Terms, Privacy and Refunds

This page is also in: Українська · Русский · Français

Third-party licences and acknowledgements — the open-source software, models and voice data we use, each with its licence and authors.

Last updated 16 October 2026 · version 2026-10-16.1 · MafiaVoice is run by Oleksandr Martiuk, operating as MapleGate Systems, a sole proprietorship in Alberta, Canada.

For consumers in Quebec: a French version of these terms is available at /legal.fr.html. When you sign up over a connection from Canada, or from a place whose country we cannot tell, it is offered before you agree. The sign-up box links to it and asks you to choose the French or English text. If you live in Quebec and did not expressly choose the English version when you signed up, the French version is the one that binds you and us. If the French and English versions differ, you may rely on either, at your convenience.

Written to be read. If anything here is unclear, write to the contact form and ask.

Earlier versions. This is version 2026-10-16.1, of the date above; versions 2026-09-29.9 and 2026-09-29.8 and the version of 28 September 2026, 2026-09-28, are earlier texts. Versions 2026-10-01.1, 2026-10-03.2, 2026-10-03.3, 2026-10-03.4, 2026-10-04.1, 2026-10-04.2, 2026-10-04.3, 2026-10-04.4, 2026-10-04.5, 2026-10-04.6, 2026-10-04.7 and 2026-10-04.8 were drafts and were never published. Version 2026-10-05.1, of 5 October 2026, versions 2026-10-06.1 and 2026-10-06.2, of 6 October 2026, and versions 2026-10-07.1, 2026-10-07.2 and 2026-10-07.3, of 7 October 2026, are also earlier texts. Versions 2026-10-08.1 and 2026-10-08.2, of 8 October 2026, and version 2026-10-09.1, of 9 October 2026, are earlier texts too. Versions 2026-10-11.1, 2026-10-11.2 and 2026-10-11.3, of 11 October 2026, are earlier texts as well. Versions 2026-10-13.1 and 2026-10-13.2, of 13 October 2026, are earlier texts as well. Version 2026-10-15.1, of 15 October 2026, is an earlier text as well. The version you agreed to when you registered is recorded against your account, and if you want to read the exact text you accepted, ask at the contact form and we send it to you.

What changed since version 2026-09-29.9. Versions 2026-09-30.10, 2026-09-30.11 and 2026-09-30.12 were drafts and were never published, so everything below is new since 2026-09-29.9. Voices and the models behind them: the use restrictions that come with the open voice models (OpenRAIL) apply to anyone who receives our voice audio or a voice model file, and where the full licence texts are; bluffing inside the game is not false information. The phone app is described: a subscription bought, restored and cancelled in the App Store and on Google Play, the purchase screen and what it shows, and that deleting the app or the account does not cancel a store subscription; deleting your account from the app. On the website a purchase from a country where Stripe Managed Payments handles the tax goes through it once it is open there, with Link (Stripe) as the seller of the payment; in the app paid plans are sold through Apple and Google. How the phone turns your speech into text, what reaches us at a practice table and at a live table, and that live tables are in the app too. App updates through Expo, what Expo receives, and the keyed hash that counts them; crash reports from the app. The store’s age rating does not lower the age limit. The app is for adults, 18 and older, and asks the store for your age range. Two automatic checks on a purchase — the Ukraine card price, and a purchase with a billing address or a card from Brazil, or one from the EU, the EEA or the UK that reached our ordinary checkout, which is cancelled and refunded — the email they send and how to ask a person. Reply times: we no longer name 30 days; we answer a data request within the time the law that applies to you sets, and an appeal without undue delay. The country your connection comes from is read when you open the prices and when you join a live table, and is never stored. When it cannot be told, live tables and the purchase pages stay closed. The United Kingdom picked as your account’s country closes live tables too. The operator’s weekly email of the anonymous daily totals. The AI mark in our audio files is signed and carries its time, and anyone can check it at mafiavoice.com/ai-mark. The synthetic bot voices come with use rules: no impersonation, fraud, or intimate or harassing content, and the voice-data licence’s own restrictions, passed on to anyone who receives our audio. After a legal review of this version: the daily cap on full reviews; a yearly plan bought in Quebec ends instead of renewing into another year; a club code in the iPhone app; requests from the police and the courts, keeping data when the law requires it, and child sexual abuse material; what belongs to us; appeals and reports through the contact form; profiling and automatic decisions; transfers out of the EU and out of Quebec; the Quebec notices and the French version at sign-up; a paid account is never deleted by the test; accessibility as it is really checked. Then: the EU button to withdraw from the contract; your billing name and address on the copy of the agreement; deleting your account from the app while a store subscription runs. Inviting a friend works differently: your friend gets 14 days of the full product once they have confirmed their email address and finished a first game, and you get 7 days at that moment; you get 30 more days when your friend first pays, on the website or in a store, and lose them again if that payment is refunded or disputed. Your friend no longer gets 30 days for paying. At most 10 rewards per account in a calendar year; no 30 days for a payment with the same card as yours, checked with a one-way code made from Stripe’s card identifier. A monthly subscription bought on the web can be paused for 1 or 2 months instead of cancelled. The room for friends costs $3.49 CAD a month with a card issued in Ukraine. Paid plans are for people 18 and older; the age is asked once, the first time you join a live table or pay. Streamer and creator partners are paid 15% of the net amount, after a 60-day hold, from C$50, with at most C$200 earned in the first 90 days and an automatic pause on signs of fraud; what we keep about them, the T4A slip, no partners resident in Quebec yet, and how a paid post must say so. Newly stated in Privacy: an invite or partner code from a link is not stored in your browser — it travels in the page address; a partner’s code from a link and the ids of the payment that earned a referral reward; the encrypted hourly copy outside the server; Cloudflare’s bot check; the stop list for letters that bounce; your EU withdrawal statement; voices you download to your device; the date you answered that you are under 18, and the date a store said so, and when each is removed. Deleting your account asks for your password, or sends a ten-minute link if the account has none; confirming your address removes a password somebody else set on it before you confirmed; the session cookie is now named __Host-mv_session; two more cookies in our code that a player does not receive, and what else your browser keeps besides the listed items. Also: a second automatic refund is refused for the same email address or the same card on another account, too; the Ukraine card price is checked again at every renewal and change of plan; paying needs an account that has accepted the current terms. Also newly stated: an alert to the operator about a payment dispute, a fraud warning or a failed automatic refund carries payment numbers; the security-log fingerprints on the operator’s computer are kept unencrypted and with no time limit; the technical log notes for up to 30 days that you deleted a review; a club application is confirmed by pressing a button on the page our link opens; an invited friend’s first real game needs one move of their own and no turn answered by the clock; the letter that says a refund has not gone through yet, and the letter to a club room’s organiser when most of its paid reviews are used. Also new: an optional setting, off by default and never a condition of playing, lets a de-identified copy of your own turns at live tables help train our own bots; switching it off deletes them.

What changed since version 2026-09-29.8. Every table says that the bots and the host are AI, and every audio file our server sends carries a machine-readable AI mark. Leaving a live table is final for that game, missing your turn three times in a row hands your seat to a bot, and leaving one game several times counts once. What you write to us and our answers are kept in one place, you see yours in your account, and a message sent without an account is deleted 24 months after the last one; who else receives a copy is named. You can delete your account from a link sent to your email, without signing in, and the deletion page is also in French and German. Before your browser’s speech recognition is used, the game asks you. The pause for a real threat is switched on. Paid plans are not sold in the EU, the EEA or the UK yet. Refunds on Android after the first 48 hours are made by us, through Google Play; in the App Store only Apple decides; the 14 days is when we send a refund, and your bank then takes its own time to show it. The service may not be used from Crimea or the occupied regions of Ukraine. A verified club’s closed tables are free, with no card; the $7 CAD/month room for a private group of friends starts with 3 free evenings and no card. Newly stated: how long an anonymous id is kept; that an anonymous problem report keeps a hash of the IP address, not the address; the security log and how long each kind of entry is kept, and that the technical log keeps nothing older than 30 days; the copies kept on the server in Germany; the check a complaint triggers, as a sixth automatic tool; everything that lowers the hidden finish-rate number; that a web address or phone number said at a live table is shown to a person and is never a foul; what a club organiser sees of the members; that your email address is no longer kept in your browser; who controls your data and whom to ask about providers outside Canada; and that the notice before an unused account is deleted comes after 22 months.

What changed since version 2026-09-29.7. A complaint that is not confirmed no longer costs the person who made it: only a repeated pattern does, and that can be appealed. A complaint that a player spoils the game on purpose is decided only by a person. Joining and leaving the live queue again and again pauses joining it for a short time. You can block another player. The open-source licences are listed on their own page.

What changed since version 2026-09-28. A real threat to a person pauses live tables automatically, a person looks at every such pause, and it can be appealed with one tap; what is kept about it and for how long. On the date of this version this pause is switched off. We no longer promise how fast an ordinary message is answered: a person reads every message, and we answer a data request within 30 days, or sooner where the law requires. An appeal against a foul, a pause or a closed account is answered within 30 days. The club-gift lines in the paragraph below are also new since that version.

What changed since the version of 27 September 2026. You can change your email address yourself: what is kept while a change is under way and for how long, the letters it sends, what the stop link does, and that Stripe is told the new address. Your own game history is free, and the free tier now says so. The history keeps the last 300 games. A nightly copy of the database is kept in Canada so the service can be restored. Your statistics are kept for the life of the account. A club’s texts are checked against the list of words before they are saved. A club's code gives its fourteen days only once the club is verified, and to at most 20 new people in each 30-day period; how a club is verified, what is kept about it, and what a declined club can do. A club's fourteen days start when you confirm your email address, not when you register or type the code; with all of a club's places taken they wait and start by themselves on your first visit after a place opens.

What changed since the version of 25 September 2026. Live tables are not offered in the United Kingdom. What a live table keeps of your speech, for how long, and the one-time note before your first live table; the moderation model and what it keeps. The session cookie described for guests too, and the limits of a session opened without a confirmed email. The hash that survives deleting an account during a pause. A granted refund keeps its email and payment method for up to 24 months. The whole school is free. The rules check before a first live table. Deleting a single review. The full list of letters we send. Where each voice is synthesised and how an AI voice is marked. The retired federation choice is gone. The seller’s phone number, and MAFIAVOICE as the name on your card statement. A club’s own room: what it costs, the free month, cancelling and refunds. What is kept of a finished table and who can open it again, what deleting your account removes from other players’ results and reviews, a game played without an account deleted after 30 days, and a review built from the engine’s own facts while the AI’s own words are switched off.

Terms of use

Consumers in Quebec: when you sign up over a connection from Canada, or from a place whose country we cannot tell, we offer the French terms before you agree and the sign-up box links to both versions. Choose the French or English text there. If you live in Quebec and did not expressly choose the English version when you signed up, the French version is the one that binds you and us. If the French and English versions differ, you may rely on either, at your convenience.

Consumers in Quebec: this paragraph does not apply to you. We are in a public test right now. While we test, we may delete or reset your account, your games and their reviews without notice — this is separate from the account deletion described below, which stays under your control the whole time. This paragraph stops applying the day the service leaves testing; nothing in it limits anything else you are promised on this page. Sorry, and thank you for trying it before it is finished.

A paid account is never deleted by the test. If a reset during the test would remove your games or reviews, we email you first, and the unused part of the period is refunded — or the whole payment, inside the 14-day window.

Who you are buying from

Oleksandr Martiuk, operating as MapleGate Systems, a sole proprietorship in Alberta, Canada. MafiaVoice is a product of MapleGate Systems; until September 2026 it was at mafiacoach.com. Based in Calgary, Alberta, Canada. GST/HST registration no. 752982173 RT0001. Support phone: +1 (403) 483-6375. There is no support department: the contact form is how you reach a person, and one person answers it.

What this is

MafiaVoice is a practice game for the party game of Mafia. A single-player table seats you against nine computer-controlled opponents, ten in all, with no other human player and no chat. A live table can seat other people instead: what is said there travels by voice, through our own relay and is not recorded by us, and by hand sign — never as free text between players. Either way, what you do at a table is seen only by the people seated at it.

Who may use it

You must be 16 or older to use this site. Paid plans are for people 18 or older, wherever you live. Where the age of majority is 19 — British Columbia, Nova Scotia, New Brunswick, Newfoundland and Labrador, Yukon, the Northwest Territories and Nunavut — a buyer under 19 gets a full refund on request. The checkbox you tick when you register confirms you are 16 or older. A parent's payment card must not be used without their permission.

Tables with other live people are for adults — 18 or older. A table with bots and the school stay open from 16. A live table means talking with strangers by voice, and that is where the higher age applies. Live tables are not offered in the United Kingdom for now. If we cannot tell which country your connection comes from — for example through Tor or a network that hides it — live tables and the purchase pages stay closed for that connection; the page says what to do, and tables with bots and the school stay open. The service may not be used from Crimea, Sevastopol or the occupied parts of the Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine, and not by anyone on a Canadian or United States sanctions list; if we learn of either, we may close the account. Paid plans are not sold in Brazil; elsewhere, whether a payment can be made from your country is decided by our payment provider (Stripe) on the website and by the App Store or Google Play in the app.

MafiaVoice is not offered in the European Union, the rest of the EEA (Iceland, Liechtenstein and Norway), the United Kingdom, Gibraltar, Turkey, Vietnam or Indonesia. Over a connection from one of these countries the website and the app show only “MafiaVoice is not available in your region”: no sign-in, no sign-up, no game. These terms, the rules, deleting an account, the contact form and the stop link in our letters stay open there. An account whose country is one of these — the country you picked, or the billing country of your latest payment — is closed in the same way over any connection, a trip or a VPN included: it can still download its data, delete the account, sign out, and cancel a subscription or ask for a refund. If we cannot tell which country your connection comes from, this rule does not close anything. Paid plans are not sold in Brazil, on the website or in the app; the game itself is open there. In the Android app paid plans are not sold in Tanzania, Switzerland or Israel; on the website they are. Everywhere else MafiaVoice is offered as this page describes — we close no other country ourselves — and whether a payment can be made from your country (for example, where sanctions or local law forbid it) is decided by our payment provider (Stripe) on the website and by the App Store or Google Play in the app.

The age rating the App Store or Google Play shows describes the content; it does not lower the age limit here. The app is for adults, 18 and older, and it is not made for children: it is not in Google Play’s programme for families or Apple’s Kids category. Live tables with other people are in the app too, and the 18+ rule for live tables applies there exactly as on the site; at a live table in the app the other players hear you by voice, as on the site. The app asks the App Store or Google Play for your age range, keeps on the phone only whether you are 18 or older and whether you are under 16, tells your account the same, and does not open for someone the store says is under 18; the site stays open from 16.

Your account

An account is needed to play at a table with other people, to join a club, to keep your progress and to pay. A practice table with bots can be tried without one; then only the anonymous id your browser keeps and that game’s record are stored; without an account it can be opened again only in the same browser, for up to ten minutes after the game ends, and the record is deleted 30 days after the game ends. It takes one screen: an email address and a password you choose. There is no waiting for a letter and nothing else is asked for — no real name, no phone number, no card unless you decide to subscribe.

The address is what the account is. It is what makes your record and your coach reviews survive a cleared browser or a second device, it is how you sign in from anywhere, and it is what a receipt is sent to if you ever pay. A display name is optional, and the game itself is played anonymously at the table: at a practice table the other seats are software; at a live table the other players see your display name, never your email. Nobody else ever sees your address.

An account is for one person. Do not share your sign-in with anyone else: through it they would see your email address and your payments. You are responsible for what happens under your account. Do not attempt to attack, overload, scrape, or reverse-engineer the service, and do not use it to build a competing product.

What belongs to us

The software, its engine and coach, our writing, our visual design and our artwork are MapleGate Systems’, to the extent the law gives anyone rights in them. You may not copy, reproduce, distribute or make derivative works from them without written permission. The rules of Mafia and the way the game is played belong to nobody — play them anywhere. Your own games and your own record are yours — you can have them deleted at any time, and we make no claim over anything you type.

If you add a club's name, description or logo, you confirm you may use it and let us show it on the site, free and non-exclusively, while the club is listed. At the table you may choose only a unique pseudonym from our fixed list; custom text and personal names are not accepted. Existing off-list names are not shown at new tables until changed. A club’s texts are checked before they are saved. Its name, description, city, link, meeting times, venue and the note in an application are checked against the separate safety word list for club text — when a club is created, applied for, sent again after a refusal, and at every edit. A text the list refuses is not saved and is never shown: the organiser is told which field to reword, never which word was caught. We keep only a record that a field was refused, the kind of word that caused it, and a one-way hash of the text — never the text itself. If you think a text was refused wrongly, tell us through the contact form.

The text and layout of our school materials, and of our rules and gesture sheets, are protected by MapleGate Systems' copyright. Copying, reprinting, and using them in another course or app needs the author's written permission.

The open-source software and models we ship to your browser or phone keep their own licences; each one, with its version, licence and copyright holder, is listed on the open-source licences page.

Our pictures are AI-generated. The players’ portraits, the eight character pictures, the cover picture and the app icon were made with an AI image generator; they are not an artist’s work and do not show real people.

Other companies’ trademarks. Apple, the Apple logo, Apple Pay, iPad, iPhone, Keychain and Safari are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc., registered in the U.S. and other countries. Android, Google Play, Google Pay, Chrome and other marks are trademarks of Google LLC. Every other name on this page belongs to its owner. Apple and Google do not sponsor or endorse MafiaVoice.

The free tier

Unlimited play is free and stays free. That is arithmetic, not generosity — the opponents cost nothing to run, so metering them would only cost signups. We may change what the paid tier includes, but we will not put a meter on free play.

The whole school is free too — all ten steps, every lesson, their revisions and every test, never behind a card. Step 0, the short rules overview, needs no account at all; the full ten-step course needs a free account, only to keep your place on it.

A finished game is kept for 30 days, free. With an account, a game you played to its end — live or practice — opens again from its own link for 30 days after it ends, with its review, and you can share it in that time. Then the game is deleted, with its review; your results and statistics stay, and a complaint about it keeps its own record for the period given in Privacy. There is no list of past games. Without an account, a result opens for about ten minutes after the game, and only in the same browser; the game itself is kept for 30 days, and creating an account in that browser within that time lets its result open again for the rest of those 30 days.

The paid tier

Paid plans are for people 18 and older.

A subscription unlocks the full coach review after every game, up to 10 full reviews a day and 6 an hour — enough for every game most players play in a day: the round-by-round breakdown of your reads against the engine's, and the specific evidence you had in front of you and did not use. Free players get one full review a day; the rest of the time they see their score, how many reads they missed and the day and seat where the game turned, but not which reads they missed.

It is billed monthly or yearly, whichever you chose, and renews automatically at the same price until you cancel. You can cancel at any time from your account screen. Cancellation takes effect at the end of the period you have already paid for.

On the website, a purchase from a country where Stripe Managed Payments handles the tax — Switzerland, Israel, the United States and Australia among them — goes through Stripe Managed Payments once it is open for that country. For that payment the seller is Link (Stripe), the merchant of record: the VAT or sales tax your address owes is already inside the price and Link pays it to the tax office, the price may be shown in your currency (you can switch to Canadian dollars), and the receipt comes from Link. The service itself is still provided by us under these terms, refunds included. Which checkout opens is decided by the country your connection comes from; until Managed Payments is open, and always from Canada and for the price for cards issued in Ukraine, our ordinary checkout opens. A purchase with a billing address or a card from Brazil is cancelled and refunded in full, on either checkout. So is a purchase that reached our ordinary checkout although its billing address or card is from the EU, the EEA or the United Kingdom — over a VPN, for example (see where MafiaVoice is not offered). Brazil aside, we refuse no country ourselves: whether a payment goes through is for Stripe to decide. In the phone app the App Store or Google Play sells the subscription and charges the tax itself.

