Privacy Policy
1. Who is responsible
[NAME / COMPANY AND ADDRESS] is the controller of your personal data in Mesa. Contact: [CONTACT EMAIL].
2. What we collect, and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: name, email address and profile picture from your Google account | To sign you in and show who is at the table | Contract (art. 6.1 b) |
| Your content: decks, games, table state, camera set-up, which cards are where | To run the game and share it with the people you play with | Contract (art. 6.1 b) |
| Card images for AI help: a cropped image of a card (sometimes a photo of the table) when Mesa cannot name it on your device | To identify the card. The image is sent to our server and on to the AI service; we do not store the image | Contract (art. 6.1 b) |
| Usage events, linked to your account: for example that you created or joined a game, how many cards were played, when Mesa named a card and when you corrected it, how long it took, and how you rated the camera | To measure how well Mesa works and to find and fix problems. We do not use it for advertising | Legitimate interest (art. 6.1 f): improving a product we run. You can object, see section 7 |
| Technical data: basic request logs from our hosting, and a count of your questions to the AI service (to apply a monthly limit) | Security, stability and cost control | Legitimate interest (art. 6.1 f) |
Mesa does not use advertising or tracking cookies. Usage events are sent without your IP address being stored for analytics, and without an analytics cookie.
3. Who receives your data
We use these companies to run Mesa. Each handles data for us under a data processing agreement.
| Company | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Stockholm) |
| Vercel | Hosting and server functions | Global network |
| "Continue with Google" sign-in | Per Google's own terms | |
| Anthropic (Claude) | AI help to identify a card from a cropped image | USA |
| Mixpanel | Usage events and reports (section 2) | EU data residency |
Other players in your game see your name, the cards you play onto the table and your table state. They do not see your hand or your library.
We do not sell personal data.
4. Transfers outside the EU/EEA
Some of these companies are based in the USA or may handle data there. Where that happens it relies on the EU–US Data Privacy Framework or on the EU's standard contractual clauses.
5. How long we keep it
Your account, content and usage events are kept for as long as you have an account. When you ask us to delete your account, we delete your account and content and ask Mixpanel to delete your events. The count of AI questions is kept without any link to you. Images sent for AI help are not stored by us.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to move it to another service. Write to [CONTACT EMAIL]; we answer within one month.
7. Objecting to usage events
You can object to us recording usage events at any time, without giving a reason. Write to [CONTACT EMAIL] and we stop sending events for your account and delete the ones we have.
8. Complaints
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or to the data protection authority in the country where you live.
9. Age
Mesa is for people who are at least 16 years old, or who have a parent or guardian's permission.
10. Changes
If this policy changes in a way that matters, we change the version above and ask you to agree again the next time you open Mesa.