Privacy Policy

Applies to the mobile game Atlas Mahjong (io.nestengineering.mahjong) on Android and iOS.
Last updated 7 November 2026.

Atlas Mahjong has no accounts and no sign-up. We never ask for your name, your email address or your phone number, the game never asks your device where you are, and we do not use your internet address to work out where you are. What the game sends is listed below in full.

Who we are

Atlas Mahjong is made by Nest Engineering, the data controller for the purposes of the GDPR. For any privacy question, or to exercise any of the rights described below, write to support@nestengineering.io.

The age question comes first

On first launch the game asks for your year of birth. From it the game works out which age range you are in — under 13, 13–15, 16–17, or 18 and over — and keeps only that range and when you answered, on your device. The year itself is never stored and never sent. The game is the same for everyone who can play — the answer decides which ads are suitable and what may be collected, as set out below and under Children. Players under 13 cannot play (see Children). Until it is answered, nothing in the table below is sent.

Your saved game

The save file itself never leaves your device. Your progress — levels and stars, coins, gems, boosters, quests, settings and language — is written to the app’s own storage. There is no cloud save and no login, we hold no copy, and we cannot restore it for you. Deleting the app deletes it permanently.

Some of the same numbers do travel in the analytics events described below — how far you have played, your coin and gem balances, whether you have VIP or have removed ads. They travel as individual events tied to a random installation identifier, not as a copy of your save, and they cannot be turned back into one.

What the game sends

Data	Why	Who receives it
Gameplay events App launches and session length, screens opened, levels started, won, lost or left, tutorial steps, coin and gem balances and what changed them, boosters, offers and ads shown and their outcome, theme downloads, your answer’s consent status, reminders scheduled, opened or switched off, update notices shown, which version of the game settings (below) is in use, and frame-rate and stutter measurements. Each event also carries the app version, platform, OS version, device model, graphics chip, memory size, quality setting, the game’s language, how far you have played, how many days since install, and whether you have VIP or have removed ads.	To understand which levels are too hard, where players stop playing, whether the game runs smoothly on a given phone, and whether a change made the game better or worse.	Mixpanel and Google Analytics for Firebase
An installation identifier A random string the app generates the first time collection is allowed, stored on your device.	To tell one player’s events apart from another’s without knowing who either of them is. The same identifier is attached to crash reports, so a crash can be matched to the session it happened in, and to gameplay recordings (next row).	Mixpanel and Sentry, and our own storage for gameplay recordings
A Firebase app-instance identifier A random identifier Google Analytics for Firebase creates for this installation once collection is allowed. We do not attach our own installation identifier to it, and no advertising ID is read.	To count Firebase events per installation without knowing who you are.	Google Analytics for Firebase
Gameplay recordings (ages 18 and over) A detailed record of how a level was played: each touch on the screen (where and when), taps on tiles, matches, misses, hints, undos, shuffles and boosters used, how you turned and zoomed the board, when the game was paused or sent to the background, settings you changed during the level, and how the level ended. With it: the level, its layout, the boosters you had, a few game settings (effects, reduced motion, auto zoom, frame-rate cap, language), your device model, OS version, graphics chip and screen size, the app version, the installation identifier above and a random identifier for the attempt. See Gameplay recordings below.	To measure how hard levels really are for players and to build a model of how people play, which we use to design and tune levels.	Nest Engineering, stored in our own Amazon Web Services account in the EU (Stockholm)
Crash reports The error, a stack trace, device model, OS version, app version, your language setting, the installation identifier above, the theme, level, mode and screen you were on, and a short trail of what you did just before (levels started, won, lost or left, boosters used, screens opened). No name, no email and no IP address: the crash reporter’s personal-data option is off, and email addresses and folder names are removed from error messages before they are sent.	To find and fix crashes, and to see how many players one crash affects.	Sentry
Advertising data Handled by Google’s ad SDK. May include your device’s advertising identifier (on iOS only if you allow tracking, see below), IP address, device and OS information, and which ads you were shown — subject to your age range and consent choices, see below. The game tells Google whether your age range calls for child-directed or under-age treatment; it never sends the range itself.	To show ads, to cap how often you see them, and to measure them.	Google AdMob
Install attribution (Android and iOS, ages 16 and over) When you first open the game an installation record is sent so we can tell which advertisement brought you here. It includes your device’s advertising ID (on iOS only if you allow tracking when asked; otherwise Apple’s privacy-preserving attribution is used instead), device and OS information and your IP address. Afterwards a short list of milestones is sent: each new furthest level you reach with the stars earned there, finishing the tutorial, and reaching levels 10, 25, 50 and 100. AppsFlyer’s answer — whether the install came from an advertisement, and which advertising source and campaign — is also recorded in our analytics (Mixpanel). When this happens: only if your age range is 16 or over and only when analytics is allowed — in places where the game shows a consent form (such as the EEA and the UK), only once you have given consent in it. If you later withdraw that consent in the game’s privacy options, attribution stops.	To know which advertisement or campaign an install came from, and to measure whether our advertising is worth buying.	AppsFlyer
Purchases Which product you bought or tried to buy, and whether it completed, failed or was restored. Attempts that fail or that you cancel are recorded too. Never your card number, billing address or store account.	To deliver what you bought, to keep a subscription active, to restore purchases, and to find out where purchases break.	Apple / Google, RevenueCat, and Mixpanel. RevenueCat keeps your purchases under a random identifier it creates for your installation — not your name, email or store account. This one runs for every player who can play, whatever their age range, because without it a purchase cannot be delivered or restored. Where install attribution (the row above) is running, AppsFlyer’s identifier for your installation is also given to RevenueCat, and RevenueCat reports your purchases (product, price, currency) to AppsFlyer so a purchase can be linked to the advertisement that brought you; withdrawing consent removes that link.
Theme downloads Most regions of the world map are downloaded when you approach them. On Android they are delivered by Google Play, which sees the request as it does any other download from the store.	To keep the first download small.	Google Play
Game settings download After the age question (and, where it is shown, the consent form) has been answered, and again when you return to the game after a while, the game downloads a small settings file from our website, `nestengineering.io`. The request carries no identifier and nothing about you or your game; like any download from a website, it reveals your IP address and basic information about the connection.	To adjust the game without a new app version — for example hint timing, help on hard levels, ad frequency limits and update notices — and to switch a feature off quickly if it misbehaves.	Nest Engineering, served through Amazon Web Services (Amazon CloudFront)
Update check Once per launch the game asks the store whether a newer version of the game exists: on Android through Google Play, on iOS through Apple’s public App Store lookup, which receives the game’s store id and your country. No identifier of yours is sent.	To tell you when an update is available.	Google Play / Apple