An introductory price, if the pricing page shows one — a lower first month, for example — applies to the first period only, and once per account and email address; we also check the card after the first payment, and an account that knows a card which already had the introductory price is not offered it again. Before you pay, the pricing page names the introductory price, how long it lasts and the full price that follows; from the second period the full price is charged automatically unless you cancel. The 14-day full refund covers an introductory charge exactly as it covers any first payment. About five days before the introductory price ends, we email you the date and the full price.

It needs a modern browser (or the mobile app) and an account to keep your progress. There is no DRM and no technical restriction beyond that.

In the iPhone and Android app the same subscription — Coach, monthly or yearly — is sold through the App Store or Google Play, never through our own checkout. Before you pay, the purchase screen shows the plan’s name, its length and its price as your store charges it, in your store’s currency and with any tax the store adds, and links to these terms and to Privacy. Your Apple ID or Google account is charged when you confirm. It renews automatically at the same price until you cancel in the store; on the App Store, cancel at least 24 hours before the period ends, or the next period is charged. A subscription bought in the app works on the site too, and one bought on the site works in the app: sign in to the same account. You never need to pay twice, and the app will not let you buy a second one while the first is active. The store subscription has no free trial period. While in-app sales are closed, the purchase screen says so and takes no payment; everything free stays free.

Purchases in the apps. A subscription bought in the iPhone or Android app is paid for through the App Store or Google Play: the store takes the payment, renews the subscription, sends the receipt, and is where it is cancelled. The store does this under its own terms, which you accepted with the store and which apply alongside these terms — the Apple Media Services Terms and Conditions or the Google Play Terms of Service. We never see your card, and we do not cancel a store subscription for you. How to cancel on each phone is under What you are agreeing to pay; who decides a refund of a store purchase, and how to ask for one, is under Refunds and cancellation.

A subscription from the site and a subscription from a store are separate. Either one unlocks the same Coach for your account, on the site and in the app. But they are two contracts with two tills — Stripe for the site, the App Store or Google Play for the app — and each is cancelled and refunded only where it was bought: cancelling one never cancels the other. One account needs only one: while an account has Coach, the site’s pricing page and the app’s purchase screen do not offer a second. If an account ends up with both all the same, it still has one Coach, not two: the paid time does not add up, and each till keeps charging until you cancel it there. Write to us through the contact form. A charge taken through our site on top of an active store subscription is a duplicate and is refunded, as “Refunds and cancellation” says; a refund of the store’s charge follows the rules for that store in the same section. If a new site subscription is paid for while the account already has an active store subscription, we do not wait for you to write: we cancel the site subscription at once, refund that payment in full and tell you by email; the store subscription keeps running. If the Coach switches off while one of the two is still paid for, tell us and we switch it back on.

If you subscribed inside the iPhone or Android app

Changed phone or reinstalled the app? Sign in to the same account, or press Restore purchases on the purchase screen. It asks your store which subscription your Apple ID or Google account already holds and reconnects it to your account, at no charge. It works whether in-app sales are open or closed.

This agreement is between you and Oleksandr Martiuk, operating as MapleGate Systems, and not with Apple or Google. We, not they, are responsible for the app, for everything in it, and for anything it does or fails to do. Apple and Google have no obligation whatsoever to furnish any maintenance or support services for it.

If the app does not match a warranty either store offers, you may tell Apple, and Apple will refund what you paid for the app; beyond that refund, Apple has no other warranty obligation of any kind, and anything further is ours to answer. We, not Apple or Google, are responsible for a claim that the app infringes somebody else’s intellectual property, that it breaches a consumer-protection or product law, or that it caused a loss — and for answering your own questions and complaints about it, at the address in Contact.

Apple and its subsidiaries are third-party beneficiaries of these terms, and Apple has the right to enforce them against you as a third-party beneficiary of this agreement. You also confirm that you are not in a country subject to a United States Government embargo or designated by it as supporting terrorism, and that you are not on any United States Government list of prohibited or restricted parties.

The licence for the app. These terms are the licence agreement for the app. The licence is personal and non-transferable: you may use the app on Apple-branded devices that you own or control, as the Usage Rules in the Apple Media Services Terms and Conditions allow, and on Android devices that you own or control; on Apple devices the app may also be used by other accounts associated with the purchaser through Family Sharing or volume purchasing. Where we have not supplied these terms to Apple as the app’s licence agreement, Apple’s standard Licensed Application End User License Agreement applies to the app instead, and these terms still govern our service and your account. While using the app you must also keep to the agreements you have with others that this use touches — your mobile carrier’s data plan, for example.

No warranty, and the limit of our liability

Consumers in Quebec: this paragraph does not apply to you. The service is provided as is. It may be unavailable, it may contain errors, and its advice about a card game is not advice about anything else. To the extent the law allows, our total liability to you is limited to what you paid us in the previous twelve months.

Consumers in Quebec: this paragraph does not apply to you. To the maximum extent permitted by law, MapleGate Systems is not liable for any indirect, incidental, special or consequential damages, or for any loss of data, profits or goodwill. Nothing here excludes or limits liability that cannot lawfully be excluded — including under Canadian, EU or UK consumer law.

Governing law, and what happens if something goes wrong

These terms are governed by the laws of the Province of Alberta and the federal laws of Canada that apply in it, and the courts of Alberta have jurisdiction. If you are a consumer in Quebec, the laws of Quebec apply to these terms instead: the Quebec Consumer Protection Act does not allow a consumer contract to choose the law of another province. If you are a consumer in another Canadian province — Quebec and Ontario included — or in the EU, the UK or elsewhere, this does not take away the protection of the mandatory consumer law where you live, or your right to bring a claim in your own local courts.

Need help with a problem? You can write through the contact form; a person reads every message and answers it. This does not limit your statutory rights.

The rules, and what happens if they are broken

A single-player table has no other human player and no chat, so most of what "behaviour" means on other sites does not apply there. A live table does seat other people, and its own conduct rules — a foul, a complaint (one per player per game; appeal any time — a person answers an appeal without undue delay; we set no deadline of our own) — are covered under Privacy, along with the toxic-speech check, which may warn or give a foul at the table by itself. What we ask everywhere is short. Do not attack, overload, scrape or reverse-engineer the service; pretend to be another person, a club or a federation — in your display name, in a request to join a club, or in a message to us; register a club that does not exist or that you do not run; use several accounts to take a free trial, free access or a refund more than once; or knowingly make a false or fraudulent payment dispute. A genuine dispute with your bank remains your right. Abusive or harassing language in anything you write to us or to a club is covered by the same rules.

Two more lines, stated plainly. Cheating — sitting at one live table with two accounts, or passing your role to another player outside the game — is treated as seriously as fraud below. And criticising the game, its prices or us is never a reason for any of this. The whole ladder and the appeal path, on one short page: Rules and moderation.

Fair use. One account per person. Do not let a bot, a script or any other automation play, speak or sign up for you, at a live table or a practice one. Do not collect games, lines, reviews, voices or lessons from the service in bulk, and do not use them, or our bots, to train or improve an AI model. A referral reward earned through a fake account, a second account of your own or a game played by a script is not owed and is taken back, and the accounts involved may be closed, as with fraud below.

Leaving a live table is final for that game: a bot takes your seat and keeps it to the end, and coming back does not give it back. Missing your turn three times in a row counts as leaving, and a bot takes the seat the same way. A lost connection is different: you have 120 seconds to come back to the same seat and role. If the game ends during those 120 seconds, it still counts for you: its result, win or loss, is recorded, and it does not count as leaving. After those 120 seconds a bot plays your seat to the end of that game; if you come back to the same game before it ends, the lost connection still does not count as leaving — it counts only if you do not come back. However many times you leave one game, it counts once. If you leave a live table repeatedly — or are away from your turn three times in a row — the third time within your last ten games pauses your access to live tables for a short time that grows if it happens again, capped at three days; single-player tables stay open the whole time. The fourth foul in one game removes you from the table and also pauses live tables for you for at least 10 minutes, growing the same way. You are told the pause and the reason in plain words — for example what happened and in how many of your last ten games — never only a number. You can appeal it exactly the way you appeal a foul, above. Joining and leaving the queue for a live table three times within ten minutes, before the table sets off, pauses joining live tables for 5 minutes; if it happens again within 24 hours after that pause ends, the pause grows the same way — 10 minutes, 30 minutes, 24 hours, then three days at most. It lowers nothing else, tables with bots stay open, and it is appealed the same way. If you delete your account while a pause is still active, one thing survives it: a keyed one-way hash of your confirmed email address, the date the pause ends, its reason and which step of the ladder it was — never the address itself. Its only job is to stop the same pause being escaped by deleting the account and signing up again; it is deleted automatically once that date passes. If you change your email address while a pause is still active, the same is kept for the confirmed address you changed from, until the same date, so that changing the address does not escape the pause either.

A real threat to a person can pause live tables. A check reads each turn you speak at a live table for one thing only: a threat that points outside the game — at someone’s real life, home, address, family or personal data, or pushing someone to harm themselves. Game talk such as “the mafia will shoot you tonight” never counts. A threat typed as text pauses automatically. A threat said by voice is sent to a moderator at once instead: while the moderator reviews it, nothing happens to you and you are not told. The moderator either finds no violation — then nothing happens and nobody is told — or puts the pause on from that moment. During a pause, live tables with people are paused for you for 7 days and the hidden number described below goes down; practice tables with bots stay open, the game you are in goes on, and nobody else at the table is told. You are told at once — at the table and by email — and you can appeal with one tap, at the table or in your account. A person looks at every such pause, whether you appeal or not, and answers an appeal without undue delay; if the check got it wrong, the pause is lifted at once and the number restored. The same threat said twice in one game counts once, and this check never closes an account. On the date of this version this pause is switched on. Whenever it is switched off, the check only counts how often it would have fired, with no name attached.

A moderator — a person on our team — may give you a foul. When our anti-toxic check flags a turn you said at a live table, or a person reads a complaint about it, a moderator may give one ordinary foul for insulting or swearing at players (§6.7); on such a case it is the moderator, not the model, who decides. It counts exactly like a foul given at the table: your first and second are noted, the third makes your next minute silent, the fourth removes you from that game — one count per game whether a foul came from a sign, a complaint or a moderator, and one turn is never fouled twice. The host says the foul aloud, with the number only; if someone is speaking at that moment, a removal waits for the end of that speech. After the game ends, nothing changes in it: the foul is recorded on your account and the hidden number described under Privacy goes down. You are told at once if you are connected, otherwise the next time you sit at a live table — the line, the rule and one tap to appeal; a person reads the appeal, and if we got it wrong the foul is struck from your record and the point comes back; what the table already did in that game is not undone.

The table warns, and gives fouls, by itself for insults. Our own anti-toxic model, on our own server, reads each turn a person says at a live table — never a bot’s — when the turn ends. When it reads an insult, hate or a sexual remark, the table’s shared screen shows it to everybody as the seat and the category only — for example “Seat 4 — warning: insult” — never your words, and never who, if anybody, complained. A second such turn in the same game, or one the check is very sure about, is an ordinary foul on the same count as above, and the host’s line names its category — but only when a second signal agrees with the check: our own word list of insults, or our live abuse check. When the check fires alone, the table shows a warning and never a foul. You alone are told why, privately: the category, the rule, your line as it was heard, that the check decided it automatically, and one tap to say it is a mistake. For the first 7 days after this check is switched on, a person on our team reads it; after that, three jurors of the players’ court do — with every name removed, and only if you allowed jurors to read your lines; otherwise, or when the jury has not decided within 72 hours, a person on our team reads it. If they agree, the warning or foul is taken back, in front of the table if the game is still on; after the jurors’ answer you can ask a person on our team to look at it again. A turn the recogniser heard badly, a very short turn, or one in another language than the table’s gets only a private note to you, never a public warning or a foul. A threat, or anything about harming yourself or someone else, is never decided this way: it goes to a person, as described above. The check gives one account at most 6 warnings and fouls a day, and it stops for everybody past a daily limit. It acts only inside the game: it never pauses, restricts or closes an account and never changes the hidden number. A foul it gives is recorded on your account, and you can appeal it with one tap; the appeal is read as just described. The words of such a turn are kept up to 14 days for that appeal, as for a reported turn. This check can be switched off; while it is off, nothing is shown. When a live table starts, its shared screen shows the rule in one line.

After you report a player, what happens for you is your choice. In one tap: stop hearing that player (only you), never be seated with them when there is a choice of table, or both — a block. It is silent: nobody is told — not that player, not the table — and nothing at a table shows who avoided whom. You can undo it any time in your account. The player you reported is never told who reported them or what you chose, and you learn whether measures were taken only after the game.

A players’ court decides a restriction on an account — never a model. After you report a player you may also send your report to the players’ court with one tap. A case opens only when our automatic check also acted on that player in that game, or when at least two players with no link to each other — not in one club, not invited by one another, not on the same network — reported them; several linked players count as one. A case also opens by itself when a player has been removed from 2 games for fouls within 30 days; it is judged the same way, with the same rules about names and permission. Three jurors are picked at random among experienced players (at least 14 days on the site and 5 finished live games, no foul or restriction of their own in the last 30 days) with no link to the case: never anybody at that table, in a club with either side, invited by either side, or who played with either side in the last 7 days. Jurors see only the category, the line or lines as they were heard with every name replaced by “[player]”, whether the automatic check acted, and how many independent players reported — never an account, a name, who reported, or what anybody chose for themselves. Two votes of three are needed; if the jury has not decided within 72 hours, the case closes with no restriction. These numbers are for while players are few; when there are enough players the jury becomes five jurors who need four votes of five, each with at least 20 finished live games, and this page says so first. A restriction mutes your voice at public live tables — 24 hours the first time, then 3 days, then 7 days; a fourth within 90 days pauses live tables for 7 days. Club tables, private rooms and practice with bots are never affected, and you can still play with buttons and hand signs. You see the main reasons in your account and can appeal once, within 14 days, to a new jury of different players; if it clears you, the restriction is lifted at once. After that appeal you can ask a person on our team to review the decision. Threats, anything about harming yourself or someone else, and anything about a child are never sent to players: a person decides. Jurors read your lines only if you allowed it — a separate, optional tick on the sheet before your first live table or in your account, off until you tick it, never a condition of playing, and you can take it back in your account at any time; otherwise a person on our team reads such a case. Sending to the court needs an account at least 7 days old with a confirmed address, at most 3 a day and 10 minutes apart; if several of your reports to the court are not confirmed you are told so, and after 3 in 30 days sending to the court pauses for 14 days — muting and blocking always work. The player you reported is never told who reported them, and you learn whether measures were taken only after the game, never which. Until the court is switched on, the button is not shown.

What we do, in this order. First we write to you, say what we saw and which rule it touches, and ask you to stop. If it continues, we suspend the account and say so. If it continues after that — or if what we see at the start is serious, such as fraud, an attack on the service, or a knowingly false or fraudulent payment dispute — we close the account. Short of any of that, we can also end an account's sessions everywhere it is signed in, without suspending or closing the account itself. Deleting a suspended account, or having it closed by us, does not lift the decision: a new account under the same confirmed email address is suspended on the same ground until an appeal is decided.

We always say why, in writing, naming the rule and what we actually saw. You can answer. Write to the contact form with the word "Appeal" in your message; a person reads it and replies without undue delay, for a foul, a pause or a closed account alike; we set no deadline of our own, and if we got it wrong we put it back. Our decision is not the last word: you keep every right you have under the law where you live, including going to a court or to a consumer regulator.

If you had paid, you get the unused part of the period back. We refund it whoever was at fault — it is a few dollars and we would rather return it than argue about it. If you paid by card on the website, we refund it to your card ourselves. If you subscribed on Google Play, we refund it ourselves, through Google Play — automatically, or by hand — and end the subscription there. If you subscribed in the App Store, we can neither cancel it nor refund it: only you can cancel it, and only Apple can refund it. When we suspend your account we tell you how: cancel under Settings → your name → Subscriptions, and ask Apple at reportaproblem.apple.com; the decision is Apple’s. The single exception is money that is itself the problem: a payment already reversed by your bank, or one made with a card that was not yours. While an account is suspended, we take no new payment for it on the website: the card subscription is cancelled. A subscription bought in the App Store is charged by Apple, not by us, and Apple keeps charging it until you cancel it.

You can close your own account at any time from your profile — it is a button, not a request.

Who you are playing against: AI

The other seats at a practice table are AI — software, not people. Their decisions come from our game engine, their lines are prepared text (some of it may be written in advance by our own AI model, with the engine only picking which line is said) or, where that is switched on, text generated by a language model on our own server or on your own device, depending on the table and enabled features, and their voices are synthesised. Every such line, including one the model wrote in advance, is said by an AI seat and labelled as described below. At a live table a seat can be software too, including a seat a bot takes over from a player who left. A round-by-round review is built from the engine’s own facts; that same model can be switched on to add a paragraph in its own words, and while it is switched off — as it is on the date of this version — no model is asked anything for a review. Here is how you can tell which parts are software and which voices are synthetic. How you can tell, in practice: every table on this site shows a line saying that the bots and the host are AI and that their voices are synthetic, and at a live table a seat played by software also carries the word “bot” (while a more important marker such as “nominee” or “out” is showing on that seat, it stands in its place). A written review carries a line saying AI wrote it, marked the same way in the page’s own code. Every audio file our server sends — the host’s pre-recorded lines — carries a machine-readable AI mark inside the file and in the server’s response. In the Ogg and WAV files the site plays, that mark is signed with our own key and carries the time it was signed (the m4a copies of the host’s lines that the phone app plays carry it unsigned): on mafiavoice.com/ai-mark anyone can upload one of our audio files, or give the address of one of the host’s lines, and see whether the mark is ours and whether the sound has changed since it was signed. A voice made on your device produces no file we could mark; for it the mark is the visible line on the table.

Rules for the synthetic voices. Some voices we have used earlier were made from speech recordings published under an Open & Responsible AI licence (the “Dialogs” corpus); the bot voices made on your device today are not. That licence travels with the sound: by playing, recording or otherwise using a voice or an audio file from this service you agree to the use restrictions in Section 2 of the licence, whose full text is on our licences page. On top of them, and in plain words, you must not use our voices, or any sound they make, to imitate or impersonate a real person; to deceive or defraud anyone, including in a call, a message or a recording; for sexual, intimate or harassing content; or to defame, threaten or harass anyone. The licence itself also bars use that breaks the law, harms minors, spreads false information meant to harm, exposes personal data to harm someone, discriminates, gives medical advice, or serves justice, policing or immigration decisions. If you pass our audio on, you must pass these same rules on to whoever receives it.

Bot voices made on your device. Bot audio is made on your device. For English bot lines, our server converts the speakable text into text phonemes (IPA) and sends those phonemes to your device; it does not make or send audio. Only the bots’ lines are voiced, never anything a person says; the host keeps its recorded voice. After you choose a language, the website or the app downloads that language’s two bot voices from our own server, no third party: about 37 MB for Ukrainian, about 37 MB for Русский and about 37 MB for English; the website also downloads its speech engine once, about 11 MB. The app shows the size and asks before it downloads; the website downloads in the background and your first game does not wait for it. The files stay on your device (in the browser’s storage, or in the app’s own files) until you clear this site’s data or delete the app. Until the voices are ready, or if the download fails, the bots’ lines are shown as text. The speed check. Before the voices are used, and then during each game, your device measures how fast it makes speech; if it is too slow, the bots’ lines are shown as text instead, which you can follow at your own pace. We receive an anonymous record of each check and one per game: the device model as your browser or phone reports it (for example “Redmi Note 11 Pro”; the app on an iPhone sends the model code, such as “iPhone14.5”), the system, the browser or the app and its version, the number of processor cores and the total memory (the app: in whole gigabytes; a browser: as it reports it), the language, the voice and its version, and the measured speed — and, when they are known, how long the voice download took and how big it was, how long the voice model took to load on your device (initialising it and its first test line, in whole milliseconds), how long the first bot line took to start in a game, and, if the voices fall back to text, the reason (too slow, an error, no voice files, or the download failed). A report is sent when the device checks whether it can voice the bots, once per game, and when the bots’ lines fall back to text. It carries no name, no account, no email and no IP address (the address is used only in memory, to limit how often a check can be sent); the time is stored rounded to the hour, and it is deleted after 30 days. We keep it to know what share of devices can voice the bots, and why some cannot. The names it keeps on the device: the voice files in mafia-devvoice-v1 (the website’s cache; in the app, a “voices” folder of its own files); the speed check’s own result, so it does not run every game, in mv_devcheck:* (website) or mafia.devcheck (app); in the app, the languages you chose to download, mafia.devvoice.ok, and the languages whose size it has already shown you (a list), mafia.devvoice.asked; and the reading pace you chose for the bots’ lines shown as text, mafia.chatux.pace.

