Privacy Policy

Mafia: Truth or Lie is an online social deduction game. This policy explains how the game handles account information, game activity and player communications, and how to contact us about your information. Contact: zaidrabeeab1@gmail.com.

The game is owned and operated by Zaid Rabeea, based in Ontario, Canada. Privacy inquiries may be sent to the contact email above. The operator's location does not mean that all game data is stored in Ontario or Canada.

### Age and agreement check

The entry screen asks for a date of birth to check the 16+ eligibility rule. The server evaluates it and retains only the eligibility result, server-recorded acceptance time and the versions of the age policy, Terms of Service and Privacy Policy associated with that acceptance. The full date of birth is not retained in the account consent record. This does not independently verify identity, replace consent requirements for minors or authorize marketing, microphone or photo access.

The game creates a guest account so that your progress belongs to a server account rather than only to your device. We store an internal account identifier, your Player ID, username, account creation details and profile choices. If you change your username, we also keep a history of those changes.

If you link an email address, we store that address, its verification status and a password hash. We use the address to verify the account and send password recovery messages. Password verification uses a hash; the game does not store your password as readable text. Verification and recovery requests also create time limited security records.

When Facebook sign in is available and you choose to use it, Meta processes the sign in and returns an authentication credential. Our server verifies it for this game and stores the Facebook identifier associated with your linked game account. The current integration requests the basic public profile permission. It does not request your Facebook password, friends list, posts or photo library. We do not use Facebook sign in to publish posts on your behalf or to treat a Facebook email address as a verified game email address. Facebook sign in is still undergoing device testing and is not currently enabled for general players. Unavailable sign in methods do not become active simply because they appear on the Account screen.

You may choose one of the game's built in avatars. An account with an eligible linked sign in method may also choose a profile image from the device photo picker. The server processes the selected image, removes its embedded metadata and stores a smaller JPEG copy for the profile. This feature uploads the image you select; it does not upload your entire photo library.

Profile images are intended for display to other players. A stored profile image can also be accessible to someone who has its image URL. Avoid uploading an image you want to keep private.

Microphone access is optional. When voice chat is available and you turn on your microphone, your audio is transmitted to the players permitted to hear it under the current room and game rules. Denying microphone access does not prevent ordinary gameplay. The game does not implement voice recording, speech transcription or voice identification. Other people can still record what they hear using their own devices; the game cannot prevent that.

We store information needed to operate matches, calculate rewards and preserve your progress. This includes match identifiers, available completion and mode information, win or loss outcomes, participation classification, XP, Coins, rank and mastery progress, statistics, cosmetic unlocks, reward claims and selected profile items. Daily reward records include claim dates and, where relevant, activation, expiry and consumption information.

The server also processes room membership, role assignments, votes, actions and connection or AFK state to run a match. Private role information and action results are sent according to the game's visibility rules. Some match state is temporary; the game does not retain a complete permanent replay of every match action as part of its current progression records.

The current version does not process real money purchases or subscriptions. If payment features are introduced, their information handling must be described before they become available.

Your Player ID, username, avatar and selected frame can be visible to other players through supported profile, search and multiplayer features. We store friend relationships, friend requests and blocks to provide those features.

Direct messages between players are stored in the game database so that the conversation can be retrieved. A limit on the number of messages shown does not mean older stored messages are automatically deleted. Direct messages are not described as end to end encrypted.

Room and match text or sticker messages are delivered to the relevant participants. The current server does not save their contents as permanent chat history. Temporary message displays and rate limit state are used during play. Recipients may retain screenshots or their own copies.

If you contact us for support or account recovery, we receive the message, contact details and any information you choose to provide. Recovery records may also contain a claimed Player ID, evidence references, internal review notes and request status. Please do not send passwords or security codes in a support message.

We use session records, a device identifier, device platform and name, login timestamps and security information to authenticate you, restore access and protect accounts. Login and token misuse records can include an IP address, browser user agent, provider, a hashed login identifier and the result of the attempt. Hosting and service providers also receive network information needed to handle a connection.

The mobile app stores refresh credentials using the device secure storage service and keeps access credentials in memory. Other device settings, such as language and sound preferences, are stored locally. The current browser preview is a development tool with temporary session storage; it is not a separately approved production browser account system.

The current game does not request access to your contacts, precise device location or camera for these account features. The iOS Facebook integration is configured without automatic advertising identifier collection or automatic app event logging. We do not sell personal information in the current game service or use game communications to target advertisements.

We use service providers for functions needed to operate the game:

• Resend delivers verification and password recovery emails. It receives the recipient address, message contents, including the verification or recovery code, and delivery information.
• Meta provides optional Facebook authentication and receives information through that sign in process under its own terms and privacy practices.
• LiveKit, when voice service is configured and available, carries real time voice and processes connection information, a game supplied participant name and opaque room and participant identifiers. The game does not use LiveKit AI agents or enable recording as part of its current voice implementation.
• Database, file storage and hosting infrastructure hold or process the information needed for the game. The final public hosting provider and deployment regions have not yet been selected.
• The support mailbox provider processes messages sent to the contact address above.

Providers may process information outside your country. Their own processing and service records are subject to their applicable terms and retention practices. We may also disclose information when necessary to comply with a legal obligation, protect accounts and service security, or with your authorization. Player information is shared with other players only through the game features described above.

Account, progression, ownership, social and security records are stored to provide the service and protect accounts. Expiry of a code, session or temporary reward prevents future use but does not itself delete historical records. The owner has approved the following intended schedule, which is not yet implemented or offered as an operational guarantee:

• Account progress and owned items: while the account remains, without inactivity-based deletion.
• Direct messages and routine connection, error and login records: 90 days.
• Closed support cases: 12 months after closure.
• Expired authentication challenges and ended sessions: cleanup within 30 days after expiry or final termination, without extending or shortening their existing validity.
• Game voice and room/match messages: no permanent recording/history in the current implementation.
• Backup rotation: a proposed maximum 30-day cycle, subject to confirmation with the selected production provider.

Daily reward claim history, rename-card sources, progression and duplicate-reward protections are not routine expired-session data; temporary item expiry does not delete these permanent account records. Defined security disputes, fraud evidence and future financial records require their own approved retention rules. Any necessary exception must identify a specific purpose and period, rather than retaining every record indefinitely. Deletion targets and backup treatment are described separately below.

You may contact zaidrabeeab1@gmail.com to ask about access, correction or deletion of your game information. We need to verify control of the account before changing or deleting it. Logging out, uninstalling the app or removing Facebook access does not by itself delete the server game account or its history.

The separate Data Deletion information describes the account deletion and 30-day restoration process. The development build supports ownership-verified in-app deletion for guests and verified-email accounts, with a 30-day Restore Account window before primary cleanup. Website deletion and provider-only verification are not yet publicly available. Production backup coverage and external provider copies require deployment verification. These pages do not promise an unverified backup-erasure deadline.

We use server side identity verification, access checks, password hashing and restricted credentials to protect account information. No security measure can guarantee that information will never be accessed improperly. We will update this policy when the service or its information handling changes and identify the document version and effective date.