The installation identifier is not a device identifier

It is a random value created by the app itself and kept in the game’s own storage. It is not your device’s advertising ID, not a hardware serial, and not shared with any other app. If you withdraw consent it is deleted, together with any events not yet sent, and a new, unrelated one is made if collection is allowed again. Uninstalling the game destroys it.

Your internet address

Every request any app makes carries your IP address, and the services above receive it as part of the connection. We ask Mixpanel not to use it to locate you and not to store it on events, and the crash reporter is set not to record it. Google Analytics for Firebase uses it to estimate your country and region and does not keep the address itself. Google and AppsFlyer use it as described in their own policies.

Google Analytics for Firebase is set up for analytics only: it collects nothing until analytics is allowed (the same rule as Mixpanel), never reads your advertising ID, and its advertising features (ad personalisation, ad storage, ad user data) are switched off.

Gameplay recordings

Who. Only players whose age range is 18 and over, and only when analytics is allowed — in places where the game shows a consent form (such as the EEA and the UK), only once you have given consent in it. A level that starts before that is never recorded. We may record every eligible player or only a share of installations.
What is not in it. No name, email, account, location, advertising identifier, purchase details, contacts, photos or anything outside the game. It records what happens on the game board, not what is on the rest of your screen.
When it is sent. A recording is sent after the level ends, while you are outside a level, so it never affects play. If it cannot be sent (no connection, the app closed), it waits on your device and is retried later; unsent recordings older than 30 days are deleted from the device.
Where it goes. Straight to storage in our own Amazon Web Services account in the EU (Stockholm region). Amazon Web Services acts only as our processor. Recordings are not shared with or sold to anyone and are not sent to any advertising partner. Mixpanel receives only the attempt identifier and whether the level was recorded, on the level events above, so the two can be matched; never the recording itself. Recordings are never used for advertising or to make decisions about you. The servers that receive them do not keep your IP address.
How long. Recordings are deleted automatically 180 days after they are received, and copies used for analysis follow the same 180-day limit.
Stopping it. If you withdraw consent in the game’s privacy options, recording stops, and every recording still on your device, sent or not, is deleted at once. Uninstalling the game does the same.

Advertising and your consent

Atlas Mahjong shows ads between some levels, and optional ads you choose to watch in exchange for a reward. Ads are served by Google AdMob.

In the EEA, the UK and Switzerland, players aged 16 and over see a Google-certified consent form before any ad is requested. If you do not consent to personalised ads, ads are requested as non-personalised. You can change your answer later under Privacy options in the game’s Settings.
Under 18, ads are always non-personalised, whatever the form says. Under 16 the form is not shown at all: ages 13–15 are flagged to Google as below the age of consent. Players under 13 cannot play and are never shown an ad (see Children).
On iOS, players aged 18 and over are asked once by Apple’s App Tracking Transparency prompt, after the age screen and, where it is shown, the consent form. Before the prompt the game explains what it is for. It is never shown to players under 18, and never if you refused consent in the consent form. If you choose Allow, your device’s advertising identifier may be used by Google AdMob for personalised ads and by AppsFlyer to measure which advertisement brought you, which links data about you with data from other companies’ apps and websites. If you choose Ask App Not to Track, the advertising identifier is not available to the game or its partners and the game works exactly the same. You can change your answer at any time in Settings › Privacy & Security › Tracking.
You can reset or delete your advertising ID at any time in your device settings (Settings › Privacy › Ads on Android; on iOS, by not allowing tracking as above).
Buying Remove Ads, or an active VIP subscription, stops the ads between levels. Optional reward ads remain available if you choose to watch one.

