Privacy policy

1. Who we are

Mafia Pro is the Telegram bot @mafiaprof_bot, the Telegram mini app, the website mafiapro.app, the channel @mafiaprof and the “Mafia Pro” Discord server for playing mafia at the table and online. The data controller is the Mafia Pro project team (“we”).

To contact us about your data: send /support with your message to the bot @mafiaprof_bot. We reply there within 30 days, usually much sooner.

2. What data we collect

Telegram data. When you message the bot or open the app, Telegram gives us your Telegram id, first and last name, @username, interface language and a link to your profile photo. Telegram does not give us your phone number, contacts or chats.

• The game: tables you open or join, your seat, role, moves and answers in online games, table chat messages, game results, points, rating, statistics and win streaks, the name you played under.
• Friends and clubs: your friends and friend requests, your invite code and whom you invited, clubs (name, city, description, link, logo), club memberships and club chat messages, partner applications (name, channel, audience).
• Profile: your city, if you add it to your profile in the app.
• Purchases: what you bought with Telegram Stars, the amount and the Telegram payment id. We never get card details — Telegram handles the payment.
• Where you came from: the tag of the link you first opened the bot with (a channel post, an ad, the website, Discord, Instagram, Facebook, TikTok, an invitation) and the time of your first visit.
• Discord (if you are on our server): your id, username and display name, when you joined and left, which invitation brought you; a link to your Telegram account only if you connected them yourself with /link or a personal invitation from the app.
• Security: Cloudflare processes your IP address to deliver requests. We do not store IP addresses — only an irreversible salted hash, and only with security events (forged requests, floods, blocks): the event type, country, section and time. Plus request counters that are not linked to anyone.
• On your device: the app keeps settings, local player profiles (names and avatars you added) and the current game in browser storage. That stays on your device; only what is listed above reaches our server (for example, a game result sent by the host).

We do not collect phone numbers, e-mail addresses, location or card data; the app and website contain no third-party advertising or analytics trackers.

3. Why we use the data

• To run the game (performance of the contract — the terms of using the service): sign-in, tables and dealing cards, online games, chats, rating, friends, clubs, notifications about your game.
• Purchases (contract and accounting obligations): to deliver what you bought and refund a payment if needed.
• Security and fair play (legitimate interest): to fend off attacks and floods, block abuse and prevent rating manipulation.
• Improving the service (legitimate interest): to understand which channels and posts bring players — as aggregate numbers.
• News in the bot (legitimate interest): we occasionally send news and invitations. To opt out — /unsubscribe; to opt back in — /subscribe.
• Discord (your action): language roles, table and result cards, /stats.

4. Who sees your data

• Other players: your name, @username, photo, rating and statistics, whether you are online, your club; at a table — what the game shows; messages in table and club chats. The public leaderboard shows name, @username, photo and points. You can be found by @username or name in the player search.
• Discord: online table cards with the host’s name and game results with player names and roles in the server’s channels; /stats shows your statistics if your Discord is linked.
• Mafia Pro administrators: for support, moderation, partner payouts and reports on new players.
• Processors the service cannot work without: Telegram (messenger and payments), Cloudflare (hosting, database, network protection), Discord (if you use it), Google Fonts (the fonts of the website and app receive your IP when they load). GitHub hosts the code and the old website address; it holds no player data.
• We never sell data or pass it to advertising networks. To authorities — only when the law requires it.

5. How long we keep it

• Account and game data — while you use the service. You can delete them at any time (section 6).
• Security events — 30 days, request counters — 14 days, blocks — up to 90 days.
• Payment records — as long as accounting law requires.
• Data on your device — until you clear it (browser or Telegram settings).

6. Your rights

Everything is done in the bot @mafiaprof_bot:

• /mydata — a file with all the data we hold about you (once an hour).
• /deletedata — delete your data. We delete your profile, rating and statistics, friends, club memberships and messages, table seats and table chat, invitations, where you came from, your Discord link and settings. In past game results your seat stays as “Player” without a Telegram id. Payment records are kept for accounting; purchased items and granted access are gone after deletion.
• Correction: your name, @username and photo update from Telegram automatically; your city is changed in your profile in the app.
• /unsubscribe — no broadcast messages; /subscribe — turn them back on.
• Objection, restriction of processing, other questions — /support with your message.
• Complaints to a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in Poland — the President of UODO; elsewhere in the EU — your national data protection authority; in Armenia — the Personal Data Protection Agency of the Ministry of Justice.

7. How we protect data

• HTTPS only; every request from the app is checked against Telegram’s signature, so nobody can sign in as another player.
• The bot accepts updates only from Telegram’s servers and only with a secret key.
• Request limits and automatic blocking of flood sources; Cloudflare’s network DDoS protection.
• Round-the-clock monitoring: suspicious events reach the administrators at once; dangerous admin actions can be locked, and the lock can only be lifted through a separate protected channel.
• Keys and passwords are never stored in the code; IP addresses only as hashes.
• If a breach affects your data, we will tell you through the bot and, where the law requires it, the supervisory authority within 72 hours.

8. International transfers

Telegram and Cloudflare process data on servers in different countries, including outside Ukraine and the EU. Cloudflare uses the EU Standard Contractual Clauses and other data protection safeguards.

9. Children

The service is meant for people aged 16 and over. If you are younger, use it with your parents’ consent. If we learn that data of a child under 13 reached us without such consent, we will delete it.

10. Cookies and browser storage

The website and app set no advertising or analytics cookies. Browser storage (localStorage) is used only to make the app work. Cloudflare may set technical bot-protection cookies.

11. Changes

If we change this policy, the new version will appear on this page with a new date; we will announce important changes in the bot or the channel @mafiaprof.