Voices and the models behind them. The bots’ and the host’s voices are synthesised by open voice models. Some of the models we use or have used come with a responsible-use licence (OpenRAIL), and that licence covers the voices they produce too. Its full text is on the open-source licences page. By using the game, and any voice audio or voice model file you receive from it, you agree not to use them: (a) in any way that breaks any applicable law; (b) to exploit or harm minors; (c) to create or spread verifiably false information or content meant to harm others; (d) to create or spread personal information that can be used to harm someone; (e) to present synthetic speech as human or not machine-generated; (f) to defame, disparage or harass others; (g) to impersonate anyone without their consent; (h) for fully automated decisions that harm someone’s legal rights or create a binding obligation; (i) to discriminate against or harm people based on their social behaviour or personal characteristics; (j) to exploit the vulnerabilities of a group of people because of their age, social, physical or mental situation in a way likely to cause harm; (k) to discriminate based on legally protected characteristics; (l) to give medical advice or interpret medical results; (m) for justice, law-enforcement, immigration or asylum purposes, such as predicting that someone will commit a crime.

Bluffing inside the game is part of play, not false information. If you pass on a voice file or a voice model, you must pass on these restrictions and the licence with it. The models keep their own licences; we add nothing that weakens them.

Reporting something illegal, and our point of contact

Anyone, with or without an account, can tell us about something on this site they believe is illegal — a display name, a club’s name, description or logo, or what happened at a table. Write to the contact form and choose the topic “Report illegal content”: give the page address, or the table and game, where it is; why you believe it is illegal; your name and email (these two may be left out when the report concerns child sexual abuse material); and tick the box confirming that you believe in good faith that what you wrote is accurate and complete. We confirm that it arrived, decide promptly and impartially, and tell you what we decided and how to challenge it. Whoever put it there is told the reason in writing, under the same rule as above, and may appeal — unless the law forbids telling them. Where a report shows that someone’s life or safety is in immediate danger, we tell the police; child sexual abuse material is reported to Cybertip.ca and the police, as Canadian law requires.

One point of contact, for players and for authorities alike (EU Digital Services Act): the contact form. You may write in any of the five languages this page is published in. You can also reply to any email we have sent you, or write under Account → Your messages to us; a person reads every one.

What is decided automatically

Eight automatic tools touch what happens to you, and each is named where it is described: the pause for repeatedly leaving live tables (above), the pause for joining and leaving the live queue again and again (above), the automatic pause for a real threat typed as text (above; a threat said by voice goes to a moderator first), the pause that makes an account younger than 7 days wait out a pause given on the same network and device (see Privacy), the check a complaint triggers — when you complain of an insult or profanity, our moderation model, or the fixed word list when the model is off, reads that one turn and decides alone whether it is a foul; a complaint that someone spoils the game on purpose is never decided this way (see Privacy) —, the toxic-speech check at live tables, which may show a warning or give an in-game foul by itself and never touches your account (see above), a hidden finish-rate number that only orders who is offered a seat first, and the newcomer shield: until a player has played five live tables to the end, they are not seated with a player whom a person has recently found breaking the rules — it only chooses the table, refuses nobody a seat and never counts an automatic decision on its own (see Privacy). Whatever any of them does to your account is explained in writing and can be appealed to a person. On request we tell you which of your personal information such a decision used, the reasons and the main factors that led to it, and you can have that information corrected. A restriction on your account for what you said at a table is never decided by any of these tools alone: a players’ court of people, or a person on our team, decides it.

Two more act on a purchase, never on play. If you choose the price for cards issued in Ukraine, we ask Stripe which country issued the card you paid with; if it is not Ukraine, the subscription is cancelled at once, anything already charged is refunded in full, and you can buy again at the ordinary price. That price is paid by card only — Apple Pay and Google Pay count as cards. If Stripe cannot tell which country issued the card, nothing is refunded automatically: the subscription moves to the ordinary price from the next period, and nothing more is charged that day; if your card was issued in Ukraine, write to us and a person will restore the price. We ask again at every renewal and every change of plan; if the card is then not from Ukraine, the plan continues at the ordinary price from the next billing date, nothing extra is charged that day, and we tell you by email. The same goes for the room for friends: its price for a card issued in Ukraine is $3.49 CAD a month instead of $7 CAD. And a purchase on the website is cancelled at once and refunded in full when its billing address is in Brazil or the card that paid was issued there, and also when it went through our ordinary checkout although its billing address or card is from the EU, the EEA or the United Kingdom, whose purchases go through Stripe Managed Payments — wherever you connect from. If Stripe does not tell us which country issued the card, the billing address alone decides. If the refund does not go through at once, our email says so, we keep trying, and a person is told. Neither uses up your one refund. Either way you get an email saying that the decision was automatic and why, and you can ask a person to look at it: reply to that email, or write to us under Account → Your messages to us.

What this game is not

Mafia is a traditional party game, invented in 1986 and played all over the world since. Its rules belong to nobody, and this is an independent practice tool for that game. It is not affiliated with, endorsed by or sponsored by the publisher of any video-game series of the same name, any board-game publisher, or any mafia club, federation or tournament organiser.

There is no gambling here. Nothing is staked, nothing is wagered, no entry fee is tied to winning, and no prize has any money value. What a subscription buys is coaching, never a bet on an outcome — so this is not a game of chance or a lottery scheme under the Criminal Code of Canada, and it is not real-money gaming under any app store’s rules.

The rest of the small print

• If one clause fails, the rest stand. A term a court finds unenforceable is narrowed to what the law does allow, or struck out on its own, and everything else here keeps working.
• Not enforcing something once does not give it up. We may still enforce it later.
• This page, together with what you were shown at checkout, is the whole agreement between us about the game. Nothing said anywhere else adds to it or takes away from it.
• We may transfer this agreement if the business is ever sold or reorganised — your terms, your price and the protection of your data travel with it unchanged, and you can still delete your account at any moment. You may not hand your account to somebody else.
• Things outside anyone’s control — a failure at the data centre, a network outage, a law that changes overnight — can interrupt the service. We fix what can be fixed, and the refund rules below still apply to a period that was genuinely unavailable.
• The parts that outlive the account — what belongs to us, the limit of our liability, the governing law and the clause above about the app stores — stay in force after you stop playing.

Privacy

The controller of your personal data is Oleksandr Martiuk, a sole proprietor in Calgary, Alberta, Canada, doing business as MapleGate Systems, which makes MafiaVoice. Questions about the providers we use outside Canada, and anything else on this page, go to him through the contact form. This page is our written policy on those providers — in which countries and for what — and we send a copy to anyone who asks.

