Privacy policy
The short version: we collect nothing about you. There is no account, no sign-in, no analytics and no advertising. A game passes through our relay while it is being played, and the relay keeps none of it.
This policy is written so that each sentence can be checked against what the app does. If you find one that is not true, tell us at support@ralab.io and we will correct either the app or the sentence.
1. Who we are
RA Lab makes Mafia and runs this website. We are the data controller for anything described here. Contact: support@ralab.io.
2. What we collect
Nothing. The app has no account to create and no sign-in. It contains no analytics, no crash reporting and no advertising or tracking code. We hold no personal data about players. Two things come near it, and both are described below: the relay that carries a game while it is played (section 4.1), and an email you send us (section 7).
3. What the app keeps on your phone
- the name you play under, which you can change in Settings;
- the game in progress, so that closing the app does not lose it — the players, the state of the game, and, on the host’s phone, everyone’s roles. It is replaced by the next game;
- a note that this phone has used its free game: a random game number, when that game started and whether it ended. On iPhone it is kept in the Keychain on that phone only, so it outlives reinstalling the app. On Android it is kept in the app and in Google’s Block Store, which is backed up with your phone’s Google backup.
4. What leaves your phone, and why
This is the complete list.
4.1 The game, through our relay
The phones in a game talk through a relay of ours, run on Cloudflare. The host’s phone runs the game; the relay only passes messages between the phones in it.
- What passes through: the game’s code, a random number for each phone (new for each game), each player’s name, and what every player’s screen shows — who is playing, who is out, the votes and, once the game is over, everyone’s role.
- What only one player should see — their role, the Detective’s answer, the Mafia’s team, each player’s night picks and votes on their way to the host — is encrypted on the phones, for that one phone (X25519 and ChaCha20-Poly1305). The relay cannot read it.
- The relay stores nothing. A game exists only while a phone is connected to it, and its logs are switched off. Like any host, Cloudflare sees the IP address a phone connects from, under Cloudflare’s privacy policy.
4.2 Purchases
The day pass is bought through the App Store on iPhone and Google Play on Android, and it is their services that tell the app whether a pass is active. We receive no payment details and no personal data from Apple or Google about you. Their privacy policies cover it: Apple’s and Google’s.
4.3 Scanning the host’s QR code on Android
On Android, the code is read with Google’s ML Kit, on the phone. The camera picture never leaves the phone. Google says ML Kit sends it information about how the scanner itself performs and is used — such as the phone’s model and the app’s version — and nothing from the picture. On iPhone, the code is read by iOS and nothing is sent.
4.4 What you share yourself
When you share a game’s code or link, it leaves through your phone’s share sheet to the app or person you choose.
5. The narrator
The lines the host’s phone calls out are spoken by the phone’s own text-to-speech, on the phone.
6. Permissions the app asks for
- Camera — only to scan the host’s QR code when you join. Nothing is recorded or kept. You can type the code instead.
Declining it disables only scanning.
7. Email
If you write to support@ralab.io or feedback@ralab.io, we have your email address and what you wrote, for as long as it takes to deal with it and then for twelve months after the last message; after that it is deleted. The app’s Send Feedback and Contact Support open an email with the app’s and your phone’s system version filled in, which you can see and change before sending. Our mail is hosted by Google Workspace.
8. This website
ralab.io sets no cookies, runs no scripts and has no analytics. It is served by Cloudflare, which may keep standard server logs for security. We do not look at them.
9. Children
The app is not directed at children under 13, and we knowingly collect no data from anyone, of any age.
10. Your rights
Because we hold no data about you beyond any email you have sent, there is nothing on our side to access, correct, export or delete. What the app keeps is on your phone, and deleting the app removes it, apart from the free-game note described in section 3. If you have emailed us and would like that correspondence deleted, ask and we will delete it. Where a law such as the UK or EU GDPR applies to you: our lawful basis for relaying a game is that you asked to play it, and for keeping an email, our legitimate interest in answering it; your rights of access, correction, erasure, restriction, portability and objection are exercised by emailing us; and you can complain to your local data protection authority.
11. Changes
If the app ever starts doing something this policy does not describe, the policy will change first and the date at the top will move.