Google’s handling of this data is governed by the Google Privacy Policy and how Google uses data from apps that use its services.

Purchases

All payments are taken by Apple or Google. We never see or receive your card number, your billing address or your store account details. The VIP subscription renews through your store account until you cancel it there; see the Terms of Service.

Legal bases for processing (GDPR)

Consent (Art. 6(1)(a)) — personalised advertising, and, in places where the game shows a consent form, analytics, gameplay recordings, crash reporting and install attribution. If you refuse or withdraw consent there, those stop.
Legitimate interests (Art. 6(1)(f)) — analytics, gameplay recordings, crash reporting and install attribution where no consent form is required, and non-personalised advertising, which is how the game is paid for; the game settings download and the update check, which carry no identifier. You can object at any time under Art. 21 by writing to us; uninstalling the game stops it outright.
Contract (Art. 6(1)(b)) — delivering and restoring an in-app purchase or subscription.

How long it is kept

Analytics events and crash reports are kept only as long as they are useful for improving the game, under the retention limits of Mixpanel, Google Analytics for Firebase and Sentry. Gameplay recordings are deleted 180 days after they are received. Advertising data is kept by Google, attribution data by AppsFlyer and purchase records by RevenueCat, each under its own retention policy, linked under Third-party services below. Data on your device is kept until you delete the app.

Your rights

If you are in the EEA, the UK, Switzerland, California or another region with comparable law, you have the right to access, correct, delete, restrict, port or object to the processing of your personal data, and to withdraw consent at any time.

To exercise any of these, email support@nestengineering.io and tell us your device model and roughly when you installed the game. We respond within 30 days. You also have the right to complain to your local data protection authority.

We hold no account for you and the installation identifier exists only inside the app on your device, so we have no reliable way to match a request by email to a particular set of analytics events. That is a consequence of collecting as little as we do — and it is why the most complete step available to you is to uninstall the game, which destroys the saved game, the installation identifier and the link between you and what was already collected. The same applies to gameplay recordings, which in any case are deleted after 180 days. Attribution and purchase records held by AppsFlyer and RevenueCat are not on your device, so uninstalling cannot erase them; to have those deleted, email us with the approximate date you installed the game and, if you made a purchase, its date.

Children

Atlas Mahjong is made for a general audience aged 13 and over and is not enrolled in Google Play’s Designed for Families programme.

Under 13 — the game does not open. It shows a card saying so and asks the age question again once the calendar year has changed. Nothing in the table above is sent, apart from the store’s update check, which carries no identifier: no analytics, crash reports, install attribution, ads, purchases or game settings download, and no installation identifier is created. Only the age range and when it was given are kept, on the device.
13 to 15 — ads are non-personalised and flagged to Google as below the age of consent. Install attribution is never sent. Analytics and crash reports are off wherever a consent form would be required.
16 and 17 — ads are always non-personalised, the iOS App Tracking Transparency prompt is never shown, and gameplay recordings are not made. Analytics, crash reports and install attribution follow the same consent rules as for adults.

Gameplay recordings are made only for players aged 18 and over.

If you are a parent and want a child’s data removed, email support@nestengineering.io; deleting the app stops any collection immediately.

Permissions

The game asks for at most two permissions, and works the same if you refuse either:

Notifications (Android 13 and later, ages 13 and over). The game first explains in its own card what the reminders are; only if you agree does Android ask for the permission, once. You can switch reminders off at any time in the game’s Settings or in Android’s settings. See Reminders.
App Tracking Transparency (iOS, ages 18 and over), as described under Advertising and your consent above.

The game does not use your location, camera, microphone, contacts or photos. The other Android permissions in its listing (internet access, network state, the advertising ID, billing, and background work for ads and downloads) are granted at install and never asked for.

Reminders

On Android, if you allowed notifications, the game schedules a few reminders on your phone when you leave it — for example the next day, two days later, or after a week or two away — and their text may name your next level. They are composed and scheduled on your device; no server sends them and their content never leaves your phone. Opening the game cancels them. The analytics events above record only that reminders were scheduled, opened or switched off. Reminders are never set for players under 13. There are no reminders on iOS.

International transfers

Our service providers process data in the United States and the European Union. Where data leaves the EEA it is transferred under the European Commission’s Standard Contractual Clauses or an adequacy decision. Gameplay recordings are stored in the EU and do not leave it.

Third-party services

Changes to this policy

If we change what the game collects, we will update this page and change the date at the top. Material changes will also be announced in the app.