What is actually stored

• A random account id, created by our server on your first visit and kept in your browser or, in the phone app, in the phone’s protected storage (Keychain on iPhone, Keystore on Android). It is not derived from anything about you.
• A display name — optional, and only if you choose one from the list.
• An email address — required, because it is your account. Without one you can at most try a practice table with bots. It is what makes your record survive a lost browser, it is how you sign in, and it is required before we can take a payment or send a receipt. We do not send a newsletter unless you ask for one, and that is a separate box you tick yourself.
• A country — optional, and only the two-letter code you pick from a list. It is used to know where players are, never to locate you. One thing depends on it: if you pick a country where MafiaVoice is not offered (see above), your account is closed for play over any connection — you can still download your data, delete the account, sign out and cancel a subscription.
• A preferred language — optional. It decides which language gets translated next and the language of the letters and notifications we send you, and nothing else.
• The date you agreed to these terms, and which version you agreed to. Consent has to be demonstrable, and a tick box with no date proves nothing. When we tell you on the start screen that the terms changed and you press “I accept”, or you tick “I accept the updated terms” on the sheet before a live table and press “Take my seat”, we note which version you accepted, and when — that is the record of your agreement to that version. “Not now”, or a box left unticked, records nothing.
• The French-terms choice: whether the sign-up page offered the French version, and whether you chose the French or English text when you agreed. We keep these two values with the date and version of the terms you accepted; they are deleted with your account and included in your data download. The offer is based on the network’s country estimate for that request (Canada, or a visitor it cannot place). We do not keep that estimate for this purpose.
• Whether you confirmed you are 16 or older, and when. Asked once, the first time you agree to these terms, and never asked again. And, separately, whether you confirmed you are 18 or older — asked once, the first time you join a table with other live people or pay, whichever comes first, because that is where the higher age in Terms applies. And, at the same door, whether you have seen the short notice about how speech works at a live table — shown once, before your first one, never again. And, at the same door, which version of the one-sentence promise not to insult or swear at other players you accepted, and when — asked before your first live table, and once more after a complaint against you for an insult or swearing is upheld, after a pause for a threat, or when the wording of the promise changes; kept as long as your account exists and deleted with it. If you answer that you are under 18, we keep the date you said so — never a birth date — so that the question is not put to you again for 24 hours; the practice table and the school stay open. If the App Store or Google Play tells the phone app that you are under 18, we keep the date we were told — never the age group — so that 18 or older cannot be confirmed on the site either, and an earlier confirmation is withdrawn. The first date is removed when you later confirm, after those 24 hours, that you are 18 or older. The second is removed only when we correct it after you ask us at the contact form — a later 18+ answer from the App Store or Google Play, or confirming 18 or older on the site, does not remove it. Until then both dates are kept for as long as your account exists and are deleted with it. Each of these answers, and a choice not to share your age group with the app, is also written to the technical log described below, kept at most 30 days. If the App Store or Google Play tells the phone app that you are under 16, the account is closed at once and deleted 7 days later; an account with no email address and no password is deleted at once. Until then we keep only the date we were told — never the age group — so that we know when to delete it, and we email you that date. If it is a mistake, write to us at the contact form before that date: we remove the date and open the account again.
• A sign-out counter — a plain number on your account, raised only when you (or we, after a security incident) sign you out everywhere. It lets the server refuse a sign-in token that was issued before that moment. It says nothing about you and it is never shown.
• Whether an account is ours — a yes-or-no mark, set by us only on an account that belongs to us: our own, a tester’s, or one an app store’s reviewer uses. Such an account is left out of the numbers we count (new accounts, subscriptions, how many people come back, the weekly totals); nothing else changes for it, and it is never shown to other players. A player’s account never carries it. It goes when the account goes.
• A "New here?" card dismissal counter — a plain number on your account, raised each time you close the door's course-suggestion card. It decides only whether we keep showing you that card; it says nothing about you and it is never shown.
• Game results — which role you had, whether you won, how many days it ran, which difficulty, and — on the one round a game gives you a best move — how many of the names you gave were right. Used to show you your own statistics, to price that round under the points shown on your own result screen, and to keep the game balanced. For a table you played to its end — live or practice — also, for 30 days after it ends, the game as the engine recorded it: every seat’s display name and face, the roles, the moves (including what the table understood from a speech or a hand sign, such as whom it accused) and who voted for whom — never the words anyone said. Only you, and each other person who played that table to its end, can open its result and review again, each from their own account through the table’s own link, during those 30 days; then that record is deleted, with its review, and the game results above stay. We keep a note of that table’s id and the day its record was deleted, so that its link says “no longer kept” rather than “not found”; it goes with your account. To anybody else the table does not exist. We also keep one number: how many practice games you have finished, so that «games played» on your account stays right after the games themselves are deleted. It goes when your account goes.
• Anything you type into the feedback box, so that features several people ask for can be built. The "Report a problem" tab also attaches automatically: the page you were on, which part of the app it was (the site, the door, or the phone), which screen inside it, your chosen language, the build you were running, and the size of your window — never a full web address, and never a fingerprint of your device beyond that; the one other place a device model is reported is the anonymous voice check described under “Bot voices made on your device”. You can report a problem as a guest or with an account. The report is linked to your player identifier and, if you have registered, the email address on file. If no player identifier reaches us, the report is instead linked to a keyed one-way hash of the sending IP address — never the address itself — to enforce report limits; after 30 days the hash is removed and the report keeps no sender at all. When you submit a problem report from a table, we also attach its identifier, day and phase, and, if available, the last speaker’s seat and display name and up to 200 characters of their last line. The server checks that you sat at that table. This excerpt is saved with your report for investigating the problem; unlike the table’s temporary feed, it remains after the table ends — for 14 days, after which the speaker’s name and line are removed and the report stays without them. If the speaker deletes their account sooner, their name becomes their seat number and the line is removed. A report linked to your account is deleted with your feedback when you delete your account; a report left with no sender is deleted after 24 months. No audio is attached.
• What you write to us, and our answers — through the contact form, “Report a problem” or a refund request — kept together in one place, so that one person can read, answer and follow up every message. Signed in, you see your own messages and our answers in your account, and they go when you delete your account. Without an account, the email address you type is kept next to your message so that we can answer it, and used for nothing else; the messages, our answers and the address are deleted 24 months after the last message in that conversation, or sooner if you ask us to. The few words you may write after “Something else”, if you host a private room and answer the one question about why you did not take it, are kept the same way, at most 200 characters, with your account: only we read them, and they go when you delete your account.
• Whether you chose to share your progress with your club, and when you switched it on. It is off unless you turn it on; while it is on, your club's organiser sees your display name, the highest step you have passed, how many sessions you have passed and when you were last active — never your email address, never a single game, never which side you played. It also shows one yes or no — whether you are ready for the club’s table: that you have finished a game, passed a lesson and opened a game review. It is worked out from those records when the organiser opens the club page, and nothing new is stored for it. Turn it off and you leave the organiser's view at once. Whether you share or not, the organiser's member list shows each member's display name and the date they joined, so that a spam sign-up can be removed, and the club's checklist shows one yes or no — whether at least two members have finished a game — and only once the club has five members. Never how many games you played, and never whether you pay.
• Whether you asked for revision reminders, and when the last one was sent, so the one-a-week limit holds. It is off unless you tick its own box — in Settings in the app, or on your account page on the website; that same box also sends, once a week, a short note naming your best read of the week and what to study next, with the week's games, wins and rating, and your club's next table if it has one. The letter names how many sessions are due and links back to the course, and one click in it turns all of it off for good, with no sign-in.
• A table you asked to be reminded about, and whether you switched that off. Pressing "Remind me" on one upcoming table stores that table's time and language against your account, and — if you belong to a club and turned on its own reminder — the same for that club's next table; a table reminder is erased the moment it is sent or the table starts; for a club’s standing reminder we keep only the time each letter went out, for 7 days, so the once-a-day and three-a-week limits hold. We send at most one letter per table, ten minutes before it starts (or thirty minutes for a club's own standing reminder, capped at once a day and three a week), never more — if you turned notifications on in the phone app, the reminder for a table you pressed "Remind me" on comes there as a push notification instead of the letter — and the letter's own link turns off table reminders for good, with no sign-in — separately from the revision-reminder and weekly-note box above, so turning one off never silently turns off the other.
• A push-notification token, if you turn notifications on in Settings on the phone — a device address issued by Apple or Google, the app's own language, which kind of phone it is, the phone’s time zone, and when we last sent to it, so the one-a-day limit holds and nothing is sent outside 9:00–21:00 your time (a reminder that would fall at night comes by e-mail instead). It is off unless you turn it on yourself, and turning it off in Settings removes the token from our server at once. Turning notifications off only in your phone’s own settings stops them showing, but the token stays on our server until you turn it off in Settings, sign out, or Apple or Google tell us it no longer works. Signing out in the app ends your session on our server and removes this phone’s token as well. It carries the same reminders the emails above do — a revision due, once a week a short note with your best read of the week, and a table you pressed “Remind me” on — on this device instead of by letter, and nothing else. It goes when your account goes.
• Which federation's rulebook your club plays by, if its organiser set one — a fact about the club, not about you; it only changes which official rulebook a few lessons show you.
• A club referral code, if you arrived through a club's link, so the club can be credited. A partner's code — from a partner's link, or typed by you at sign-up — is kept aside with your account and earns nobody anything unless, when you pay, it belongs to an active partner; it is deleted with your account. Together with the code we keep the time it was noted, so that the 12 hours a note on a guest record lives can be counted (link codes). The time is deleted together with a guest record's note when those 12 hours have passed, and otherwise no later than the record or the account itself.
• The line you write when you ask to join a club, if you ask to join one. It is shown to that club's organiser and to nobody else, alongside your display name and how many games you have played — never your email address, and never how well you played. It is deleted with your account, and it is deleted when the club answers. The organiser is also emailed, at most once a day and only when somebody new has asked, the display names of up to 10 people who asked to join (yours among them, if you chose one), how many are waiting and a link to the club page — never your line, your email address or anything about how you play. We send it because you asked to join that club and its organiser has to answer; the organiser can stop these emails for the club with one click. A letter already sent stays in the organiser’s mailbox.
• Which reads you made and which you walked past — one row per round, tagged by the kind of tell it was. That is the coach review, and it is also a record of how you play, so it is named here rather than folded into "game results". It is never shown to anyone else, and never to your club except inside the one club-wide count described under Clubs and club codes, and it goes when your account goes.
• Which sessions of the school you have passed — the score, how many attempts it took and when it was, because that is what decides when a session comes back for revision and when a step opens. And where a lesson asks you to play a hand: whether you played it, and whether that game answered the lesson's question. And, so a revisit can show you the same quiz marked up with what you answered and what was right: the answers you actually picked, and which attempt they were drawn from — a template question changes with the attempt, and without that number a revisit would mark up the wrong version of it. And the date you finished the five core rules lessons, or passed the short rules check before your first live table, whichever happened first: stamped once, and never moved — so we never ask you to prove you know the rules a second time. It is never shown to anyone else, never to your club, and it goes when your account goes.
• Lesson materials shown to your account may carry technical marks tied to your account to protect them from copying; the marks store nothing new about you.
• A record of the letters we sent you — the kind and the date, so a reminder is not sent twice and a daily limit can be honoured. Never the contents of anything you reply.
• If a letter we send bounces, or its reader marks it as spam, a one-way code made from that address and the reason, so that we do not write to it again for 24 months, after which it is deleted; our email provider tells us. And, for one day and only in the server's memory, how many letters were asked for from each network, so that one network cannot use up the day's letters for everyone.
• When you were last here, and whether you have paused your account. Used to decide whether to send anything at all, and to count how many people are actually playing.
• A technical log of refusals and errors — an action the server rejected, a script that threw, the shape of a finished game. It carries your account id so a fault can be traced to the game it happened in, and it never contains anything you typed. Capped, overwritten oldest-first, and nothing in it is kept longer than 30 days: days, not years. In the phone app, the same log receives an error’s message, up to a few lines of where in the code it happened, and which screen it was — linked to your account id, kept at most 30 days, never your app version, phone model or anything you typed. If the app is offline, the report waits in the app’s memory, not on the phone, and is sent when the connection returns while the app is still open. We use no third-party crash-reporting service. Apple and Google may also give us crash statistics from people who chose to share them in their phone’s own settings; that choice and that data are theirs, and we see it only in their developer consoles.
• A security log, separate from the technical log above: sign-ins that worked and that failed, password changes, limits you ran into, input the server refused, what an administrator did, and moderation events — each with your account id, never a password and never the text you typed. It is kept 90 days; moderation events up to 6 months; an administrator’s action one year; the record that you turned news letters on or unsubscribed three years, because consent has to be demonstrable; a keyed hash of the address of anyone who tries an administrator-only page, one year. The web server’s own access log keeps the page asked for, what your browser says about itself and your IP address with its last part removed, for at most 14 days. If you delete your account, the sign-in entries of this log (sign-ins that worked and that failed, password resets and changes, and that the account was deleted) are kept for the rest of their 90 days without your account id, under a keyed one-way code made from your confirmed email address; every other entry is deleted with the account.
• Your settings — difficulty, sound, face, the languages you ticked — so a cleared browser costs you a session rather than a whole setup.
• If you pay: an identifier from whichever till you paid through — Stripe on the web, or the App Store/Google Play (through RevenueCat) on the phone — linking your account to your subscription, when it renews, whether it is ending, whether it is paused and until when, and when it last changed. If a renewal charge fails, it also notes when it first failed, so that you keep the paid features for up to 14 days from that moment and not longer; the next successful payment clears that note. If you pause the subscription, it notes which subscription the pause belongs to, so that no other subscription on your account can lift or change it. Both are needed to carry out your subscription and go with your account. It also names which plan you are on — monthly or yearly — and whether each of the renewal notices below has already gone out for your current period, so neither is ever sent twice. If you bought a yearly plan with a Quebec billing address, it also notes that, so the plan ends instead of renewing and its one expiry notice is sent once. On the monthly plan it also keeps the date your subscription started and how many of the once-a-year reminders have gone out, so each one is sent once, on its anniversary. If your first month came with an introductory price, it also names the date your first full-price renewal falls on and whether that one-time reminder has already gone out — the same "has this letter been sent" fact as the renewal notices, for the one renewal that changes your price. If you chose the price for cards issued in Ukraine, the subscription’s record at Stripe also notes that it was that price; and the country that issued the card, checked at the first payment and at every renewal, is written to the technical log, which keeps nothing longer than 30 days — at every renewal, and at the first payment only when it is not Ukraine or cannot be told. If you withdraw from a contract from the EU, the EEA or the UK, we keep that you withdrew, from which contract, and the date and time it reached us, with the refund record, for the same time; your name and the address appear only in the confirmation we email you. The copy of the agreement we email you shows your billing name and address as Stripe holds them: we read them from Stripe when the letter is made and do not keep them. What you were shown when you agreed to buy: for each purchase, a record of the notice you accepted — what you bought, the price, currency and period shown, the version of these terms, a code naming the exact notice text, the page language, whether it was the website or the iPhone or Android app, and the time. It is our proof of what you agreed to, which consumer law asks a seller to keep (California’s automatic-renewal law: at least 3 years); it is kept with the payment records for the same six years, it is in your data download, and if you delete your account it is kept without the link to you. Never a card number — those never reach our server at all.
• If you ask for a refund: the date you asked, the charge or invoice it concerns, your own free-text reason, and the decision. A refund that is actually granted keeps your email address and payment method for up to 24 months — long enough to stop the same address or payment method claiming a second free trial or free access a second time — and after that, only the date, the amount and its currency, the charge it concerned, the decision and our own note on it remain; your email, the payment-method reference and your own free-text reason are cleared. The date, amount and decision are one of a few entries on this page that survive deleting your account too, because they describe the address and the payment method, not the account row — but your free-text reason is cleared the moment the account is, whichever comes first. A request that is refused, or never decided either way, keeps the address you wrote from, the charge it concerned and the payment-method reference — even after you delete the account — and is deleted after two years.
• If free access we gave you through an invitation is taken back: a mark that it was revoked, and the date. Like the refund record above, this survives deleting your account, for the same reason — it stops the same address being handed that free access again after a fresh sign-up. It is kept as a keyed one-way code made from your address — never the address itself, and not linked to your account — for as long as the access stays revoked and 12 months after.
• If you run a club: which club it is, so your own access stays open.
• If you apply to bring a club: what you typed on the application — the club's name, its country and city, where it meets (a venue or an area; we never ask for and never publish a home address), when it meets, a page of the club's own on the internet, roughly how many play, its federation, its logo, and anything you added. The language of the page you applied on (en, ru or uk), so that the letters about the application come in that language; nothing else uses it. The date you confirmed the email address by pressing the button on the page our link opens — an application is not looked at until you do, so nobody can put a club in our queue using somebody else's address. And the decision, and the reason we wrote: the same words we email you are kept on the club so your own club page can show them, which is how you still have the answer if you delete the letter. It is a record about a club, not about a player; it goes with the club. If you delete your account, an application sent from the email address you confirmed on that account goes with it while it is not yet approved; from an approved club your address and name are removed, and the club is closed if it is still open. If you ask us to verify a club: the six things on that form (the club's name, city and country, the one public link, your name, the address we answer to, and how often and where you play, if you add it), the answers to our six checks, the decision and its reason, and when each happened. It is a record about a club and goes with the club.
• If somebody introduced you — their account, and whether that introduction has been credited yet. It is how the referral days reach you and the person who brought you here. If you pay by card, we also keep a one-way code made from the card identifier Stripe gives us (never the card number), only to check that you and the person who invited you — or a friend you invited — did not pay with the same card, and that a partner’s own account and a person who paid through that partner’s code did not either. It is a keyed one-way code — made with a secret key that only our server holds, so it cannot be turned back into the card or its identifier — and it is kept for every account that pays by card, so that the check works from the very first payment: a legitimate interest in preventing fraud, which you can object to. For an account that is not part of such a pair it is deleted 400 days after the last payment with that card; in every case it goes with your account. They are never told what you play, how you score, or anything else about you; they see a count of how many people used their link and how many of those went on to pay. If you were invited and then paid, the identifiers of that first payment — Stripe's invoice, charge and payment ids, or the App Store or Google Play transaction id — are kept with the reward record, only so that a refund or dispute of that same payment, and no other, takes back the 30 days it earned; they go with your account. If you joined through a friend’s link from the same network that friend’s account had used during the day before, a yes-or-no mark of that — nothing about the network itself; it is what decides whether the friend gets 7 days, and it goes with your account. Delete your account and the link between you goes with it.
• If a bank takes back a payment of yours, or warns that it may be fraudulent: a note of that on your account, with the date — nothing else. It is kept up to 400 days, so that a payment taken back never counts as proof that an account can be trusted, and it goes with your account.
• Your password, as a hash — never the password itself. If you set one, what we store is the output of scrypt with a random salt unique to your account. It cannot be turned back into your password, by us or by anybody who takes a copy of the database. We are saying this plainly because people reuse passwords, and you are entitled to know how the ones you hand over are kept. Making an account asks for one, and the emailed sign-in link stays as the way back in when it is forgotten. Delete your account and it goes with it.
• A change of your email address, while it is under way. When you ask to change it on the Account page, we keep your current and your new address, when you asked, and one-time links stored only as hashes, like a sign-in link’s. Nothing changes until the new address opens its link, which works once and expires in ten minutes; until then your current address signs in as before. If your account has no password, your current address approves the change first, with a link that also works once and expires in ten minutes. When the change is done, every other device is signed out, and for 30 days nobody else can register the old address, so the stop link sent to it always has an account to give back. Opening that stop link signs every device out and removes your password — whoever asked for the change knew it — and you set a new one straight away. The record is deleted within a day after 30 days have passed since the request or, for a change that was made, since the change. Delete your account and it goes with it.
• A live table, while it is actually running — your seat number, what state that seat is in, and the clocks the server runs. It lives in the running server's memory and nowhere else: it is never written to the database, it does not survive a restart, and no transcript of a game outlives it by more than 10 minutes, the time to report a turn from the results screen — the one exception is a single turn a complaint names, that the automatic check gave a foul for, or that the moderation model marks as harassment or luring, held for up to 14 days so it can be reviewed and appealed, then deleted the same way (see below). The one other exception is a turn the threat check paused someone for or sent to a moderator, or that our anti-toxic model sent to a moderator: it stays only in the server’s memory, at most 72 hours. What is left once the table ends is the game record named above under “Game results” — the other seats’ display names and faces included — plus a short record of which table and which seat it came from, written when you sit down — so a fault can be traced back to the table it happened in, the same reason the error log above carries your account id. It goes when your account goes. Joining also mints a resume token — a short-lived pass tied to your account and that one seat, so a dropped connection walks back into the same chair instead of losing the game. It holds nothing about you and it dies with the table.
• The text your browser makes of your speech, at a live table, once you have allowed it; at a practice table on the website the microphone is not used. Your browser turns speech into text, only inside your own speaking turn, and sends us the text. No sound is sent to us for recognition; if you allow it, the sound of your voice reaches the other players only through our own relay, which records nothing — see “Your voice, while a live table is talking” below. Where that recognition actually happens is your browser's doing and not ours: Chrome sends the audio to Google's servers; Safari does it on your device when it can, and otherwise on Apple's servers; a browser with no speech recognition sends nothing at all, and the table tells you the bots will not hear you. Before the microphone is used for this the first time, the game asks you to Allow or choose Not now; until you allow, nothing is recognised and you play with buttons, gestures and typing. You can change your answer any time in Settings → Sound and voice; the answer is kept on your device. What reaches us goes to exactly two places (a third only if you switch it on yourself: helping train our bots): the engine, so your move is understood, and moderation — our own model, on the same server, reads every turn for a fixed list of rule breaks (threats, harassment, luring players to another service, deliberately breaking the game). A turn it marks as harassment or luring is kept up to 14 days for a person to review; for every other mark only the label is kept, never the words — except a turn our anti-toxic model sends to a moderator, whose words stay in the server’s memory only, at most 72 hours (see below). A fixed rule, separate from the model, also notices a web address, an @-handle, a phone number or an IP address said in a turn. That only puts the table, the seat and the turn in front of a person — never the words, never a foul, never a change to the hidden number — and the row is kept 12 months like a complaint. It is never shown to another player at the table (the one exception — a reported line read by jurors without names, only if you allowed it — is under “If you take part in the players’ court”) — the table's feed carries the host's lines and gestures only. It is shown to you alone in two cases: if a complaint about that turn is upheld, one sentence of it, up to 300 characters, so that you can appeal (see the complaint entry below); and if the check privately warns you about an insult in it (see below). It is held in the running server's memory, capped at a few thousand characters per turn, and deleted 10 minutes after the table ends, so that you can still report a turn from the results screen, other than the one turn a complaint names, that the automatic check gave a foul for, or that the moderation model marks as harassment or luring, which is kept up to 14 days for review and appeal, and the turn the threat check paused someone for or sent to a moderator, or that our anti-toxic model sent to a moderator, which stays in memory only and at most 72 hours — see the complaint entry below. We never use the words of your speech to sell you anything, to advertise, or to train another company's AI — the only count we ever draw from speech content is one daily total of turns the checks flagged, with no account, table or quote, kept 30 days, plus one technical line per checked turn with numbers only — the check’s category and score, the model version, the word count, the language and the seat — with no account, table or words, also kept 30 days; that line by itself changes nothing. While we test a model that reads the moves in a turn alongside our rules, it may write one more such line per turn: the language, the kinds of move and the seat numbers each reading found, the flags the model raised and how long the reading took — no words, account or table, kept at most 30 days; it changes nothing in the game. Our own bots learn from real speech only if you switch it on yourself — a de-identified copy of your own turns, off by default, kept at most 12 months and deleted the moment you switch it off; see Helping train our bots with your speech. In the phone app the phone does the job your browser does on the website. At a live table the phone listens by itself during your own minute, with a 🎤 sign on screen while it does; at a practice table it listens only while you hold the talk button; and it lets go of the microphone as soon as the app goes to the background. While it listens, the phone turns your speech into text — on the phone itself when it can, otherwise through the phone’s speech service (Apple on an iPhone; on Android the phone’s default service, usually Google’s), which then receives the sound. No sound is sent to us for recognition. At a practice table the phone only works out which seat you named and sends us that choice. At a live table it sends us the text of your turn, used exactly as described above: the bots read it as your turn and our own model checks it, it is shown to nobody, and the same 10-minute, 14-day and 72-hour rules apply. Before the phone first asks for microphone and speech-recognition permission, the game asks you; say no and you play with buttons and hand signs. At a live table the app also carries your voice to the other players, as the next entry describes.
• Your voice, while a live table is talking — on the website and in the app alike. Your microphone goes live to the other players only when it is your turn to speak and, if you are mafia, in the mafia’s short first-night agreement, which only the mafia hears. The first time, the game asks you; say no and you still hear the table and play with buttons and hand signs. You never hear a player you have blocked. The audio is relayed by our own server in Germany, seat to seat, so the others hear you. The relay is the open-source LiveKit software, which we run ourselves on that server; neither LiveKit the company nor any other voice service receives any of it. Nothing is recorded. That relay's own recording feature is switched off, there is no camera and no screen sharing, and no audio of any kind is written to a disk or to the database. It is carried and dropped, the way a telephone line carries a call.
• What the characters say comes from the game engine’s own prepared lines. Some of those lines may be written in advance by our own AI model. Before any game, a model we adapted ourselves from an openly licensed one writes a bank of lines, on computers we own or rent. During a game the server only picks a line from that bank; the game engine alone decides every move — who is accused, voted for or killed, and what a bot claims. No data of any player is used to write or train these lines — no game, account, name, message or voice of yours, and not even the speech you may choose to share for training our bots, which is off unless you switch it on and is described under Privacy. A line goes through our own automatic safety check as it is said, and one that fails it is replaced by a line from the engine. Every such line is said by an AI seat and labelled as AI, as described under “The other seats at a practice table are AI”. A separate feature that has our own model word them while the game is running, on our own machine standing next to the game on the same rented server, is switched off on the date of this version. No AI company is involved and nothing from your game is sent to one. When that feature is on, on a single-player table that same model may instead be downloaded to your device and run there; your browser keeps the file in its own cache so a second visit does not fetch it again. It is the same file for everybody, it carries nothing about you, and clearing your browser's site data removes it. English voices you choose to download for this device are kept the same way: the same files for everybody, carrying nothing about you; clearing your browser's site data removes them.
• A hand sign itself is not stored. A sign is seen, for a few seconds, by everyone at that table — even one addressed to a single seat, as at a real table; a sign made at night, only by the mafia — and by nobody outside it, and is never written into the game's feed — nobody can scroll back afterwards and read who signalled to whom. The one exception is a sign made too often in a single daytime speaking turn: the fourth becomes a foul, and a foul is a line from the host like any other, kept with the game. At night a sign never becomes a foul: after 12 signs from one seat in one night, the next ones are simply not sent, and only you are told. What the table reads from a sign as a move — a shown sheriff’s check, an accusation, a defence or a question to a seat — is kept in the game record named under “Game results”, like any other move.
• If you complain about another player, or somebody complains about you: who complained, who about, the seat and the turn it happened in, the reason from a fixed list (never free text), the decision, the rule it was given under and what it cost. You can complain during the game or, for 10 minutes after it ends, from the results screen. The turn's own words are held for up to 14 days — long enough for a person to review them and for you to appeal — and then deleted, the same way an ordinary turn is; before that they reach nobody but us, never the rest of the table and never the person who complained — except that, when a players’ court case opens and the player allowed it, up to 7 jurors picked at random read them with every name removed. If a foul is given, the player who said them is shown one sentence of that turn, up to 300 characters — at the table and in their account, to them alone, with the rule it broke — so that they can appeal; once the 14 days have passed, the account says only that the text was deleted. The decision itself outlives the words — which rule, what happened, who or what decided — and is kept for 12 months without them, so a pattern of fouls still means something after the words themselves are gone. Only we read a complaint; the rest of the table, and the player it was about, are never told who complained. The person who complained is told only whether measures were taken — never the words, the rule or the foul. When the words of a reported turn match our list of hate or war terms, a person reads them — at most 20 such complaints in any 24 hours; above that, the complaint is closed without a foul and its words are not kept. A complaint by itself punishes nobody: it only makes the check named under What is decided automatically read that one turn, and nothing here closes an account. If a foul is given you are told, and you may appeal in your own words, up to 500 characters — a person answers without undue delay; we set no deadline of our own. A complaint of yours that is not confirmed costs you nothing. Only a pattern does: if, among your last 10 complaints of an insult or profanity that were checked, 3 were not confirmed, against 3 different players, and none was confirmed, the hidden number below goes down; you see this in your account and may appeal it the same way. A complaint that a player spoils the game on purpose is decided only by a person, never automatically; if it is upheld, the hidden number of the player it was about goes down, with no foul in the game, and they may appeal it the same way. Delete your account and your name is erased from every complaint you appear in, on either side of it, and any held words go with it at once. Your own appeal — against a foul given to you, or against your complaints being counted as a pattern — is read only by us, never by the other player; it is kept with the complaint for its 12 months and is deleted at once if you delete your account.
• If you take part in the players’ court — as the player reported, as a reporter or as a juror: the case (the category, the line or lines with every name removed — a nickname, and also a first name, surname or contact said aloud —, whether the automatic check acted, how many independent players reported, the votes and the outcome) and any restriction with its dates, kept 12 months after the decision; for a juror, the date you ticked «I keep cases confidential» (asked once, before your first case), which cases you were invited to and how you voted — shown to nobody else — and a count of your answers on control cases with a known answer; for a reporter, which report you sent to the court, when, and a keyed one-way code of your network (never the address), used only to tell independent reporters apart; your consent tick for jurors and its date; for a player removed from a game for fouls, which game and when — kept 30 days, only to open such a case. Deleting your account deletes your requests, invitations, votes, consent, that tick and restrictions; a case keeps no name. If a restriction is still running when you delete the account, one thing survives it: a keyed one-way hash of your confirmed email address, the date the restriction ends and its kind (voice or pause) — never the address itself. Its only job is to stop the same restriction being escaped by deleting the account and signing up again; it is deleted automatically once that date passes. If you change your email address while a restriction is still running, the same is kept for the confirmed address you changed from, until the same date.
• If you block, mute or avoid another player: which account, which of the three you chose, and when — no reason, nothing else. Mute: you no longer hear what they say at a live table and it is not shown to you as text. Avoid: when there is a choice of table, the two of you are not seated together. Block: both. The other player is never told, and nothing at a table shows it. The list is in your account (the reports tab), and you can undo any of them at any time. Deleting either account deletes it.
• If the table's own automatic check reads something you said as toxic, an insult or a threat: nobody filed this — it lands in the same place a complaint would, but with no complainer, only a yes/no mark for which kind it read, never the words and never the recognised text of the turn. By itself it changes nothing: enforcing it is a separate switch we have not turned on. If that switch is ever turned on, it follows the exact same rule as a real complaint — one ordinary foul, appealable in your own words, and nothing here closes an account. Delete your account and it is erased from this row exactly as from a complaint.
• If the table’s automatic check warns you, or gives you a foul, for an insult, hate or a sexual remark: it may show a warning for your seat on the table’s shared screen, or give an ordinary foul (see Terms). A warning or a foul is recorded like an upheld complaint but with no complainer — a warning costs nothing — the seat, the turn, the category, the rule and what it cost — and the words of that one turn are held up to 14 days for your appeal, shown to you alone and to the person who reads your appeal. The record is kept 12 months, like a complaint, and it does not change the hidden number. We also keep one count a day per language — turns read, warnings, fouls, private notes and decisions taken back — with no account, table or words, so that the check can be made stricter for a language whose decisions are taken back too often. Delete your account and it is erased from this row exactly as from a complaint.
• If a check hears an explicit insult to another player in a turn you said, before anybody complains: the table may warn you privately — your own line, up to 300 characters, the rule, and that there is no foul and no penalty — at most twice a game. The warning is shown to you alone, and its words are not stored anywhere. What is kept is a note that a warning was given — your account, the game and the seat, never the words — for at most 90 days. It never counts against you. While this warning is switched off for players — on the date of this version it is — the check only makes that note, and you are shown nothing.
• If the check for a real threat finds one in a turn you said (see Terms): the words themselves are never written down — not to the database, not to a log, not in a letter. What is recorded is that it happened: the table, your seat and turn, when, the kind of threat (for example “your home or address”) and the names of the check’s own rules that matched, the pause and the change to the hidden number, and later a person’s decision and your appeal if you make one, in your own words up to 500 characters. For a turn said by voice there is no pause and no change to the hidden number until a moderator decides; the record then holds that decision — no violation, or the pause from that moment. That record is kept for 12 months, like a complaint, and deleting your account erases your name from it. So that a person can look at the case, the words of that one turn stay in the running server’s memory only — never on a disk — until a person has decided or 72 hours have passed, whichever comes first; a restart of the server loses them sooner. Nobody but us sees them. We also get one email naming your account id, your display name and the kind of threat. For a turn said by voice it comes at once, with a push alert that carries only the case number. Several close together are grouped into one push alert that carries only their count. A turn the check only suspects of being a threat (for example a threat-like phrase said aloud) reaches a moderator in the same way: its words stay in the server’s memory only, under the same limit, no push alert or email is sent, and nothing is paused, changed or told to anyone unless a person decides so. A turn our own anti-toxic model is sure is abusive — such as an insult, hate, a sexual remark, a threat, spam or talk of self-harm — when our word list of insults and the threat check said nothing about it, reaches a moderator the same way, at most once per player per game and within a daily limit: the record holds the table, your seat and turn, the language, the category and the model’s score, and is kept like the record above; its words stay in the server’s memory only, under the same limit; no push alert or email is sent; and nothing is paused, fouled, changed or told to anyone unless a person decides so. While this pause is switched off, the check keeps only a count of how often it would have fired, by kind only, with no name, table, language or words; on the date of this version it is switched on.
• A hidden number for whether you finish the games you start — one score per account. It goes down when you leave a live game or miss your turn three times in a row — from the third time within your last ten games —, every time you are removed from a table at the fourth foul, when a complaint against you is confirmed — by a person or by the automatic check, including a complaint that you spoil the game —, when a moderator gives you a foul on a turn our check flagged, when you are paused for a real threat, and for a repeated pattern of your complaints that were not confirmed, against different players (see above). Finishing a game raises it a little, up to a small ceiling. It is shown to nobody, on any screen, including you. Its only use is the order in which people are offered a seat. Because it assesses how you behave at a table, it is profiling; it cannot be switched off, because without it a live table cannot be filled fairly — if you do not want it, practise alone with the bots, where it is never used. It is deleted outright when you delete your account. One exception: if a pause from live tables is still running when you delete the account, the record described under Terms stays until that pause ends, at most 7 days.
• The newcomer shield — nothing new is stored. Until you have played five live tables to the end (practice tables with bots do not count), we do not seat you at a public live table with a player who, in the last 30 days, had a complaint upheld or a foul given against them by a person on our team, had an automatic foul upheld on appeal by a person or by the players’ court, or had a pause for a real threat that a person reviewed and kept — unless a later appeal overturned it — nor with a player who has a pause from the players’ court still running. It works both ways, whoever joins the table first. An automatic decision on its own never counts: not a warning or a foul the table gave by itself, not a score from our model, not a pause for leaving tables or for the live queue, and not an automatic threat pause that no person kept. The shield uses only records this page already describes — how many live tables you finished, upheld complaints and fouls, and pauses —, reads them when you join a live table, and stores nothing new. Its only use is choosing your table: nobody is refused a seat and nobody waits longer — if every open table is ruled out, a new one opens, and bots play the seats nobody takes. Club tables and private rooms are not affected. Neither player is told, and nothing at the table shows it. Our ground is a legitimate interest — fair and safe first games for new players — which you can object to. As with any automatic decision, you can ask a person to look at it and have a record it used corrected (see What is decided automatically, in Terms).
• If you ask for a round-by-round review of a game: the review is stored against that one game and your account — the language it was written in, whether any of it was written by our model (while the model’s own words are switched off, none of it is: you are shown the engine’s own facts) and, if so, which model, and the text you were given, which names the seats it talks about. It is yours alone and shown to nobody else, not to your club. It is deleted with its game, 30 days after the game ends. If you delete a single review within 24 hours of receiving it, its text and its link to the game are erased at once, but a note that one review was delivered — only the time, the language and whether our model wrote any of it — stays on your account, so that deleting cannot reset the daily allowance; the note is removed at the first daily clean-up after those 24 hours, no later than 48 hours after the review was delivered. The technical log also keeps, for at most 30 days, that you deleted the review of that game. Deleting your account deletes every one of them. If you answer the one question under a review — “Did the review help?”: Yes, No or Not now — we keep your answer (“Not now” too, so that you are not asked again about that review), the reason you choose after “No”, if you choose one (one of four fixed choices: Not true, Unclear, Too general or Other — never your own words), the time, and which game the review is about, against that review and your account. Only we read it — as totals and a list of recent answers that names no account — to learn whether the reviews help; it is shown to nobody else. It is deleted with the review: when you delete that review, when the game is deleted 30 days after it ends, or when you delete your account. Answering is optional and changes nothing about your account or your reviews. While the question is switched off, it is not shown and nothing is stored.
• Which clubs you belong to, what role you hold in each, and since when — a person may now be in more than one. If you ask to join, the line you wrote is covered above; and if the organiser declines you, the reason they wrote is kept, so the answer is not only in a letter you may have deleted; if the organiser removes you, the reason they wrote goes only to the technical log, kept at most 30 days. If the organiser removes you, we also keep a mark that you were removed from that club, so that its code does not let you straight back in; the mark is cleared when the organiser accepts you again, and goes with your account. The club's own row carries its description, its language, whether a request must come with a message, who may see each table on its calendar, and the tables themselves — when they start, in which language, and whether they repeat weekly. Those are facts about a club rather than about you, and they go with the club. The same row notes when the club’s organiser last got the daily letter about join requests, up to which request it reached and whether the organiser stopped these letters; and, for a private room, when its host answered or skipped the one question about why they did not take the room — the time only, never the answer — so that it is asked once. If the club subscribes to its own private room, the same row also carries that subscription's billing status (trialing, active, past due or cancelled), an identifier from Stripe for the CLUB — never a player's own — and the date the room first went live. The same class of fact as a player's own subscription status above, billed to the club as a whole, never to any one person in it. For each club we also count, in each 30-day period, how many people its code gave the fourteen days to and how many it could not because the places were taken — numbers only. If you were one of those it could not, your account notes that club and period so you are counted once; the note goes with your account. Your account also notes which club's code your fourteen days come from and when they started, or which code they are waiting for; that note goes with your account too.
• Two counters that earn you free things. How far you are, in finished games, through the current run toward a free coach review, and how many of those free reviews you have earned and spent — plain numbers, rebuilt from your own finished games rather than trusted on their own. And if somebody introduced you: the free days credited to your side of that introduction, when they were granted, and whether they were taken back because the payment behind them was refunded. Both go when your account goes.
• A lower-cased copy of your nickname, for one purpose only: so that two players cannot take the same name. It is the word you chose yourself, kept a second time in one letter case, with Cyrillic letters that look like Latin ones written as Latin. Nothing else is derived from it and it is never shown to anyone.
• Club-room store purchase records. If you organise a club and its private room is paid through Apple or Google, we link the verified store purchase to your account and that club. We keep the store provider and environment, product, subscription status (trialing, active, past due, cancelled or suspended), transaction and original-transaction identifiers, purchase and period-start times (including a pending next period), expiry, access and grace dates, and sandbox, cancellation, suspension and refund state. We also keep the last processed store-event time. RevenueCat event identifiers, times, decisions and reasons, and links from a transfer event to each affected transaction, are kept so repeated or out-of-order notices can be handled safely. When a verified new store purchase resolves a transfer marker, we also keep when it was resolved and the identifier of the RevenueCat event that resolved it. These transfer-marker records are included in your data export and deleted with your account. For an organiser with more than one club, a server-created purchase intent identifies the selected club and store environment for no more than 15 minutes; it records its identifier, club, environment, creation/expiry times. It is deleted when consumed or expired and contains no store credential or payment method. Your data export includes your store binding, related event and transfer-link records, any live purchase intent, and your transaction identifiers. If you delete the organiser account, we close its club, clear its local store-owner/provider/period pointers, and delete its bindings, event links and intents. If another owner remains, that person’s club ownership and Stripe record remain. Account deletion does not cancel Apple or Google billing; cancel it with the store.

