MJOT is operated by its developer as an individual, based in Taiwan. This policy describes exactly what MJOT stores and why. There are no user accounts on this website, no third-party analytics, and no advertising trackers. The only thing the website itself keeps in your browser is your light/dark theme preference (localStorage). Fonts and all other assets are served from our own deployment — no third-party font or script CDNs.
1. Your game positions are not stored
The board states you send to /v3/react are processed in memory to compute the move and then discarded. We do not retain the tiles, hands, or event streams you submit, and we do not use them to train models.
2. What the API logs
Each API request writes one line of operational metadata: timestamp, request id, HTTP method/route/status, latency and payload sizes, the number of events in the request (a count, not the events), the model id, coarse decision metadata (e.g. the chosen action type and its probability), your IP address and derived country, user-agent, and — for authenticated calls — the internal key id, the key's last 4 characters, and its plan.
These logs exist for abuse prevention, capacity planning and debugging. They are rotated and compressed, and retained only for a short bounded window (currently 14 days, and additionally capped by total size). Aggregated, non-identifying statistics (hourly request counts, latency percentiles and similar) are kept longer.
3. Keys and usage
- Our key database stores API keys only as salted hashes, plus the last 4 characters for display. During purchase delivery a plaintext copy exists transiently — for the short claim window in which your client fetches it — and is then deleted. If a credential is delivered by email, that email also contains it (see §5).
- Per-key daily request counters are kept to enforce plan quotas.
- An email address is stored only if you provide one. It is optional: anonymous redemption works without it, but grouping keys under one account, email delivery of credentials, and subscription notices require it.
4. Purchases
Payments are handled by our payment processor (currently PayPal). Card or bank details never reach our servers. From a completed purchase we store the order/subscription id, the product, the amount and currency, the capture id, and — for subscriptions and emailed deliveries — the payer email address. Purchase records are kept as long as needed for accounting, refund handling, and legal retention periods.
5. Email delivery
Redeem codes, API keys and subscription notices are delivered through our transactional email provider (Resend). Such an email contains your credential and nothing else; we do not send marketing email. Keep in mind that an emailed credential exists in your inbox — delete the email if you prefer the key to live only in your client's configuration.
6. Service providers
The following categories of providers process technical data (such as IP addresses and request metadata) as part of operating the Service:
- Website hosting — Vercel serves this website.
- API infrastructure — our servers and Cloudflare, which provides network routing and protection in front of the API.
- Payments — PayPal processes payments under its own privacy policy.
- Email — Resend delivers transactional email.
We do not sell or share personal data beyond these providers, and disclose it otherwise only where required by law.
7. Where data is processed
Data is processed in Taiwan and in the countries where the providers above operate (including the United States). By using the Service you acknowledge these transfers; where a jurisdiction requires a specific transfer basis, we rely on the providers' standard safeguards.
8. Your rights
You may request access to, correction of, or deletion of data held about your email or keys (deletion is subject to legal retention of payment records). Where your local law — for example the GDPR — grants further rights (restriction, objection, portability, or a complaint to a supervisory authority), you may exercise those too.
To make a request, contact shinkuan@shinkuan.me. A key's last 4 characters help us locate it, but are not sufficient on their own: before fulfilling a request we may require proof of possession of the full key, or verification through the purchase email or payment transaction.