we are
Mafia is operated by Innotech, which is the controller of the personal data described here. You can reach us at [email protected] for anything in this document, including a request to exercise the rights in section 9.
2.What this covers
This policy covers the Mafia mobile app and the web version at mafia.me, together
with the servers behind them.
It does not cover the app stores you download the app from, or anything else you reach by following a link out of the app. Those are run by other companies under their own policies.
3.What we collect
Everything below is either given to us by you, or produced by you playing the game. There is no hidden category.
To have an account
- Your phone number, and the one-time code we send to it by SMS. This is how you sign in; there is no other identity we hold you to. We keep a record that the message was sent and whether it was delivered.
- An email address and a password, only if you choose to add them as an alternative way to sign in.
- Your profile: display name, the avatar you pick from our fixed set, and — if you fill them in — your name, a short bio and a link to a social account. You choose an avatar from a gallery we ship; the app has no photo upload and never asks for your camera roll.
- Your country, derived from your phone number, and your referral code if you arrived through someone else's.
Because you play
- Your game record: which games you joined, the role you were dealt, the actions you took, how the game ended, when you left, and — if it happened — that you were removed from a table and the reason given.
- Your progression: experience, level, achievements, statistics and your position in the leaderboards.
- Your social graph: your friends, your pending friend requests, and anyone you have blocked.
- Reports: if you report another player, we keep the report and your reason. If someone reports you, we keep that too.
- Your coin wallet: the balance and the transactions that moved it.
Because you paid
- Purchase records: what you bought, when, which store processed it, and the receipt identifier that store gave us so we can confirm the purchase is real. We never receive your card, bank or wallet details. The store is the merchant; it charges you and tells us only that a purchase succeeded.
Because software runs on a device
- Device and connection data: a device identifier, the platform and app version, your IP address in our server logs, and the time you were last active.
- A push token, if you allow notifications, so that Apple's or Google's push service can deliver a message to your device.
What we do not collect. No location. No access to your contacts, photos, files or calendar. No advertising identifier. No third-party analytics, attribution or crash-reporting SDK is compiled into this app. No behavioural profile is built about you, because there is nothing here to sell you.
4.Your voice
The game is played by talking, so this section is the one that matters most.
While you are at a table, your microphone audio is carried through our servers to the other people in that room, in real time, and then it is gone. We do not record it, we do not store it, and we do not transcribe or analyse it. Nothing about what you said in a game exists on our systems after the game; only the game's events — the votes, the actions, the outcome — are written down.
But other players hear you, and we cannot control their devices. Anyone at your table can record what you say using their own phone or computer, exactly as they could in a room. Our rules forbid it (see the community rules), and we act on reports, but we cannot prevent it. Speak in a voice game as you would speak in front of strangers, because that is what you are doing.
Your microphone is used only for this. It is not opened outside a game, and the app asks for the permission at the point you need it.
5.Why we process it
| Purpose | Data | Our legal basis |
|---|---|---|
| Creating your account and signing you in | Phone number, one-time code, email and password if set | Performance of our contract with you |
| Running games, voice, matchmaking and the coin economy | Profile, game record, wallet, live audio | Performance of our contract with you |
| Progression, statistics, leaderboards and friends | Progression, social graph | Performance of our contract with you |
| Confirming purchases and preventing payment fraud | Purchase records, receipt identifiers | Contract, and our legitimate interest in not being defrauded |
| Keeping the game safe: acting on reports, stopping cheating, enforcing bans | Reports, game record, device identifier | Our legitimate interest, and the interest of every other player, in a game that is not ruined |
| Keeping the service up and diagnosing faults | Server logs, device and connection data | Our legitimate interest in a service that works |
| Sending you notifications | Push token | Your consent, given in the operating system's permission prompt and withdrawable there |
6.Who else sees it
We do not sell your personal data, we do not rent it, and we do not show third-party advertising. There is no advertising network in this app, so there is no one to sell you to.
Your data reaches other parties in exactly four ways:
- Other players. People at your table see your display name, avatar, level and statistics, and they hear your voice. Your friends see when you are online. Your phone number, email and payment history are never shown to another player.
- The app store you bought through. It processes the payment and tells us the purchase is valid. It is the merchant of record, not us.
- Service providers who act on our instructions and only for us: the hosting provider that runs our servers, the messaging provider that delivers your sign-in SMS, and Apple's and Google's push services if you turned notifications on.
- Where the law compels us — see section 12.
7.Where it is stored
The servers for this service are located in the European Union. Your sign-in SMS is handed to a messaging provider that may deliver it through the telephone network of your own country, which is how any SMS reaches a phone.
This deployment is separate from any other deployment of this game: it has its own servers, its own database and its own accounts, and no user data moves between them.
8.How long we keep it
| Data | Kept |
|---|---|
| The one-time sign-in code | Minutes — it expires and is cleared |
| Your account and profile | Until you delete your account |
| Your game record | Kept after deletion, but detached from you — see Delete your account for exactly what that means |
| Purchase records | As long as tax, accounting and fraud-prevention law requires us to be able to show that a payment happened |
| Server and connection logs | A short operational window, then rotated out |
| Bans and the reports behind them | While the ban stands, so it cannot be evaded by re-registering |
| Aggregated statistics that identify nobody | Indefinitely |
9.Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or to send it to another service in a portable form. You can withdraw a consent you gave — notifications, in the operating system's settings — at any time, and withdrawing it does not affect what we did while it stood.
To delete your account: open the app and go to Settings → Delete account, or, if you no longer have the app installed, follow the process on Delete your account. You do not have to reinstall anything to be deleted.
For anything else, write to [email protected] from the number or email on the account, or tell us the phone number so we can find it. We answer within 30 days. We may ask you to confirm you are the account holder — that check protects you, not us.
If you are in the European Economic Area or the United Kingdom and you think we have handled your data badly, you may complain to your national data-protection authority. We would rather you told us first.
10.Age limit
Mafia is for people aged 16 or over. It is a game where strangers talk to strangers by voice, and that is not a place for children.
We do not knowingly hold an account for anyone younger. If we find one, we delete it. If you are a parent or guardian and believe your child has an account here, write to [email protected] and we will remove it and the data with it.
11.Security
Concretely: every connection between the app and our servers is encrypted in transit; access to the production database is restricted to the people who operate it; we never hold card or bank details, so there are none here to steal; and when an account is deleted the identifying fields are overwritten rather than merely hidden.
Beyond that we take the technical and organisational measures a service of this size reasonably can. No system is perfect, and we will not pretend otherwise: if a breach ever affects your data, we will tell you and the relevant authority as the law requires.
12.Legal disclosure
If a court or another authority with jurisdiction over us lawfully compels us to hand over data, we will comply. We will tell you when we are allowed to, we will not volunteer more than what is asked, and we will refuse a request that has no legal basis.
13.Changes
When we change this policy in a way that matters to you, we will say so in the app, before the change takes effect — not silently, and not by editing this page and hoping. The version and date at the top always tell you which text is in force.
14.Contact
Privacy questions, data requests, and anything in this document: [email protected].
To report a player's behaviour, use the report button in the app — that reaches moderation, which is faster than email. The community rules explain what happens next.