If you organise a club

We also keep a short public record about mafia clubs and their organisers — a name, an email or social-media handle, a city and which federation's rules a club plays by — gathered from the club's own public page, so we can write and offer the free practice tool and printed rules sheet. We never buy or scrape hidden lists. Clubs in Germany, Austria, Switzerland and Poland get no such letter: there we write only to an organiser who has asked us to. Say so once and we remove your entry and never write again — write to us, or use the "say stop" line in any letter you received from us.

What is not stored

Your password in readable form — see above; only a hash it cannot be recovered from. No card numbers. No location — the only place we ever read is the country your connection comes from, which Cloudflare passes to us with every request: to decide whether MafiaVoice is offered there at all; when you open the prices or start a payment, so that the right checkout opens for your country; and when you join a live table, to decide whether live tables are offered in your country. It is not stored with your account — we keep only a count of requests per country, without who sent them. No contact list. No advertising or analytics identifiers. We do not record your microphone audio. Where voice is on at a live table, the sound passes through our own relay to the other seats and is dropped — nothing is written to a disk, and the relay's own recording feature is switched off. Where your speech is recognised — by your browser during your own turn at a live table, or, in the app, by your phone — only the recognised text is sent here; the sound itself reaches us only through the relay above, and only while voice is on. What we cannot promise on your browser's behalf is where that recognition happens: some browsers, Chrome among them, do it on their vendor's servers rather than on your device. That is your browser's behaviour and not something this game controls or can see — if it matters to you, choose Not now when the game asks, and type instead of speaking. Character voices are synthesised, not permanently recorded. Each game language — English, Русский and Ukrainian — has one host voice and two bot voices, one female and one male; the “Better voices” option can add others on your device. Every voice is under a licence that allows commercial use, and the open-source licences page names each one, its licence and its authors. The bots’ voices are made on your device, on the website and in the phone app alike, from voice packs that your browser or the app downloads from our own server (about 37 MB per language; see “Bot voices made on your device”): nothing you say or type goes back, and our server makes and sends no bot audio. If the voices are not ready, or your device is too slow, the bot’s line is shown as text only — your device’s own voices are never used for a bot. The host speaks from recordings made in advance, which our server sends as audio files; a line the recordings cannot say is shown as text — never spoken by our server or by your device’s own voice. The phone’s own voices are never used for the bots or the host.

Helping train our bots with your speech — only if you switch it on

Off unless you switch it on, and never a condition of playing. The setting Help train the bots with my speech, in Settings → Sound and voice, is off for everyone until you switch it on yourself — there, or in a question asked once, after your third game at a live table. Only an account confirmed 18 or older can switch it on. Saying no, or not answering, changes nothing: every table, price and feature stays the same, and nothing is given for saying yes.

What is kept while it is on. The recognised text of your own turns at live tables, from the moment you switch it on — never the sound, which does not reach us for recognition; never another player’s turn; never a hand sign. Each line is kept with what the table understood from it, the game language, the phase of the game and the month. Before a line is kept it is checked: a line that may contain a name or a way to reach someone — a first name, an email address, a phone number, a web address, a username, or the name of a messaging service or social network — is not stored at all. In the lines that are stored, the nicknames our site gives players are replaced by a placeholder. The check cannot catch everything, so please do not say real names or contact details at the table. It is not kept with your account, your name, the table or your IP address: each line carries a code that our server makes from your account with a secret key, used for nothing except finding your lines when you download your data or switch the setting off. Each line also carries a random tag, made when you switch the setting on and not derived from your account; it lets us find and delete your lines when you switch the setting off, and it is erased from your account at that moment.

What it is used for, and who has it. Only to train our own models that understand what players say at a table, so that the bots understand you better — not moderation, not voices, not marketing, and no line is shown to another player. It stays on our own server in Germany and, encrypted, on the operator’s own computer in Canada, where the model is trained; no other company receives it — no AI company, and no rented computer.

How long, and how to stop. Each line is kept at most 12 months, in a separate store that is not part of our backup copies. Switch the setting off in the same place, at any time: saving stops, and every line saved so far is deleted from our server within a minute; deleting your account does the same. A copy already taken to the operator’s own computer for training is encrypted there, and your lines are deleted from it before the next training run, so no training run that starts after you switch off uses any of your lines. A model trained before that may keep running; every model trained afterwards leaves your lines out, and we stop using any model trained on them within 12 months. The record of your choice — on or off, when, from which screen and on which platform (website, iOS or Android), and which version of this text — is kept with your account, so that we can show what you agreed to, and is deleted with it. Download my data includes the setting, that record and your saved lines.

Cookies, and why there is no banner

Your browser does keep a few values in local storage on your own device:

• your account id;
• your display name, so you are not asked twice (your email address is not kept here: the server gives it back when needed);
• your answer to whether your browser’s speech recognition may be used;
• your chosen difficulty, face and voice settings;
• a club's code, if you arrived through its link — kept only after our server has confirmed that such a club exists; until then it stays in the page address;
• your interface language, your progress in the school, your club notes, your voice choices and whether you are seated at a table, so the game resumes where you left it; and, for one browser session, the pass back to your seat;
• whether you have already closed the onboarding tips and the current "what's new" notice, so neither reappears.

This list names the main items; the full list, with every name, follows below. Besides them, the pages keep other settings you chose yourself (for example the languages you would like to play in, hints, hidden votes and sound), marks that a notice or a hint was already shown, so that it is not shown twice, and a few technical values, such as the height of a page block, so that the page does not jump while it loads. The “Better voices” offer keeps only that you pressed “Not now” — how many times, and the date of the last press — so that it waits 14 days before asking again; it does not count the games you finish.

Existing interface keys named here explicitly. mafia.ops.lang keeps the owner-only operations screen’s language until browser storage is cleared. mafia.nameWords keeps the readable account nickname until sign-out or account-trace clearing. mafia.signsSeen remembers that you have played, to show the experienced-player sign panel. mafia.relink.* is one module-load retry mark per address, for this tab only. mafia.signedout is removed after showing the signed-out notice once, or when the tab closes. mafia.roomOfferAt prevents showing the optional room suggestion — offered to any player after a finished game — again within seven days; it is not a seven-day deletion timer. The web played-game flag and suggestion timestamp remain until browser storage is cleared; the phone copies are removed by its account/device wipe.

HOST for a physical game. This free helper is available with or without an account. A trusted human host enters the physical cards and actions; HOST supplies timers and plays static host clips on the device. It does not record microphones, send the game to cloud Coach or add it to online ratings. Optional chair labels (use nicknames), roles, votes, night actions, checks, fouls, timers and the correction journal are saved locally to resume and recover your game. Keep the private host screen away from players; local storage is not an encrypted vault.

Local storage and deletion. On the website, IndexedDB mafiavoice-physical-host-v1 contains games, clips and audioPacks. In the phone app, mafia.host.v1.head, mafia.host.v1.slot.a and mafia.host.v1.slot.b keep the game and its recovery copy. This storage is needed only for the save/resume and offline audio you request. There is no automatic expiry: use HOST’s Delete game to remove the local game and journal; on the website, Remove downloaded voice removes that language’s local clips. The app’s static clips are bundled with the app, rather than a separately removable download. Clearing this site’s data or this app’s data removes its local records; the browser or system may also evict them. Signing out or deleting your online account does not delete these independent local HOST records. An exported public record contains caller-entered facts, not a verified server result; exporting saves a separate file which you must delete yourself. It does not submit the game for ratings or AI analysis.

Every name your browser or the app keeps, by purpose. In a browser these are in local storage, or in session storage where it says “this tab” — that goes when the tab closes. In the phone app they are in the app’s own storage; the account id and the session are in the phone’s protected storage (Keychain or Keystore). A name ending in * is one entry per table, club or language.

• Signing in and your account: your account id, that a session is open (in the app, the session itself), a session number, so that a session ended from elsewhere stops working here, that a registered account is on this device, that this app install has run before (so a reinstall does not reuse an old sign-in), and your display name: mafia.pid, mafia.sess, mafia.epoch, mafia.reg, mafia.installed, mafia.name.
• Age and your answers: in the app, your 18+ confirmation, your store’s age answer and that it was sent to us; your answer about speech recognition; for this tab, that the microphone check before a live table passed; and that the voice notice was shown: mafia.age18, mafia.ageBracket, mafia.ageSignal, mafia.ageSignalSent, mafia.sttConsent, mafia.sttMicReady, mafia.voiceIntro.
• Your seat and the table: which table you sit at; for this tab, the pass back to your seat, the last view of a table (seats, the players’ names, the state) so it paints at once — deleted when you leave the table —, that your role card and a table notice were shown, and one message a page leaves for the front page, deleted once shown: mafia.atTable, mafia.v1.resume, mafia.tbl.view.*, mafia.tbl.dealt.*, mafia.svc.*.*, mafia.doorNote.
• Settings you chose: interface language, the languages you would play in, country, difficulty, face, hints, hidden votes, sound, voices, microphone, vibration, device voices, “Better voices” and the on-device language model, a voice download you accepted in this tab, a copy of your reminder choice and, in the app, of your news choice (your account holds the real ones) and, if you turned notifications on, that they are on and the device address Apple or Google issued, an organiser’s own line on a club card, the date you closed the invitation line on the front page, a mark that your latest sound choice or settings change has not reached our server yet (only when you are signed in), so that it is sent again — removed once it arrives, and your “Not now” on the “Better voices” offer: mafia.language, mafia.lang, mafia.country, mafia.diff, mafia.face, mafia.hints, mafia.hideVotes, mafia.sound, mafia.sound.push, mafia.voice, mafia.mic, mafia.haptics, mafia.systemVoiceOk, mafia.voices.better, mafia.llm.chosen, mafia.tts.ok.*, mafia.revisionPush, mafia.remindOptIn, mafia.news, mafia.pushOn, mafia.pushToken, mafia.cardline.*, mafia.promoClosed, mafia.voiceoffer.dismiss.
• Progress: lessons a guest finished, how many lessons were done today, that the course was started, that a game was played, and the step of the first-run card: mafia.course1.done, mafia.lessons.todayDone, mafia.started, mafia.played, mafia.firstrun.
• Clubs: a club’s code from its link and when it was kept (at most 30 days), the name of a club you joined and a club-trial or club-gift notice to show once, that a club gift is waiting, and, for this tab, a club application across the sign-in page: mafia.clubcode, mafia.clubcode.at, mafia.clubWelcome, mafia.clubTrialNote, mafia.clubGiftNote, mafia.giftWait, mafia.pendingClub.
• Notices already shown: “what’s new”, the onboarding tips and the steps you tried, the first hand-sign hint, and, for this tab, the new-version notice: mafia.whatsnew, mafia.onbHidden, mafia.onbDrill, mafia.onbReport, mafia.onbVoiceLang, mafia.signhint, mafia.v1BuildAck.
• Technical values: how fast this device ran a voice or language model, the height of two page blocks so the page does not jump, for this tab that the page is shown inside our app and which new version it already reloaded for, in the app when the last reminder went (the once-a-week limit), and a test entry written and removed at once to check that storage works: mafia.voices.verdict, mafia.llm.verdict, mafia.clubs.rows, mafia.school.nextH, mafia.appview, mafia.reloadedFor, mafia.lastRevisionPush, __mafia_probe__.
• Only deleted: names an older version wrote; nothing writes them now, and the page or the app removes an old copy: mafia.email, mafia.playerId, mafia.nudge, mafia.engine, mafia.voiceoffer.games, mafia.voiceoffer.lastgame, mafia.promoSlot, mafia.memory.beacon, mafia.memory.days, mafia.memory.levels, mafia.crashq, mafia.reviewGames, mafia.reviewLastAskAt, mafia.reviewLastAskVersion, mafia.refcodes, mafia.refcodes.sent, mafia.by, mafia.by.at, mafia.partner, mafia.partner.at, mafia.srcTouch.
• Operator only: the admin and operations keys, used only in the operator’s own browser, and one test setting that ordinary use never writes: mafia.admin, mafia.ops.token, mafia.pace.

