_                   _       _ 
 __      _____| |__  _ __ ___     | | ___ | |
 \ \ /\ / / _ \ '_ \| '_ ` _ \    | |/ _ \| |
  \ V  V /  __/ |_) | | | | | | _ | | (_) | |
   \_/\_/ \___|_.__/|_| |_| |_|(_)|_|\___/|_|

Privacy

English | Български

Mahjong on webm.lol: what is stored and why

Last updated: 11 November 2026

You can play Mahjong without an account. In that case nothing about you is sent to the server: your progress stays in your own browser.

Who is responsible. This game is a personal, non-commercial project run by the owner of webm.lol. Contact: webmaster@webm.lol.

If you create an account, the server stores:

What	Why	How long
Username	To log you in and to show you on the daily leaderboard	Until you delete the account
Password, only as a one-way hash (bcrypt)	To check your password without knowing it	Until you delete the account
Recovery code, only as a one-way hash	So you can set a new password if you forget the old one	Until you replace it or delete the account
Game progress: stars, best times and scores per level and per daily puzzle, medals, number of boards cleared per day, the number of your level set	To continue on another device and to show your statistics	Until you reset progress or delete the account
Daily puzzle: when you were dealt the board each day, and your result (time, stars, score)	To time and rank players of the daily puzzle	Until you delete the account
Dates of registration and of the last login	Shown in your account panel; helps find abandoned or abused accounts	Until you delete the account
Login session, stored as a hash	To keep you logged in	60 days, or until you log out
A keyed hash of your IP address with a counter	To limit login and registration attempts	At most one hour

What is public. Once you clear a daily puzzle while logged in, your username, time and stars for that day appear on the leaderboard for everyone. Pick a username you are comfortable showing. Everything else is visible only to you and to the site administrator.

What is not collected. No email address, no real name, no raw IP addresses in the game database, no advertising, no analytics and no tracking by third parties.

Cookies and browser storage. One cookie, mj_session, keeps you logged in. The cookies theme and font remember the look you chose for webm.lol. The game keeps your progress and settings in the browser's local storage. All of these are needed for things you asked for, so there is no consent banner. They are not used for tracking.

Legal basis. Account data is processed because it is necessary to provide the account you asked for (Article 6(1)(b) GDPR). The rate limiting is based on a legitimate interest in keeping the service secure (Article 6(1)(f)).

Who else has access. The site and its database are hosted in the EU by SuperHosting.BG. The data is not sold or shared with anyone else.

Your rights. You can see your data in your account panel, change your password, reset your progress and delete the account there at any time; deletion removes everything listed above from the server at once. You can also write to the contact address to ask for a copy, a correction or deletion. You have the right to complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the authority in your own country.

Age. The game is not aimed at children. If you are under 14, please ask a parent before creating an account.

Changes. If what is stored changes, this page is updated and the date at the top changes.

---

Back to Mahjong