Fern Mahjong

Fern Mahjong privacy policy

What the game collects, why, and what you can do about it.

Last updated: 9 November 2026

Fern Mahjong is made by Fathom Business Solutions LLC ("Fathom", "we"). This page says what the game collects, why, and what you can do about it.

The short version. You never make an account and we never ask for your name, email or phone number. The game gives your phone a random player number and a generated name, so your place on the daily board and your cloud save can be kept. Ads are shown by Google, which collects its own data under its own policy, and players under 13 or who do not give their age only ever get child-safe ads. The game sends anonymous usage statistics, for players 13 and over only, and crash reports.

What the game keeps on your phone

Your phone's own backup (iCloud or Google) may copy any of this, as it does for most apps, and that copy is between you and Apple or Google. The next section says which of it also reaches our server.

  1. Your board in progress, your settings, your progress and your streak. Boards cleared, boards on each shape, best times and the days of your streak. Your garden grows from the boards cleared.
  2. Your answer to "What year were you born?" We keep only the group it puts you in: a child, an adult, or not given. The year that could make you either 12 or 13 counts as a child. The year itself is never kept. It never reaches our server.
  3. A random player number, a secret key and your generated name. Where these are kept decides what happens if you delete the game:
    1. On iPhone they are in Apple's Keychain. They survive deleting and reinstalling the game, so you stay the same player.
    2. On Android they are in a file private to the game. Deleting the game deletes the file. It comes back on a reinstall only if your phone's backup is encrypted on the phone itself, which Android does when the phone has a screen lock. On Android 12 and later a direct phone-to-phone transfer to a new phone should carry it too. On older versions a transfer may not. A backup without that encryption leaves the file out, and so does any backup on Android 8. Without the file, a reinstall starts as a new player, and the old player's results and cloud save stay on our server until you ask us to delete them.
  4. Daily results waiting to be sent, if you cleared the board while offline.
  5. Two small diagnostic files recording sound events, app events and how boards went. They stay on the phone.

What reaches our server, and why

Our server runs on Cloudflare. It receives only what the daily list and the cloud save need:

  1. Your player number and a generated name such as "Jade Heron 41", which no other player has. You cannot type a name, so the name says nothing about you. The server keeps only a scrambled copy of your secret key, from which the key cannot be worked out.
  2. Each daily board you clear: the date, the shape and the list of your actions on that board (each tile tapped, each undo, hint and shuffle). The server re-runs that list itself to confirm you cleared the board. It stores what it counted and keeps the whole list of actions with that result, with no end date, until you ask us to delete your data. It ranks results by the fewest undos and shuffles, then by the fewest taps. Hints are counted but never ranked. Only boards you clear are sent.
  3. Today's list: the top 50 who cleared that day's board, each shown by generated name with the help they used and their number of taps. That is all other players can see of you. Your list of actions is never shown to them.
  4. Your cloud save: boards cleared, boards on each shape, best times and your streak. Your garden comes back with it. It lets your progress return after a reinstall when you are still the same player. Your settings and your Remove ads purchase are not in it.

The server does not store your IP address. Cloudflare, which runs the server for us, processes it to deliver each request, under Cloudflare's own privacy policy.

What the server does keep is a scrambled form of your address group, made with a secret key that only the server holds. Your address group is your IP address, or for the newer kind of address, the block it belongs to. The scrambled form cannot be turned back into your address, and the one on a result cannot be matched to the one on another day's result. It is used for two limits: at most five new players an hour from one address group, and at most ten places on the visible top 50 from one address group. The one used for new players stops counting after an hour and is deleted the next time anyone becomes a new player. The one used for the list stays with that day's result.

Proving the game is genuine. The game can ask Apple or Google to confirm a result came from the real game on a real phone (Apple's App Attest and Google's Play Integrity). Today this is switched off: no result is refused for lacking that proof. Where an iPhone sends one, the server keeps a key for that phone and records whether the result was proven. On Android the server cannot yet check the proof, and ignores it.

We do not sell any of this, share it with advertisers, or use it to profile you.

Usage statistics and crash reports

So we can see whether players come back and fix what breaks.

  1. Usage statistics, through PostHog, and only if you said you are 13 or older. If you are under 13, or chose not to give your age, nothing is sent. What is sent: when the game is opened; when a board is started, cleared or left, which shape it was and whether it was the daily board; for a cleared board, the seconds it took and the undos, hints and shuffles used; for a board left, the tiles remaining; when a full-screen ad was shown; and your answer to the daily reminder offer. Each of these also carries details of the phone and the game, such as the phone's maker and model, its system version, the game version, the language, the time zone, the screen size and the kind of connection. These are tied together by a random number made for this install, which is not your player number. There is no name, no account and no profile of you. Each event is labelled as coming from Fern Mahjong, in a PostHog project shared with another game of ours.
  2. Crash reports, through Sentry, from every player: when the game crashes or hits an error, a report of what the code was doing, with the phone model, the system version and the game version. Nothing that names you is attached.

Each service receives your IP address in delivering what the game sends, under its own privacy policy: PostHog and Sentry. The game tells PostHog not to work out a location from it. Neither is used for ads, and neither receives your player number, your generated name, your list of actions or your birth-year answer.

The daily reminder, if you turn it on, is a notification set on your phone. It does not use our server.

Ads

The game is free and shows full-screen ads between boards through Google AdMob. Google collects data such as a device identifier, your approximate location from your IP address, and how you interact with ads, as described in Google's privacy policy and how Google uses information from apps that use its services.

  1. If you are under 13, or chose not to give your age, the game tells Google to treat you as a child: ads are child-safe and not personalised. You never see Google's consent form or Apple's tracking question, so on iPhone the ads cannot use your advertising identifier.
  2. Otherwise, on iPhone, the game asks Apple's permission before any ad may use your activity in other apps. Either answer is fine and the game plays the same. You can change it in the iPhone's Settings, under Privacy and Security, then Tracking.
  3. Otherwise, on Android, ads may use your device's advertising ID. You can reset or delete it in your phone's Settings, under Google, then Ads.
  4. Otherwise, in the European Economic Area and the United Kingdom, Google's consent form also asks you before any ad is personalised.

Remove ads, a one-time purchase, stops the ads for good, and the ads system is not even started on a phone that has it. Payment is handled entirely by Apple or Google; we learn only that the purchase was made.

Children

The game is not aimed at children, and it still protects them. See Ads, point 1. We do not knowingly collect personal information from children under 13. The player number, generated name and daily results identify a phone, not a person.

Keeping and deleting your data

Your player, daily results and cloud save are kept while the game runs its daily list. To have everything linked to your player removed, email apps@fathomsolutions.ai with your generated name. We delete the player, its daily results with their lists of actions, its cloud save and any key kept for proving the game is genuine within 30 days and reply to confirm.

Your generated name is in the game, in Settings, under Your player name. If Settings shows no name, this phone has no player yet.

Deleting the game from your phone removes everything kept on the phone, except that on iPhone the Keychain stays: your player number, secret key and name, and the key for proving the game is genuine.

Changes

If this policy changes, the date at the top changes and the new version is posted here before it takes effect.

Contact

Fathom Business Solutions LLC, apps@fathomsolutions.ai