Under the EU ePrivacy rules local storage is treated the same way as a cookie — and storage that is strictly necessary for a service you asked for does not require consent. That is how we see the account id, your seat at a table and your progress: without the account id there is no game to return to. Settings are kept because you chose them.

None of it is used for advertising or to follow you across sites. There is no banner; it is disclosed here instead. The lines tied to your account are deleted when you delete it; the onboarding and "what's new" flags belong to your browser alone and were never tied to an account to begin with. Clearing your browser's site data removes every line here at once, either way.

A friend's invite code and a partner's code are not stored on your device. A partner's code gives you nothing: it tells us which partner sent you, so that the partner can be paid a commission.

What stays in the page address. While you move around the site after opening such a link, the code stays in the page address, on every page. If you are already signed in, the code is taken out of the address at once: a link does not count for an account that exists. At sign-up a partner's code is shown in the form, where you can change or remove it; a friend's code is sent from the address. A code you type yourself comes first: if you type another code, only the code you typed is sent, and if you clear the box, the partner's code from the link is not sent. When our site redirects you to another of its own pages, the code goes along. Once you have registered, the code is taken out of the address. While there is no guest record, the website knows only the code in the page address: of two partners' links, the one you opened last is the one it has.

What we note on our server, and for how long. When a guest record is made for you after you opened a partner's link — for example when you start a guest game — we note the code on that record on our server. The note lives for 12 hours from the moment it is written. If you sign up within those 12 hours, the note counts when a partner's code comes with the sign-up. If it is the same partner's code, that partner counts. If it is another partner's link, the first partner — the one on the note — counts. If the first partner's code is closed or paused, the link you sign up from counts instead. A partner's code you type yourself counts instead of the note and of any link. If the sign-up brings no partner's code — for example, you cleared the box — the note does not count and is deleted. After 12 hours the note is ignored and deleted. When there is no note, a partner's code that comes with the sign-up — in the link you sign up from, or typed by you — counts only for a new customer. A new customer is someone who has no account and did not play as a guest before a partner's code reached them. A partner's own account is never counted for that partner's code.

What is not kept. Your device does not remember the code between visits: on a later visit you can type it in the sign-up form. The phone app writes nothing about a link's code to the phone: the code of a link you tapped is held in memory until you close the app, and of two partners' links the first one you tapped is the one held. Our server tells your browser not to keep a page opened with such a code in its cache. Such a page is not kept in the site's offline cache either. The code is never put inside the return address of the sign-in page. The code is removed from our access log — from the page address and from a redirect's address. It is also removed from any link you share from the site. Which kind of link brought you here (a club, an invitation, a letter, a video or other — one word, never an address) is not stored on your device either: it travels in the page address and is sent to us once when you register.

One anonymous count a day

We also keep one more number per day, for 39 fixed steps: how many times the site's front page loaded (a count of visits, not of people — nothing here tells two visits from the same person apart), how many new accounts were created, how many players finished a first game, how many opened a first review, how many were shown the subscription offer, how many payments went through, and how many were refunded; how many accounts came back the day after their first activity, within a week of it, or within a month; how many turned a table reminder on, how many of those reminders were actually sent, and how many of those seated somebody at a table; how many times each of the buttons on "your next step" card was pressed — resume a table, your own table, a revision round or a lesson; how many verification emails were sent and how many addresses were confirmed; how many played a first live table or opened a first lesson; and, for a new account, which one of five places it came from — a club code, a referral link, a table-reminder letter, YouTube, or anywhere else. For private rooms: how many players were shown the suggestion to start a room after a finished game (each counted at most once a day), how many rooms were made, how many first, second and third free evenings were used, how many rooms began their first paid period, and how many new hosts had earlier joined somebody else’s room as a guest; and, when a host who used the three free evenings without taking the room is asked once why, how many chose each of the five answers — too expensive, we play rarely, inconvenient, the group did not get together, something else — and how many skipped the question. Each is a single total for the day — never an account id, never an IP address, and never a cookie behind any of them. To count a return only once, the server writes a short-lived marker with your account id next to each of the three windows; it is deleted at most 40 days after it is written. Kept on a rolling two-year window, then overwritten. Once a week the operator receives these totals by email, through Resend — numbers only, never a name, an address or an account id.

Who else sees it

• Hetzner rents us the machine in Germany (Falkenstein) that the database file sits on, and a separate storage box in Finland (Helsinki) for the encrypted hourly copies, which it cannot read. It is our hosting provider and our processor under Hetzner’s own data-processing agreement; it does not read the database and receives nothing about you of its own. Its privacy policy: hetzner.com/legal/privacy-policy.
• Cloudflare stands in front of the site as a shield and a cache, so that a flood of traffic cannot take the game down for everybody. Every request passes through it, which means it briefly sees your IP address, which page you asked for and what your browser says about itself — the technical details any network carries. For all of this it is bound as a processor and may not use any of it for its own purposes. One exception: on the pages where you sign up, sign in, reset a password, ask to delete by email, join a table, apply as a partner or write to us without an account — Cloudflare's Turnstile check also reads your IP address, your browser's connection details and what it says about itself, to tell a person from a bot. For that check Cloudflare may also use these signals, as its own controller, to improve its bot detection, and never to identify, profile or target you (its Turnstile privacy addendum: cloudflare.com/turnstile-privacy-policy). It is not used for advertising. Its privacy policy: cloudflare.com/privacypolicy.
• Stripe handles payment and holds your card details. We never see them. Stripe's own privacy policy applies to that part: stripe.com/privacy. If you have paid through Stripe and change your email address, we pass the new one to Stripe, so your receipts follow it.
• Apple handles payment if you subscribe through the App Store, and holds your card details — we never see them. Its own privacy policy: apple.com/legal/privacy.
• Google handles payment if you subscribe through Google Play, and holds your card details — we never see them. Its own privacy policy: policies.google.com/privacy.
• RevenueCat validates a store purchase and tells us which tier it bought. It receives your account id (the same one you already have here — no new identifier is created), which store you bought through, the purchase/renewal dates, and basic device/OS type. It never sees your card — the App Store and Google Play do not share that with RevenueCat — and it does not receive your games or your email unless you already gave RevenueCat's own store (Apple or Google) that address. It also shows us totals of store purchases — how many subscriptions started, renewed and ended; none of it is used for advertising or to follow you across other apps or sites. Its own privacy policy: revenuecat.com/privacy.
• Expo (650 Industries, United States) does two things for the phone app. If you turned notifications on, it relays each notification to Apple or Google and receives the device token itself. And it delivers updates to the app: when the app checks for one, Expo receives a random identifier for this installation (made on the phone, not derived from you or your account), the app’s version and whether it is an iPhone or Android. Neither ever carries your email or your name, and nothing about your games beyond what a notification itself says — for the weekly note, the week’s game and win counts, your best read and the next lesson. The app asks Expo for updates only after our server says updates are open. To count the accounts whose app may ask, our server keeps a keyed one-way hash of your account id and the month, never older than the current month; once it has counted 950 in one month, updates stop until the next month and the app keeps working on the version you have. Its own privacy policy: expo.dev/privacy.
• Resend delivers the letters we send. It receives the address a letter goes to and the letter itself — nothing about your games beyond what that letter says. It is bound as a processor. Its own privacy policy: resend.com/legal/privacy-policy.
• The support mailbox. A copy of what you write to us — your message and the address to answer; for a refund request also its reason, the amount and the payment-customer number; for a club application the organiser’s name, address and note — the one email about a threat pause or a threat sent to a moderator, described above, naming the account, its display name and the kind of threat, and a note naming the account when a Quebec yearly plan’s expiry notice went out late, and the full copy of a money alert with its numbers (described below) are also delivered to the support mailbox, so that the one person who answers sees them; letters sent to our support address are forwarded there by Cloudflare. That mailbox is held for us by Migadu, an email provider in Switzerland, as our processor; the mail is stored in the European Union, and its data processing agreement is part of Migadu’s own privacy policy. Alerts about the service itself — a failed backup, a restart — go to the operator by email and as a push notification through ntfy.sh; they carry technical status only, which service and what failed, never a player’s name, address, account or anything anybody wrote. Money alerts say more, but not much: a bank’s dispute, inquiry or fraud warning, a refund that did not go through, a payment that is not one of our plans. They reach the operator’s phone and personal mailbox with only what happened, the amount and the reason — the bank’s reason, Stripe’s error text with any number or address removed, or the code of the country that stopped a sale. The numbers of the payment, the payment customer, the dispute or warning, the refund and Stripe’s event go only to our support mailbox at Migadu, described above. None of them carries a name, an address, an account or a card. When a threat said by voice waits for a moderator, the push alert carries only the case number; the email about it goes to our support mailbox at Migadu, described above. The operator’s personal mailbox receives only the alerts about the service itself and the short money alerts. ntfy.sh is a free service run from a server in the United States; it receives nothing about you — no payment or customer number, no name, no address — only the alert text (for a money alert, only the amount and the reason) and our server’s address, and deletes messages after 12 hours. A backup job also tells healthchecks.io, a service from Latvia hosted in Germany, only that it ran or failed, nothing else.
• Your browser’s or phone’s speech recognition, if you allow it: on the website only during your own turn at a live table, in the app as described above. We do not choose or pay this service and it is not our processor: Chrome sends the sound of your turn to Google, Safari to Apple unless it can recognise it on your device; in the phone app an iPhone uses Apple’s recognition and an Android phone its default service, usually Google’s, each on the device where it can. From the recognition we receive only the text, or at a practice table in the app only the seat you named. Their privacy policies: policies.google.com/privacy · apple.com/legal/privacy. You can always play without it — by typing on the website, with buttons and hand signs in the app.
• The police or a court, only when the law makes us. We hand over personal information to a Canadian authority only on a production order, a warrant or another court order — never on a request alone — and for a request from outside Canada only once it comes through a Canadian court. A demand or an order to preserve data makes us keep what we already hold, for as long as it says; we have no recordings of voice to keep. We tell you before we disclose anything, unless the law or the order forbids it. Two exceptions, both our own decision: where somebody’s life or safety is in immediate danger, we give the police the least that helps and tell you afterwards; and child sexual abuse material is reported to the Canadian Centre for Child Protection (Cybertip.ca) and to the police, as Canadian law requires. Authorities write to us through the same contact form as everyone else.
• No advertisers, no data brokers, and no company that analyses what you do in the game.

Where it lives, and for how long

In a single database file on a rented server in Germany, in Hetzner’s data centre in Falkenstein. A copy of that file is made every night and kept on the operator’s own computer in Canada (Alberta), only so that the service can be restored if the server is lost: outside any cloud folder, readable by the operator alone; each copy is encrypted with a key the server does not hold, on a disk protected by the computer’s full-disk encryption. The last 14 nightly copies and 8 more taken on Sundays are kept; older ones are deleted automatically. The server itself also keeps its last 7 nightly copies, in Germany, for the same reason and no other, and before each update of the service one more copy is made there; the ten newest such copies are kept, and none older than 60 days. Once an hour one more copy is encrypted on the server with a key the server itself does not hold and sent to a separate storage box at Hetzner in Finland, in its data centre in Helsinki; the last 48 hourly and 30 daily copies are kept there, older ones are deleted automatically, and only the operator can open them, on his own computer in Canada. A daily file of fingerprints of the security log — row numbers and hashes, no names or addresses — is also sent to that storage box and kept there 400 days, so that nobody can rewrite the log unnoticed; older ones are deleted automatically. Once a day the same computer in Canada also fetches the server’s own nightly copies and the copies made before each update, and keeps them only in encrypted form, with a key kept apart from the server; anything older than 30 days is deleted automatically. It fetches the security-log fingerprints as well and keeps those as they are — not encrypted, and with no time limit — because they hold only row numbers and hashes, and an old fingerprint is what shows that a log was rewritten. Deleting your account removes you from the live database the same day, but not from copies already made — they age out: while the copy runs every night, the oldest is about ten weeks old, so your data leaves the last copy within about 70 days. The copies are used for nothing but restoring the service. Game results are kept while your account exists, so your statistics keep working; the record of each finished table they are opened from is kept 30 days after the game ends; a game played without an account is deleted, results and all, 30 days after it ends. An anonymous id that has gathered nothing — no email address, no game, no purchase, no complaint, no problem report — is deleted after 30 days in which it is not used. An anonymous id with something on it but no email address — lessons of the first course, a problem report, a game record — is deleted with everything on it after 24 months in which it is not used, unless a purchase, a running trial or a suspension is attached to it; there is no address to warn, so no letter comes first. A finished game is kept for 30 days after it ends, then deleted by the daily clean-up, together with its review. The numbers in your statistics — which role, whether you won, how many days, your accuracy and the reads you made or missed in that game — are kept for as long as your account exists, so games played and wins never go down. Your account, games, results and statistics go when you delete your account, subject to the payment, abuse-prevention and backup exceptions stated below. Your display name and face also leave the stored results and reviews of the people you played with — at a table you played to its end and at one you left early alike, and from a review they had already opened; their record keeps only your seat number, and a paragraph the AI wrote that named you gives way to the lesson it points to. A round-by-round review can also be deleted on its own, one game at a time, with a button on the review screen itself — this removes that review's stored text (and the AI's own paragraph about that game, if one was written) without touching your account, your other reviews or your statistics.

We are based in Canada and the server is in Germany, so the database that holds your games is stored in the European Union. We do not offer the game in the EU, the EEA or the UK (see where MafiaVoice is not offered); where the GDPR or the UK GDPR still applies to what we hold about you — for example from before this version — it applies in full. Every player gets the same GDPR protections from us: the stricter of the regimes we are subject to.

Running the service from Canada is also a transfer. Operating this service means staff in Canada access the account and game data held on that German server, which is itself a transfer of personal data out of the EU. The European Commission has ruled Canada's private-sector privacy law adequate for this purpose (Decision 2002/2/EC), and confirmed that finding still stands in its 15 January 2024 review of every adequacy decision — so this access needs no further safeguard on top of it. The same decision covers the nightly copy kept in Canada; we checked on 28 September 2026 that Canada (commercial organisations) is still on the European Commission’s list of adequacy decisions.

What does leave the EU, and why. Some of the companies named under “Who else sees it” are based in the United States or run networks worldwide: Stripe (your payment details and the email attached to them), Cloudflare (the technical details of each request), Resend (the address a letter goes to, and the letter), and — only if you use the phone app — Apple, Google, RevenueCat and Expo. Each receives only what is named for it above, under its own data-processing terms, which rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. One more goes to the United States under the company’s own terms rather than a data-processing agreement with us: if you allow speech recognition, the sound of your own turn at a live table, sent by your browser to its own vendor (Google for Chrome, Apple for Safari). In the phone app your phone’s speech service may send the sound of your turn to Apple or, on Android, to its own vendor, usually Google. Each company is used only for what its line under “Who else sees it” names: payment (Stripe, Apple, Google), protecting the site (Cloudflare), delivering letters (Resend), store purchases (RevenueCat), notifications and updates to the phone app (Expo), the support mailbox (Migadu), alerts to the operator (ntfy.sh, healthchecks.io) and speech recognition (your browser’s or phone’s vendor). We never see or store your card. Your games, your record and your coach reviews stay on the German server, apart from the nightly copy in Canada described above. While your information is in another country, the courts, police and national-security authorities of that country may be able to obtain it under that country’s law. You can ask us, through the contact form, for a copy of the safeguards named here (the Standard Contractual Clauses or the provider’s Data Privacy Framework certification).

Before any personal information leaves Quebec, we assess in writing whether it will be adequately protected where it goes, and it goes only to a recipient bound by a written agreement with us — its data-processing terms. Germany, Finland and the rest of the EU protect it under the GDPR, which is stricter than Quebec's own law, and the European Commission recognises Switzerland, where Migadu is based, as protecting it adequately; for the providers in the United States named above that receive personal information, the protection is their data-processing agreement with us. ntfy.sh, healthchecks.io and the operator’s personal mailbox for these alerts receive no personal information about you, other than the numbers in the alerts described above. The nightly copy is kept in Alberta, where the federal PIPEDA and Alberta's own Personal Information Protection Act apply.

Your rights

Depending on the law that applies to you, you can ask to access or correct personal information we hold. You can also request deletion of your account. Other rights, including erasure, portability, restriction, objection and withdrawal of consent, apply where the law provides them and subject to its conditions. The retention exceptions described below still apply.

How we look after your information

We follow a written policy for personal information (Quebec’s Act respecting the protection of personal information in the private sector, s.3.2). In short:

• One person is in charge of protecting personal information: Oleksandr Martiuk, the Privacy Officer named under Contact. He decides who may see it; today nobody else can.
• We collect only what a named purpose needs and say why before we collect it; every optional use is its own tick, off by default.
• Each kind of information has its own period (see “How long it is kept”) and is deleted when it ends; a decision about you — a complaint, a pause, a players’ court case — is kept 12 months.
• Before a new feature or a new provider handles your information we assess its privacy impact, and before information leaves Quebec we check it stays as well protected.
• Every privacy incident goes into a register the same day, even when nobody is at risk, and the register is kept 5 years.
• A request or a complaint about your information gets a written answer within 30 days; if you are not satisfied, you can turn to a regulator (see “If we get it wrong” below).

If something goes wrong

If a data breach happens, we tell every regulator the law requires us to tell, without undue delay — within 72 hours under EU or UK law, and as soon as feasible under Canadian law, Quebec’s Commission d’accès à l’information included — and if it puts you at real risk, we will email you directly.

Why we are allowed to hold it at all

Four legal bases, each named for what it covers. The contract: your account, your games, your progress and reviews, the letters that keep the account working, a live table while it runs, and the players you block. A legal obligation: payment and tax records, and what a court order, a preservation demand or Canada’s law on reporting child sexual abuse material makes us keep or hand over. Your consent, which you can withdraw at any time: news about the game and its welcome letters, revision reminders and the weekly note, push notifications, sharing your progress with a club, and sending the sound of your turn to your browser’s or phone’s speech-recognition service when you choose Allow, and keeping a de-identified copy of your own turns to train our own bots, when you switch on Help train the bots with my speech. Legitimate interests, which you can object to: keeping the service safe and fair — a keyed one-way hash of your IP address or its network range, kept at most 30 days (one year if it tried an administrator-only page), and a shortened IP address in the web server’s log, kept 14 days — only to stop abuse; the 12-month email hash and the refund record that stop the same trial or refund being claimed twice; complaints, the table’s automatic check, the hidden finish-rate number and the newcomer shield; your answer to “Did the review help?”, so that we can make the reviews better; the messages and problem reports you send us, so we can answer them and fix what they report; the security log; the backup copies, kept only to restore the service; and the short public record about club organisers. Beyond that, we do nothing with your data that you did not come here for.

Everything you can ask for

Wherever you live, you can ask us to: show you what we hold · correct it · delete it · send it to you or to somebody else in a machine-readable file · restrict or object to what we do with it · and withdraw consent at any time. Write to the contact form and we answer, free of charge, within the time the law that applies to you sets: one month under the GDPR and the UK GDPR, 30 days under Canada’s PIPEDA and under Quebec’s private-sector privacy act, 45 days under Alberta’s PIPA. Where that law allows more time, we tell you why, and the new date, before the first one passes. We will never make the service worse for you because you asked. You can correct your email address yourself, on the Account page.

A copy of your data, by yourself. On the Account page, Download my data gives you, at once, everything we store about your account in one machine-readable file (JSON). It works once in 24 hours, for an account with an email address, and only right after you confirm it is you: a sign-in in the last 15 minutes, or your password typed again. The file leaves out other players’ identifiers and the secrets that protect your account — the password hash and the codes of your sessions and links. Ask through the contact form instead and we send you the same file.

An access request covers everything named on this page — including the hidden finish-rate number that no screen shows, and the record of which reads you made.

