Privacy Policy

Mago

Last updated: September 17, 2026

1. Controller

The controller responsible for the processing of personal data in connection with the Mago app is:

2. General

Mago is a card game without user accounts, without advertising and without analytics tools. You can play against the computer or with friends you invite to a game using an invite code.

This policy fully describes which data the app processes.

3. Data stored on your device

When you play against the computer, no data leaves your device. The following is stored on your device:

• the display name you choose,
• a profile photo, if you choose one,
• a randomly generated device identifier that lets an online game you have joined recognize you again,
• your settings and the state of a game in progress.

This information is kept in the app's protected storage. It is not analyzed and not shared. If you delete the app, it is removed.

4. Data in games with friends

Only when you create or join an online game is the following transmitted to and processed on our server:

• your display name,
• the randomly generated device identifier,
• your profile photo, if you have chosen one,
• the state of the game: bids, cards played and points.

Your profile photo is resized to 256 × 256 pixels and stored as an image file on our server so that your fellow players can see it. The file can only be accessed via an unguessable address that is shared exclusively with the players in your games. If you only play against the computer, the photo is not uploaded.

Your display name and profile photo are only visible to players you invite to your game with an invite code, or whose game you join. There is no public matchmaking, no leaderboard and no chat.

We do not collect location, contacts, calendars, advertising identifiers or usage statistics.

5. Access to your photos

The app only asks for access to your photos when you want to choose a profile photo. You select a single image, which the app resizes and keeps in its own storage. The app does not access your photos without your action. You can revoke this permission at any time in your device's system settings.

6. No advertising and no tracking

Mago does not use advertising, advertising networks, or analytics or tracking services. There is no tracking, and no data is shared with third parties for advertising or marketing purposes.

7. Retention and deletion

• Games are automatically and completely deleted twelve hours after they were created, including display names, device identifiers and game state.
• Profile photos are deleted as soon as you remove the photo in the app. If you choose a new photo, it replaces the old one. Otherwise the server automatically deletes a photo that has not been used for 30 days.

No data is stored beyond this.

8. Service providers and server location

For games with friends we use Supabase (Supabase Inc.) as a technical service provider for the database, file storage and server functions. Processing takes place under a data processing agreement.

The data is stored in a data center in London (United Kingdom). The European Commission has adopted an adequacy decision for the United Kingdom.

We do not use any other third-party providers, in particular no analytics, advertising or marketing services.

9. Legal basis

Processing for online games is based on Article 6(1)(b) GDPR: it is necessary to provide the game with other players that you have requested.

10. Inappropriate content

If you see an offensive name or profile photo from another player, leave the game and contact us using the contact options provided at https://alinax.agency, ideally including the game's invite code. We remove reported photos promptly.

11. Children

The app is not specifically directed at children and does not knowingly collect data from children under the age of 13. There is no chat. Other players only see the display name and profile photo you choose, and only in games you play together.

12. Your rights

Under applicable law you have, in particular, the right to:

• access the personal data concerning you
• rectification of inaccurate data
• erasure of your data
• restriction of processing
• object to certain processing
• data portability, where the legal requirements are met
• lodge a complaint with a data protection supervisory authority

As we do not maintain user accounts, we match requests using the device identifier – please include it when you contact us. You can delete your profile photo yourself at any time by removing it in the app. All other server data is deleted automatically after twelve hours.

13. Changes to this privacy policy

If the app's features or the legal requirements change, we will update this privacy policy and the date above.

The current version is always available at:

https://alinax.agency/mago/privacy

14. Contact

If you have questions about data protection or the processing of your data, you can reach Alinax using the contact options provided at https://alinax.agency.