Privacy policy

Effective date: 1 October 2026. Applies to the MyMafia app (com.mymafia.app), the website at mymafia.app, and the game service at api.mymafia.app, all operated by RemNet, Netherlands.

Our other app, Vacation Mode, collects nothing at all. MyMafia is different and it is worth being plain about why: the game is played against other people, on a shared server, so your account and your progress have to exist somewhere other than your phone. This page describes exactly what that means.

1. Who is responsible

RemNet, a development studio in the Netherlands, is the data controller. For any question about this policy, or to exercise any of the rights in section 7, email support@remnet.io.

2. What we store, and why

Your account

• Username and email address. Used to identify you and to sign you in. The email address is also the only way we can reach you about your account.
• Your password, hashed. Stored as a bcrypt hash, never as text. We cannot read it, and neither can anyone who obtains the database.
• Your display name. Visible to other players, which is the point of it.

A linked Google account, only if you choose to link one

If you sign in with Google, or connect Google from the app's settings, we store Google's stable account identifier for you and the email address on that Google account. The identifier is what signs you in; the address is stored only so the settings screen can show you which Google account is connected. We never receive your Google password, and we ask Google for nothing beyond your basic profile and email.

Your game progress

Level, experience, money, reputation, inventory, family membership, and a record of the actions you take in the game: crimes attempted, fights, casino rounds, jobs, and every movement of in-game currency. This is what a saved game is. The currency record also exists so that if someone finds a way to cheat, we can see it happen and put it right rather than guess.

Your device, for notifications

If you allow notifications, we store the push token your device issues and whether it is an Android or an iOS device. Decline notifications, or turn them off later, and no token is stored. Apart from the optional analytics identifier described below, the app does not collect a device fingerprint, your contacts or your precise location.

Optional usage analytics

The MyMafia app starts Google Analytics only after you explicitly allow usage analytics. The website loads the Google tag in consent-denied mode and sends limited, cookieless measurements before a choice is made or when analytics is refused. No Analytics client cookie is set or read in that state. These measurements include the consent state and ordinary technical information such as page URL, IP address, browser details and screen resolution; Google says it uses the resulting cookieless signals for aggregate measurement and modelling. After consent, the website may set an Analytics client cookie and measures page visits and clicks through to Google Play. In the app, Analytics measures app opens, sessions, screen visits, onboarding progress, notification prompts and opens, and the controlled category and outcome of important game actions. It may also receive virtual-currency amounts and Google Play purchase events. To compare retention without identifying a player, we set only broad properties such as app language, level and account-age bands, rank, and whether the player belongs to a family. This app measurement happens only after consent. Google Analytics also receives standard technical information such as app or browser version, device type, operating system, language and approximate region.

Google Analytics uses a randomly generated first-party client identifier on the website and an app-instance identifier in the app. We do not set a Google Analytics user ID and do not send your player or family ID, username, email address, player or family name, chat messages, searches, free-form game text or API error messages. Advertising signals, advertising-ID collection and personalisation are disabled. Google may use an IP address briefly to derive an approximate region, but Google Analytics says it does not log or store individual IP addresses.

You can refuse analytics without losing any game feature. You can also change your choice later through Analytics settings in the website footer or Usage analytics in the app profile. Collection stops when you withdraw consent.

Technical records

• Sign-in sessions. Each active session is stored as a hash, with the browser or app version string your device sent, so you can be signed out everywhere if you ever need to be.
• IP addresses. These appear in our server logs and are used to limit how often anyone can hit the service, which is what stops one person overwhelming it or brute-forcing passwords. Logs are short-lived, and the rate-limiting records expire within minutes.

3. What we deliberately keep out

This describes the website and app as they are at the effective date above, and being specific is more useful than a general reassurance. If any of it changes, this page changes first, and so does the data safety declaration on the app's Google Play listing.

• The app shows no adverts and reads no advertising identifier.
• No advertising, attribution or crash-reporting SDK is built into the app. Google Analytics is the only analytics SDK and remains disabled until you consent.
• We do not sell or rent your personal data.
• We do not profile you, and no decision about you is made automatically.
• Purchases go through Google Play. We receive a record of what was bought and when, so the in-game money can be paid in and reversed if the purchase is refunded. We never see your card or payment details.
• No access to your contacts, photos, microphone, files, camera or location. The only permissions the app asks you to grant are notifications and vibration. It also declares permissions that Android grants without asking, because the libraries it is built on need them: network state, wake lock and start-at-boot so a scheduled notification survives a restart, launcher-badge access so the app icon can show a count, and an overlay permission that comes from the React Native development tooling and is unused in the shipped app. None of them give access to your data.

4. Our legal basis

Under the GDPR we rely on:

• Performance of a contract for your account and your game progress. Without these the game cannot work at all.
• Legitimate interests for security and abuse prevention: rate limiting, sign-in session records, server logs and the in-game currency record. Our interest is keeping a shared game fair and available; the data involved is minimal and short-lived.
• Consent for push notifications and optional usage analytics. You can withdraw either choice at any time without losing access to the game.

5. Who else processes it

We use as few outside parties as we can:

• Hetzner Online GmbH, Germany, hosts the server and therefore the database. Data stays in the EU.
• Cloudflare sits in front of the service to absorb attacks and to serve it over an encrypted connection. It necessarily sees the IP address of each request.
• Google Ireland Limited processes optional website and app analytics after consent. Google receives usage events, a random client or app-instance identifier and technical device or browser information. Google also verifies your identity if you choose Google sign-in.
• Google Play processes purchases. It handles the payment itself and tells us only that a given purchase was made, so that the in-game money can be paid in.
• Expo (Expo, Inc., United States) delivers push notifications to your device. It receives only the push token and the notification text, and only when a notification is actually sent. This is the one processor outside the EU; it handles no account data and nothing else about you.

Each of these acts on our instructions as a processor. None of them receives your data for their own purposes.

6. How long we keep it

• Your account and progress, for as long as the account exists. Ask us to delete it and it goes.
• Server logs, for a matter of days, then they roll away.
• Rate-limiting records, minutes.
• Sign-in sessions, until they expire or you sign out. Signing out genuinely invalidates the session on the server rather than only forgetting it on your device.
• Push tokens, until you disable notifications, uninstall the app, or the account is deleted.
• Google Analytics data, according to the retention controls in our Google Analytics property. Google may retain aggregated reports that no longer identify a client or app instance for longer.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to our relying on legitimate interests. Email support@remnet.io and we will answer within a month. There is a separate page about account deletion, because it is the request people most often want and it should be easy to find.

You can withdraw analytics consent directly in the website footer or app profile. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

We do not require a reason and we will not make the game worse for you for asking. If you are unhappy with how we have handled it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

8. Children

MyMafia is not intended for children. The game is built around crime as a theme and includes simulated gambling with in-game money, so it is for players aged 16 and over. We do not knowingly create accounts for children. If you believe a child has an account, email us and we will remove it.

9. Security

All traffic between the app and the server is encrypted. Passwords are stored only as bcrypt hashes, and session tokens only as hashes, so neither can be read back out of the database. Sessions are short-lived and rotate, and reusing an old one invalidates the whole chain. The database and cache are not reachable from the internet at all; only the game service can talk to them.

No system is perfect. If you find a security problem, please tell us at support@remnet.io before telling anyone else, and we will credit you if you would like us to.

10. Changes to this policy

If this policy changes in a way that affects you, we will change the effective date above and say so in the app. We will not quietly start collecting something new.

11. Contact

RemNet, Netherlands · support@remnet.io