If we get it wrong you can complain to a regulator, not only to us. In Canada, the Office of the Privacy Commissioner (priv.gc.ca) or Alberta's own Information and Privacy Commissioner. In Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca). In the EU, your national supervisory authority. In the UK, the ICO. In Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Email — what we send, and what we never send

Everything we can send you, in full. The first ten are part of the service rather than marketing: each goes out because you asked for it, or because your account, your subscription or the law needs it, and no newsletter box turns them off. The eleventh goes only for a table you asked to be reminded about; the four after it go only to people who ticked a box for them:

• A sign-in link, when you ask for one. It works once and expires in ten minutes. Any registered address can ask — it is how you get back to your own record from a new browser or a second device, and it does not depend on paying us. If you said you forgot your password, the same link comes worded as a password reset and opens the password field. If you ask to delete your account by email, the link that confirms it comes the same way: it works once and expires in ten minutes.
• A note when your password changes, every time it is set or changed after you sign up — so a change you did not make does not go unnoticed. It says what happened and how to set a new one; it carries no link that signs you in.
• Letters when you change your address: a link to the new address that works once and expires in ten minutes; at once, a note to your current address with one link that stops the change — if your account has no password, that same letter is where the current address approves the change first; and a note to the old address when the change is done, whose link gives the account back for 30 days.
• A verification link, once, right after you register with a password. It works once and expires in twenty-four hours, and it proves the address is yours. Opened within ten minutes of being sent, it also signs you in; opened later, it confirms the address and signs you in only in a browser that is already signed in to the account. The first confirmation signs out every other device, and if it is opened in a browser that is not signed in to your account, it also removes the password set before it (so a password somebody else set on your address does not outlast your confirmation), and you choose your own password next — the game already works before you click it, and it is only needed to join a live table or a club room. The one-time token itself is a random string, kept hashed on our server the same way a sign-in link's is, along with the email address it was sent to, when it was sent and when (or whether) it was used. The record of such a link — this one, a sign-in link, a link that confirms deleting your account, or a one-time link in a letter about a club — is deleted within two days after the link was used or expired; a link that has expired cannot be used.
• A note before a club trial ends, so nothing surprises you. Nothing renews on its own and no card is held.
• Letters about a club room you organise — when its free evenings start and when the last one is used, when it starts, 3 days before a first charge that follows a free month, after each charge, if a charge fails, when the room has used most of the reviews it pays for in a period, when it is cancelled and when it closes.
• Letters about a verified club you organise — 30 days before its yearly check, and when it needs to be checked again (a year has passed, or 60 days without an evening).
• Letters about a club you applied to register — sent to the address on the application: the link that confirms the application before anybody reads it; the decision, approval or refusal with its reason, only after a person has read it; a note if that club is already registered, or cannot apply again yet; the letter that hands a club to a new organiser; and, if the club subscribes to its own room, a notice before the room's trial turns into a charge. A player who asked to join a club gets one letter with the organiser’s answer, and a member of a club gets one more: a note if the club they belong to is closed. The organiser of a club gets at most one letter a day, and only when somebody new asked to join it: the display names of up to 10 of them, how many are waiting and a link to the club page; its own link stops these letters for that club, with no sign-in. If you ask us to verify a club: a note that the request arrived, and the decision — verified, or declined with its reason.
• An acknowledgement that your message was received, if you wrote to us without an account — sent the same day, at most once a day even if you write again, and it never carries a reply of its own; the reply itself follows separately, from a person.
• Letters about your subscription: a copy of what you agreed to, right after you pay — it names you by the billing name and address you gave at checkout, which Stripe passes to us for that letter and which we do not keep on our server; a notice before a free trial turns into a paid period; the one-time reminder before the first full-price renewal after an introductory price; the yearly-renewal notices described under What you are agreeing to pay; a note when a renewal charge did not go through, saying where to update your card; a confirmation that your EU withdrawal arrived; a note when a payment was cancelled and refunded automatically — or, if that refund has not gone through yet, a note that says so — or your plan moved to the ordinary price, under the two purchase checks in Terms; a confirmation when a refund is sent, or, if a refund does not go through, a note that says so and another when it does; and, if a dispute you opened with your bank is closed in our favour, a note that the period that payment bought is yours again.
• Letters about your account itself: a warning, a suspension or a closure under the rules in Terms, each naming the rule and what we saw; a pause from live tables for a real threat, naming the kind of threat and how to appeal, and a note if a person lifts it; if the App Store or Google Play tells the app that you are under 16, a notice that the account is closed, with the date it will be deleted; and the two notices before an account nobody has signed in to for 24 months is deleted.
• A table reminder, only for a table you pressed “Remind me” on, or your club's standing reminder if you switched it on — at most one letter per table, and its own link turns table reminders off, with no sign-in.
• News about the game — and this one is different: it goes only to people who ticked its own box when they registered. It was never bundled into the terms, and it is never sent to anyone who did not ask. The same box also sends a short welcome series — three letters in your first days — and the stop link in any of them ends all of it.
• A revision reminder, if you turned it on in Settings in the app or on your account page on the website — at most once a week, naming how many sessions are due.
• A note after you cancel, once, a few days after your subscription ends — asking, in one line, what did not work. The same box as the revision reminder above.
• A Monday progress letter, if you turned it on — at most once a week, naming your games and rating for the week.

Your receipt comes from Stripe for a payment on the site, or from Apple or Google for a purchase in the app — not from us — it is sent every time you are charged, from the same place that holds the card. We do not send a second copy of it.

Stopping the news takes one click — the link is at the bottom of every one, and unticking the box in your profile does the same thing immediately. The service letters keep working, because they are how you get into your own account.

Every optional email carries its own one-click way out. A revision reminder, the news about the game, or any digest we add later — each one links to /unsubscribe and carries a List-Unsubscribe header, the same signal your own mail app already reads. Either stops that kind of email at once, with no sign-in needed. It never touches the mail that keeps your account working — a sign-in link, a receipt, a security notice — a subscription cannot turn those off.

We do not sell, rent or share your address, and we run no advertising. One company sees it: Resend, which delivers the letter and is bound by its own processor terms. Delete your account and the address goes with it, the same day.

How long it is kept

Your account and your games: while your account exists, because that is what makes the statistics work. A finished game itself — every seat’s name and face, the moves, its review — is kept 30 days after it ends, then deleted. Delete the account and they go from the service the same day; the nightly copies in Canada age out within about 70 days. Payment records, with the record of each purchase notice you accepted: six years after the end of the tax year, kept by Stripe and by us, because tax law says so and consent cannot override it. Error logs: at most 50,000 lines, then the oldest are discarded — days, not years. The security log and the web server’s log: as listed under What is actually stored.

A few smaller records, each with its own limit. The ids payment providers send with each event — an invoice, charge or webhook number, and for an EU withdrawal your account id with the date the subscription started; never a name — are kept 400 days and survive deleting your account: they stop the same payment, refund or withdrawal being acted on twice, which is how a replayed or forged event could otherwise move money (fraud prevention, a legitimate interest). The date you last downloaded your data: 30 days. Which letter went to your account and when: 7 days. The Stripe customer number, and the keyed codes of your last card and of the card that had the introductory price with the date it did: on your account, deleted with it. For each finished game, how many of your own moves it counted and how long it ran: with your account. The stop list for addresses that bounced is not linked to your account and keeps its 24 months after you delete it. For a partner code: how many clicks and sign-ups came through it each day, 24 months; and, if it was ever paused automatically, why and when — kept while the pause is in force, deleted with the code, and 24 months after the pause once the code is closed.

A live table is kept for as long as it is being played, and not one minute longer. The seats, the clocks and any text your browser recognised from your speech are held in the running server's memory only; they go when the table ends — the text of the turns 10 minutes later, so that a turn can still be reported from the results screen — and they go again at every restart. An ordinary game leaves no transcript, anywhere, at any age — the one exception is the single turn a complaint names, or that the moderation model marks as harassment or luring, held for up to 14 days and then deleted the same way. A turn the threat check paused someone for or sent to a moderator, or that our anti-toxic model sent to a moderator, stays in the server’s memory only, at most 72 hours. Voice audio is relayed and never written down at all, and a hand sign itself is never written down either — only the move the table reads from it. What outlives a table is the game record named under “Game results” (every seat’s display name and face, the roles, the moves and who voted for whom — never the words), the coach review, a short record of which table and seat it came from, and a complaint — or a mark from the table's own automatic check or from the moderation model — if one was made.

The words a complaint names, or a harassment or luring mark from the moderation model, are kept for up to 14 days, then deleted — long enough to answer an appeal, never longer. The words of a turn the threat check paused someone for or sent to a moderator are never written down, and neither are those of a turn our anti-toxic model sent to a moderator: they stay in the server’s memory until a person decides, at most 72 hours. The decision itself — a complaint, a threat pause, a mark from the table's own automatic check or from the moderation model, and any appeal against one — outlives the words and is kept for 12 months, because that is what makes a ladder of fouls mean anything once the turn itself is gone. Delete your account before those 12 months pass and your name is erased from both sides at once; the rows themselves stay for the rest of that window, with nobody's name in them, because the other person in that complaint has the same right to their own record. The hidden finish-rate number is deleted outright, as are your reviews, your club memberships and the two free-credit counters — the same day, with everything else. The one thing that can hold any of these longer is the law: if a court order or a preservation demand covers something we still hold, or we have reported child sexual abuse material, we keep that item for as long as the law requires — and only that item.

Two things we only ever draw from what is said at a table, and what we never do with it. The two uses of a recognised turn are named above: the engine, so a move is understood, and moderation, so a complaint or a flag can be checked. Beyond those, the only count we ever build from speech content is one daily total of turns the checks flagged, with no account, table or quote, kept 30 days, plus the numbers-only lines per checked turn named above — never used for marketing. A third use exists only if you switch it on yourself: helping train our own bots with a de-identified copy of your own turns — off by default, kept at most 12 months, deleted the moment you switch it off; see Helping train our bots with your speech.

The country and province of each payment — never a street address or postal code — are kept for six years, the length the Canada Revenue Agency requires for a GST/HST return, alongside the amount, the currency and the date already covered above, and which plan the payment was for (Coach monthly or yearly, or a club room), so that Billing can list it.

Alongside the payment records above, one more thing survives deleting your account: a one-way hash of your email address, kept for 12 months and tagged only with why it was kept — a refund, a free trial, an invited friend’s days, a club room’s free month or free evenings, or the introductory price — never your address, and never anything that can be turned back into it. Its only job is to stop the same address getting a second free trial, or free access again, right after a refund or right after deleting an account and signing up again with the same address. This is a legitimate interest in preventing abuse, not a way to identify you, and the hash is deleted automatically after 12 months. (If you were ever refunded, or had free access revoked, that record survives too, for the same reason — the refund and revoked-access entries earlier on this page, under Privacy.)

More codes of the same kind, each a keyed one-way hash — never the raw address, card or network. A keyed hash is a code made with a secret key that only our server holds; nothing in it can be turned back into the value it came from. They exist only to stop abuse — a legitimate interest, which you can object to. (1) Free evenings: that your email address was counted at a club room’s free evenings, so a new room cannot start the same free evenings again with the same people. (2) The intro-price mailbox: that your email address already had the introductory price. (3) The intro-price card: that your card already had it — made from Stripe’s card identifier, never the card number. Like the code above, these three survive deleting your account, are not linked to it, and are deleted automatically after 12 months. (4) A paused account’s network: when an account is paused from live tables, we keep a keyed hash of the network range it connected from (for IPv6, its /64 range; never an IPv4 address) together with the id of the browser it played from (one keyed hash of the two), and the reason for the pause, so that an account younger than 7 days that joins live tables from the same network AND the same browser waits for the same pause; another device on the same network (a café, a dormitory, a phone carrier) is never asked to wait. It is kept only while the pause runs — at most 7 days — and is then deleted. (5) A suspension or a closure: if your account was suspended when you deleted it, or if we closed it, the ground and the date are kept for 24 months from that date under a keyed one-way code made from your confirmed email address. A new account that confirms the same address is suspended on the same ground, and you can appeal it the same way; if the appeal succeeds, the code is deleted. (6) A payment dispute: that a payment on your account was disputed with the bank, the date, and whether the dispute was decided in our favour — kept for 24 months from the dispute under the same kind of code made from your email address and from Stripe’s card identifier. It restricts nothing by itself; a person sees it if the same address or card is used again. If you confirm the same address on a new account, your data download lists what is kept under it.

Deletion is a button, not a request form. Open your profile and press Delete my data. To make sure it is you, it asks for your password, unless you signed in during the last ten minutes; an account without a password gets a letter with a link that works once and expires in ten minutes, and is deleted when you press the button on the page it opens. Can’t sign in? On the account deletion page, type your email address: we send a link that works once and expires in ten minutes, and nothing is deleted until you press the button on the page it opens. Either way it removes your player row, your games, your results and your feedback immediately and permanently. There is no recovery; the only copies left are the backups described under Where it lives, which age out within about 70 days.

One exception: an active paid subscription, or a running club room you organise, needs to be cancelled first. Deleting the account would leave Stripe still charging a card attached to nothing, so pressing Delete my data while you are subscribed opens Stripe’s own cancel page — or cancel in Billing, as in Cancelling — instead of deleting anything. Cancel there, then press Delete my data again and it goes through immediately.

In the phone app: Settings → Delete my data. It deletes the same things, the same day, as the button on the site. Signed out, or the app is gone? Use mafiavoice.com/delete-account from any browser; you do not need to reinstall the app. If you pay through the App Store or Google Play, the app reminds you that deleting the account does not stop the store’s billing and offers the store’s subscription screen. You can cancel there first, or press Delete now: the account goes at once, and the store keeps billing until you cancel it there. Deleting does not refund days you already paid for — a refund follows Refunds. Deleting also erases your sign-in and settings kept on the phone.

How to delete an account: the account deletion page.

To ask anything else, write to the contact form.

Accounts nobody uses

If an account has not been signed in to for 24 months, we delete it. Keeping your games and your email address after you have stopped playing serves you nothing, and the law where the server stands says the same: personal data is kept only as long as it is needed.

You get told first, twice. After 22 months without a visit we email the address on the account, naming the date it will be deleted — at least 60 days ahead, and never before the 24 months are up — and offering you a copy of your record to keep. A reminder follows about a week before that date. Signing in once stops it, with nothing to do and nothing to pay, and the 24 months start again.

A paid account is never deleted this way, nor is a club organiser's account while their club is running. What deletion removes is exactly what the "Delete my data" button removes, and the same things survive it: the 12-month one-way hash of your email address, the payment records the tax law requires us to keep, and, if they apply to you, a granted refund or a revoked free-access mark, both described under Privacy above, and the security codes described there: the sign-in entries for the rest of their 90 days, and a suspension, a closure or a payment dispute for 24 months.

A club can also be removed from the list — and its code ended — if it stops existing, if nobody in it has trained for 12 months, or if we cannot reach or identify its organiser; we write to the organiser first, the club itself is unlisted rather than deleted, and their own access to the coaching is untouched.

Children

Not directed at children under 16 — the site's own age floor, everywhere, above any lower digital-consent age a jurisdiction would otherwise allow — and we do not knowingly collect anything from them. If you believe a child has created an account, write to us and it will be deleted.

That one floor sits above the age the United States children’s privacy law (COPPA) protects, above every EU member state’s digital-consent age, and above Quebec’s. We run no separate, lower regime for children anywhere, because there is no age below sixteen at which this site is meant to be used at all.

What you are agreeing to pay

A subscription renews automatically — monthly or yearly, whichever you chose — at the price shown at checkout, until you cancel. Cancelling takes two clicks in your profile and takes effect at the end of the period you have already paid for; there is no cancellation fee and no phone call. Each time you are charged you get a receipt: from Stripe for a payment on the site, from Apple or Google for a purchase in the app.

If we ever change the price, it never touches a period you have already paid for — the new one applies only from your next renewal, and we email you 30 days before the renewal it first applies to, naming the old price, the new one, the date and how to cancel. If you do not want it, cancel before that date and nothing is charged. And, like every price on this game, it is shown to you before you pay it, on the pricing page and at checkout, never charged as a surprise.

If you bought a yearly plan on the site, we email you about 60 days before the renewal date and again about 30 days before it, naming the date and the price. In Quebec, a yearly plan does not renew into another fixed year: bought with a Quebec billing address, its term is one year from the day of your payment, and it ends on the date named in the copy of your agreement we email you after you pay; nothing more is charged for it. You do not need to do anything to end it: there is no form to fill in, no notice to send and no charge for ending it. Between the 90th and the 60th day before that date we email you the end date and how to continue on the monthly plan, which runs month to month until you cancel.

Everything that renews, in one place. For a player there are two plans and nothing else: $5.99 CAD a month, and $49 CAD a year — both with Canadian GST/HST already inside the number, so what you see is what leaves your account. Whichever you choose renews for the same length, at the same price, automatically, until you cancel it, and the charge lands on the day the new period starts. There is no cancellation fee, no notice period and no phone call. A club trial is not one of these plans: no card is taken for it, and it turns into nothing. A private room is its organiser’s subscription, described just below.

How to stop it — on whichever till you bought it from.

• On the web: your account → Billing → Cancel subscription, and one confirmation on the same screen — nothing to hunt for in between. Or, without signing in, the Cancel plan link at the bottom of every page.
• On an iPhone or iPad: Settings → your name → Subscriptions → MafiaVoice → cancel. Apple stops a renewal if you do it at least a day before the period ends.
• On Android: Google Play → your profile picture → Payments and subscriptions → Subscriptions → MafiaVoice → cancel.

A subscription bought inside the app can only be cancelled in that store — Apple and Google do not give us a way to do it for you, and we will never ask you to write to us instead of using the two screens above.

Deleting the app, or deleting your account, does not cancel a store subscription on its own — only the store’s own subscription screen does, and the purchase screen in the app has a button that opens it.

A private room

A verified club: closed tables free, no card, nothing charged. A club we have verified gets its own closed table — up to 10 seats, bots on empty seats — without the 3 free evenings a friends’ room has, and with no offer to pay; within the limits below.

A verified club is free within a normal club’s size: up to 8 evenings a month (an evening is a day on which a game at one of its tables was played to the end with at least 3 people) and up to 2 tables at the same time. More than that needs the paid room, which is not on sale yet. We check a verified club again once a year, and after 60 days without an evening; until it is checked again it keeps its page, members, code and schedule, but its tables are not free, its code gives no fourteen days, and its organiser’s free coaching pauses.

If we change these terms for clubs, a club verified before the change keeps today’s terms for at least 12 months after we tell it by e-mail.

On this website, the $7 CAD/month room (3 free evenings first) is for a private group of friends without a verified club. Its organiser takes one closed room — up to 10 seats, bots on empty seats, the Coach review for the host. It is billed to the organiser, not to a player, and it is started, watched and cancelled on the room page.

The price, cancellation, failed-payment and refund terms in the next two paragraphs apply only to rooms paid for on this website. In the phone app, the organiser may choose a separate subscription after the no-card room trial; its price and renewal terms are shown before purchase, and the App Store or Google Play handles billing and cancellation. Refund requests follow the store-specific steps under Refunds. Any grace period or continued access during a store billing problem depends on that store’s rules and settings; the website’s three-day period does not apply. Your legal rights still apply.

3 free evenings, no card: nothing is charged and nothing renews by itself. An evening is a day on which at least one game at the room’s closed table is played to the end with at least 3 people. The free evenings end after the third one or 30 days after the start, whichever comes first. After that the room is $7 CAD a month for the room, GST/HST included — only if you take it: the first charge is on the day you do, then every month until cancelled. Cancel here in two taps: the room stays open to the end of the period already started, and nothing more is charged. Within 14 days of the first charge, write to us and all of it comes back, in full — once per customer.

The free evenings are given once per club and once per organiser address; a club or an address that has already had them pays from the first day, and the page says so before paying. If a monthly room charge through Stripe fails, the room stays open for 3 more days. The free evenings also end at once if at least two of the people at the table have already had free evenings in another room. Friends at the closed table get what every player gets — one free review a day, or their own plan. A room started before 29 September 2026 with a free month keeps what it was sold with for as long as that subscription runs: the free month, and a review for everyone who played at its closed table. The club page and the club code stay free whether or not the club has a room.

Refunds and cancellation

This policy is offered in addition to, and does not limit, any right you have under Quebec's Consumer Protection Act, Ontario's Consumer Protection Act, the EU/UK statutory right of withdrawal, or any other law that applies to you — Ukraine’s and Israel’s distance-selling cancellation rights included.

Cancelling

Open your account → Billing and press Cancel subscription: one confirmation on the same screen says when it ends and where the e-mail goes, and its Cancel subscription button cancels it at once. It takes effect at the end of the period you have already paid for, and you keep the paid features until then. Nothing is charged again after that. Or, without signing in, use the Cancel subscription page — it is linked at the bottom of every page as “Cancel plan” and opens without an account: give the account’s e-mail, which subscription, whether it is an ordinary or an extraordinary cancellation (with your reason), and when it should end — as early as possible if you name no date — and press “Cancel subscription”. If you are not signed in to that account, we send a link to its e-mail and the subscription is cancelled only when that link is pressed — the cancellation still counts from the time we received it. We confirm it on the screen at once, and by e-mail with what you sent, the date and time we received it, and when the contract ends. A subscription bought in the App Store or on Google Play is cancelled in that store.

Instead of cancelling, a monthly subscription bought on the web can be paused for 1 or 2 months from the same account screen: the month already paid for runs to its end, then nothing is charged and the Coach features are off until the date shown, and you can resume early or cancel at any time — the pause is offered beside the cancel button, never in front of it.

Cancelling from your account happens on our own screen, and we do not ask why. Billing also lists each payment made on this website — its date, what it paid for, the amount, and whether it was paid, refunded or did not go through — with a link to its receipt on Stripe’s page; a purchase in the App Store or on Google Play is listed by the store. Under Card and invoices, a link opens Stripe’s own page, where you can change your card and see your invoices; it does not let you switch plans. If a renewal charge fails, Stripe tries the card again over the following days and you keep the paid features for up to 14 days; if the charge still has not gone through by then, the paid features stop until it does.

Refunds

• A room paid for on this website through Stripe: within 14 days of its first website charge, full refund on request, never reduced, once per customer — as described under A private room.
• Within 14 days of your first payment: full refund on request, no reason needed, and never reduced by how many coach reviews you already opened. For consumers in the EU and the UK this policy meets, and does not reduce, your statutory right of withdrawal for digital services.
• A charge you did not expect — a renewal you meant to cancel, a duplicate: write to us and it is refunded.
• After 14 days, mid-period: we do not normally refund a period you have already used. But if the service was broken or unavailable for a meaningful part of it, write and say so. It will be handled reasonably.

Refunds go back to the card that paid, through Stripe. We send the refund within 14 days of your request — usually the same day — and your bank shows it, usually within 5–10 business days after that.

The same window and the same no-questions rule apply whether you pay monthly or once a year — an annual plan gets no shorter window and no smaller refund.

If we ever charge for something by how many times you use it, this rule covers that too: a refund is never reduced by what you already used, and anything that fails on our side — a review that does not come back, a call that errors out — is never charged in the first place, whether that would have cost money or counted against a limit.

If you are in the EU or the UK

You have a statutory right to withdraw within 14 days of the day the subscription was concluded, without giving any reason — the EU Consumer Rights Directive, and the UK’s Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. We have not asked you to give that right up. The law lets a seller take it away for digital content that starts immediately, on condition the buyer expressly agrees and acknowledges the loss; we never ask for that agreement, so the right survives your first game.

How to use it. Any clear statement is enough. Press Request a refund in your account, or write to the contact form and say you are withdrawing. There is no form to fill in, though you may use the model withdrawal form from the Directive if you prefer one. We repay everything you paid, by the same means you paid with, within 14 days of being told.

The withdrawal button. If you bought on this website from the EU, the EEA or the UK, your account shows a button labelled Withdraw from contract here for the whole 14 days. It opens a short statement — your name, the contract, and the address the confirmation goes to — and sends it only when you press Confirm withdrawal. We then email you at once that your withdrawal arrived, with what it said and its date and time, and repay you as described above.

And separately from withdrawal: the service has to work. Under the EU Digital Content Directive (2019/770) and the UK Consumer Rights Act 2015 what you subscribed to must be of satisfactory quality, fit for what it is sold for, and as described — for the whole time you are subscribed, not only on the first day. If it is not, you can have it put right, ask for a proportionate reduction of the price, or end the subscription and be repaid. Nothing on this page reduces those rights, and any sentence here that appeared to would simply not bind you.

What is not refunded

• The unused rest of a period you cancel. Cancelling stops the next charge; it does not hand back the part of the current period you have not used. You keep everything until that period ends instead.
• A period already used, once the 14 days have passed — unless the service was broken or unavailable for a meaningful part of it, which is the case above.
• A second automatic refund on the same account. The same applies to the same email address, and to the same card on another account (we compare a one-way code made from Stripe’s card identifier, never the card number). The first is processed exactly as described above. A later one is read by a person before anything moves, and it can be refused — a subscription refunded over and over is not this policy being used, it is this policy being farmed.
• Anything bought inside the iPhone app, by us. That money never reaches us and Apple decides — see below. A purchase on Android is different: after its first 48 hours you ask us, and we read it by this same policy.
• A club trial. Nothing was ever charged for it, so there is nothing to give back.

Consumers in Quebec: this paragraph does not apply to you. We may also refuse a refund, and close an account, where what we are looking at is several accounts belonging to one person, a trial taken more than once, or an account handed on to somebody else. We will say which of those it was, and you can answer it.

If you paid in the App Store or on Google Play

iPhone and iPad. Apple takes the payment for anything bought inside the app, and we have no technical way to refund it — that money never passed through us. Ask Apple directly at reportaproblem.apple.com; the decision is Apple's, not ours. Cancelling under Settings → your name → Subscriptions stops the next charge and is not itself a refund.

Android. For the first 48 hours after a purchase you can ask Google Play yourself. After that, Google sends you to us: press Request a refund in your account or write to the contact form, and we read it by exactly the policy above; if it is approved, we refund it through Google Play.

Before you call your bank

A subscription bought on the site with a card shows on your card or bank statement as MAPLEGATE* MAFIAVOICE, billed through Stripe (a few banks shorten or reword it); one bought through Stripe Managed Payments shows a line starting with LINK.COM*, as Link (Stripe) sells that payment; one bought inside the app shows under Apple's or Google's own store name instead.

Write to us first. A card dispute takes two to three months to settle, and a refund we issue reaches your card long before that — so asking is simply faster for you. A dispute opened without a word to us is contested, because the same message would have got the money back sooner. This does not limit any right the law or your card issuer gives you, including the right some provinces give to have a charge reversed when a seller has not refunded a properly cancelled purchase.

How to ask

One email to the contact form with the address you subscribed with. No form, no phone queue.

Or use your account: within the 14 days a button there refunds you automatically, with nobody to ask; outside them, or where the automatic refund does not apply, press Request a refund and your request goes to a person, who answers it. Ask within 14 days and it is refunded — not reviewed, not argued, just processed: we send the money within 14 days of when you asked for it, usually the same day. Outside that window, refunds are handled case by case, and a person will say if it is approved.

Inviting a friend. Your account has a link you can share. When somebody opens it and creates an account, they get 14 days of the full product (Coach) once they have confirmed their email address and played a first real game to its end — at least two game days and ten minutes (three minutes if they were eliminated), with at least one move of their own and no turn the clock had to answer for them — and have not had a friend’s days, a free trial or a refund before with the same email or card; at that moment you get 7 days. When they make their first payment — on the website, in the App Store or on Google Play; a free trial start is not a payment — you get 30 more days. These days are added to your access, once per person you invite, and you can receive at most 10 such rewards (7-day and 30-day alike) in one calendar year; your friend’s 14 days do not depend on that limit. You cannot invite yourself. There are no 30 days when your friend pays with the same card as you: to check this we keep a one-way code made from the card identifier Stripe gives us, never the card number. If your friend’s card is already known to be the same as yours when they finish that first game, neither of you gets the 14 or the 7 days. If that first payment is refunded or disputed, your 30 days are taken back. There are no 7 days when your friend created their account from the same network your own account used during the day before (the same home or venue connection) — your friend still gets their 14; to check this, our server compares the two connections in its memory only, for one day, and keeps nothing but a yes or no on your friend’s account. If your friend deletes their account within 30 days of the moment you got the 7 days, those 7 days are taken back. It is a thank-you, not a prize: nothing is drawn, there is no contest, and it cannot be exchanged for money.

Clubs and club codes

A mafia club can be given a club code. This section is the whole agreement about what that means, for the club and for the player.

For the player

Typing a club code gives you fourteen days of the full product, counted from the moment you confirm your email address (the link in the letter we send). Until then the gift waits and holds no place. It costs nothing, no card is asked for, and it stops on its own — there is no subscription behind it and nothing to cancel. One trial per account; a second code does not extend it, and a subscription started within 30 days after the trial is not a second trial — see Refunds. When the fourteen days end you keep the game, the hints, and one review a day. A club's code gives these fourteen days only once the club is verified (see “For the club organiser”), and to at most 20 new people in each 30-day period — we may raise that number for a club. When the club is not verified yet, you still get your account and the whole free game, only without the fourteen days, and the page tells you so. When the places are taken, you still get your account, the club and the whole free game; your fourteen days wait and start by themselves on your first visit after a place opens, and the page tells you so, with the date. In the iPhone app, a club code makes you a member of the club but does not start the fourteen days — Apple does not allow an app to unlock paid features with a code; they wait, and start the first time you use MafiaVoice on the website or in the Android app.

Your club is told how many people joined through its code, never how many of them pay. Its organiser sees your display name and the date you joined, as described under Privacy; the club is never told what you scored, or anything you typed — except the line you write yourself when you ask to join it.

The clubs table shows how many players in a club are training and how many step crossings they have passed together — as numbers only, never a name, an email or a code, and the progress numbers appear only once a club has at least five players, so no single person can be read off their club's row.

Once a club has at least five people training in it, its organiser also sees one line naming the tell the club most often misses and how many times — a count over the whole club, never a person, and withheld below five people so a small club's number cannot be read back to one player.

For the club organiser

• The coaching is free for you from the day your club is verified, for as long as it stays verified. Every lesson, every review, no card. While the club waits to be checked again — after a change of its name, city or link, once a year, or after 60 days without an evening — it pauses, and it comes back when the club is verified again. Reading a table costs us nothing to run, so this costs us nothing to give.
• It is the coaching that is free, not everything we may ever build. Anything added later that costs real money every time it runs is priced on its own. Nothing you already have is taken away to pay for it, and this clause is not a licence to move today's coaching behind tomorrow's price.
• There is no commission, and that is deliberate. A percentage of what your players pay would come to a few dollars a year, and collecting it would mean registering with a payment processor and losing a fee on the way out. We would rather give you the product, which is worth many times more and needs no paperwork from anybody.
• Your players each get fourteen days of everything once they have typed your code and confirmed their email address — the same fourteen days any club's code gives. What the code adds is a place in your club: your club's own tables, with the people they actually play with. Up to 20 new players in each 30-day period, counted from the day the club was verified. A place is counted when a player's fourteen days start, not when the code is typed. Your club page shows how many places are used and when they reset; write to us and we raise the number for a larger club.
• Applying is not the same as being approved. We read every application by hand, and we may decline one. When we do — and on every other decision — we answer in writing, with the reason, to the address on the application. The same words are kept on your club page, so you still have them if you delete the letter, and you can reply to that email and we will look again. A club page you make on the site itself works at once, by its link, but its code and your free coaching switch on only after we verify the club. To ask, you send one public link that proves the club is real: the club's own Telegram, Instagram or Facebook page with dated posts, its Meetup group, or its page on mafiaratings.com, imafia.org or americanmafialeague.com. A person checks it against six points, usually within 3–7 days, and answers in writing with the reason. If we decline, the club page keeps working; reply to that letter and we look again, or send a better link. One link proves one club. A verified club that changes its name or city, or sends a new link, is checked again, and its code and your free coaching pause until then.
• We email you a link before an application is looked at. The link opens a page with one button; until you press it, nothing is in our queue and nothing is sent to anybody — which is what stops a club being registered in somebody else's name.
• One organiser, one club. If you run more than one, write to us and we will add the next one by hand.
• Your club appears on our public club list only if you switch it on; a club we found on its own public page can be listed before anybody from it has signed up, and is taken off when you write to us. The list shows the club's name, its city and how many of its players train here. It never shows a person's name or anyone's results. The same is true of the clubs table. A club registered under “Other” rather than a named country is not shown on either — everything else about it works the same. A club made on the site appears there only once it is verified.
• We may end a club code if it is used to spam people, if it is advertised as something we did not say, or if the club stops existing. That closes the club's table, not your own access — an account is only ever closed under the account terms above.
• A club that has never had a member and has not been used may be archived. Write to us and we put it back.
• You are not our employee, agent or partner, and you may not sign anything or make promises on our behalf.

An organiser is paid in product, never in money: the coaching, free while the club stays verified, and no paperwork with a payment processor. If you are looking for the paid programme, that is streamer and creator partners below, and it is a different thing.

Streamer and creator partners

This is a different program from the club program above, for a streamer, video creator or other creator who sends us an audience rather than runs a table with it. Unlike a club, a partner is paid in money.

• A partner is paid 15% of the net amount of each payment made by a player they referred, for 12 calendar months from that player's first payment — not 15% of what the player pays: the net amount is what is left of the price after sales tax and the fee taken by the App Store, Google Play, Stripe or the payment provider that sold it. Not a fixed fee, and not for the player's whole lifetime.
• When a sign-up is counted for a partner's code. A partner's code is not stored on the visitor's device. It counts when a new customer signs up during the same visit in which they opened the partner's link, or types the partner's code in the sign-up form on any later day. Someone who already has an account, or who already played as a guest before the partner's code reached them, is not counted. If the person plays as a guest after opening the link, the code is noted on the guest record for 12 hours, as described under Privacy. Which partner counts when two partners' links were opened is described there too (link codes). A code the person types counts over any link. A partner's code is never counted for the partner's own account or own email address. A counted sign-up earns nothing by itself: commission comes only from payments, as described above.
• Each commission is held for 60 days before it can be paid, so that a refund or a dispute can arrive first. A commission on a payment that is refunded or disputed is taken off what has not yet been paid to you; money already paid to you is never asked back.
• Payment is made by hand, from MapleGate Systems, once what can be paid to you reaches C$50; a smaller amount carries over to the next month. Payouts stay manual while we have 5 partners or fewer.
• In your first 90 days as a partner, counted from your first commission, at most C$200 of commission is earned; commission above that in those 90 days is not owed.
• A code is paused automatically on signs of fraud — 3 disputed payments, or more than 20 payments through it within 24 hours. While it is paused nothing is paid out, and a person looks at it and either lifts the pause or closes the code.
• We may end or refuse a partner code for spam, for self-referral, or for advertising it on terms we never agreed to.
• What a partner may not do to earn commission. No paid advertising (search or social ads) on our brand name, on “MafiaVoice” or on a name close to it; no listing of the code on coupon or discount sites; no posing as a player. We may cancel a commission — paid or not yet paid — that came from fraud, self-referral or a breach of these rules, and close the code.
• What we keep about a partner: your partner code, the channel name and link, the address and country given on application, the country where you are resident for tax, the partner's status and the payout method, and — asked for only at the first payout — the details needed to send the money. If you are resident in Canada and we pay you more than C$500 in a calendar year, we must ask for your Social Insurance Number or business number to file the T4A slip the Canada Revenue Agency requires; it is asked for only then, used for nothing else, kept encrypted so that our server cannot read it, and kept, like the payout records, six years after the end of that tax year, as Canadian tax law requires.
• Deleting your account does not delete a partner’s tax records. If your code ever earned a commission or received a payout, the code is closed and its link to your account and your channel link are removed; the code, the channel name, the country, the country of tax residence, the payout method and the commission and payout records stay until 1 January of the seventh year after the year they belong to — six years after the end of that tax year, as the Canada Revenue Agency requires. A code that never earned anything goes with the account; a closed code with no money records left is deleted 24 months after its last change. A payment made with the partner’s own card earns the partner nothing, checked with the same one-way card code described under Privacy; if the card is recognised only later, what was counted for that payment is taken back.
• What you earned before a code is closed is still sent once its hold ends; nothing already paid is taken back.
• This is income, and you declare it yourself. We do not withhold tax; for a partner resident in Canada paid more than C$500 in a calendar year we file a T4A slip and send you a copy.
• We do not yet take partners resident in Quebec: the separate partner agreement is not yet available in French.
• A partner is not our employee or agent, and may not sign anything or make promises on our behalf.
• A partner must say plainly that they are paid, in every post, video or stream that carries the code — in the post itself, not only in a profile or a link description — for example “Ad — I earn a commission if you subscribe via my link” or “#ad”. In a video, say it out loud near the start and keep it on screen; in a stream, repeat it. Canada’s Competition Bureau, the US Federal Trade Commission, the EU rules on unfair commercial practices and the UK’s Advertising Standards Authority all require this. A partner may not pose as an ordinary player, and may not offer anything in return for a review in the App Store or on Google Play. We may close a code used without the disclosure.

If these terms change

Consumers in Quebec: this paragraph does not apply to you. They will, eventually. When they do we update the “Last updated” date at the top of this page. A new version is accepted only by an act of yours. When a new version takes effect, the start screen says what changed and asks you to press “I accept”; the same can be done on the sheet shown before a live table, by ticking “I accept the updated terms” and pressing “Take my seat”. Until you do one of these, you cannot join a live table. A box left unticked records nothing. “Not now” takes you back to the start screen and loses you nothing else: you can still see your results and statistics and delete your account. Using the game after a change does not by itself count as accepting it.

If you pay, a change that affects you is emailed to you at least 30 days before it applies, naming what changes. This email and your right to cancel stay as they are; they come in addition to the button. If you do not accept it, cancel before that date: nothing more is charged, and the unused part of a period you have already paid for is refunded. For a consumer in the EU, the UK or Quebec, a change that would remove a right you have by law does not bind you at all.

If you are a consumer in Quebec, we may change only these parts on our own: what the paid tier includes, the list of providers and data in Privacy, and the price of a future period. At least 30 days before, we email you the old and the new wording and the date it applies. If the change raises what you pay or lowers what you get, you may refuse it and cancel, at no cost, up to 30 days after it applies.

The version you agreed to when you registered is recorded against your account, so there is always a record of which terms you actually accepted.

Accessibility

The aim is WCAG 2.2, level AA, on the site; the app is next. No law requires this of us — we are too small for the European Accessibility Act, outside the Accessible Canada Act, under the headcount Ontario’s AODA applies to, and Alberta has no accessibility statute; the Alberta Human Rights Act still forbids discrimination in services offered to the public, including on the ground of disability. It is written here so you can hold us to it anyway.

What is checked on every release of the site: the contrast of every piece of text against what is really painted behind it, computed from the live page rather than read off a stylesheet, and an automatic accessibility scan of every screen, including the table in each of its states, in three languages and at phone and desktop width. A failure there blocks the release. Not yet checked by hand: a whole game with the keyboard alone and with a screen reader — that is the next step, and until it is done we do not claim it.

If something blocks you, tell us and it gets fixed. Write to the contact form with the word “Accessibility” in your message — one person reads every message. Say what you were trying to do and what got in the way; naming the device and the assistive software helps, and is never required. Last reviewed 30 September 2026.

Contact

One route, and it works whether or not your machine has a mail program: a form that lands in front of one person, who writes back. No account needed.

The seller is named in the Terms of use, under “Who you are buying from”. A postal address for letters and legal notices is sent by return to anyone who asks for it through the form.