1. Who is responsible

1.1. The data controller for the Kōkasoku portal (kokasoku.com, the “Portal”) is the Administration:

• IE Leon Nikolaev (trading as “AI MAP”)
• Registered address: Republic of Armenia, Yerevan, Ajapnyak, Shinararneri St., Bldg. 7, Apt. 17, 0038
• Actual address: Yerevan, Sayat-Nova Ave. 40, Fabula Coworking
• Registration number: 271.1264997, dated September 19, 2022 · Tax ID: 28154419
• Registering authority: State Register of Legal Entities of the Republic of Armenia
• Email: mail@kokasoku.com

1.2. This Policy explains what personal data the Portal collects, why, on what legal basis, who it is shared with, how long it is kept, and what rights you have. Terms used here have the meaning given in the Terms of Service (kokasoku.com/terms).

2. What data we process and why

2.1. Public player data. The Portal aggregates information that players have made public on third-party platforms: names and nicknames, tournament results and placements, ratings and game statistics (Pantheon / Sigrun, amae-koromo, mahjong.click, Tenhou.net, European Mahjong Association). Purpose: providing the mahjong community with consolidated access to results and ratings. Legal basis: legitimate interest of the Administration (Art. 6(1)(f) GDPR).

2.2. Account data. When you register, we process your email address, name, and password (stored only as a cryptographic hash — we cannot see your password), the confirmation status of your email address, and the date of your last sign-in. If you sign in with Google, we receive from Google your Google account identifier, email address, and name; we do not receive your Google password and do not get access to your Google data beyond that. Purpose: creating and securing your Account, signing you in, sending you the emails described in 2.4. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.3. Profile data. In your profile you may provide your city, country, club, nicknames on game platforms (Mahjong Soul, Tenhou), your Pantheon and EMA identifiers, and a Telegram username. This data is provided voluntarily and is used to link your Account with your public player record and to show it in the profile. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw by removing the data from your profile.

2.4. Tournament registration. When you register for a tournament, we process the name, city, phone number, email address, Telegram username and other contact details you enter. Purpose: organising the event and contacting you about it. This data is available to the organisers of that tournament and to the Administration. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.5. Service emails. We send emails only when your action requires it: confirming your email address at registration, resetting a password. We do not send newsletters.

2.6. Technical data. Our servers log the IP address, browser type, requested page and time of each request, and we keep records of failed sign-in attempts. Purpose: keeping the Portal running and secure, preventing abuse and automated registrations. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

2.7. Cookies. The Portal uses strictly necessary cookies: a session cookie (kokasoku_token) that keeps you signed in for 7 days, cookies that remember your language and theme choice, and a short-lived cookie used during sign-in with Google. The scoring trainer stores your settings and statistics in your browser’s local storage. These do not require consent. Analytics cookies are described in section 3.

3. Analytics

3.1. The Portal uses Google Analytics (Google Ireland Ltd.) and Yandex Metrica (Yandex LLC) to understand how the site is used: which pages are visited, from which countries, on which devices. These services set their own cookies and process your IP address and browser data under their own privacy policies. We use only aggregated statistics and do not link them to your Account.

3.2. You can prevent analytics by blocking third-party cookies or scripts in your browser, or by using the opt-out tools the providers offer.

4. Who receives your data

4.1. We do not sell personal data and do not use it for advertising. Data is shared only with the following categories of recipients, and only as far as necessary:

• Hosting: DigitalOcean, LLC — the Portal and its database run on a server in Frankfurt, Germany (EU).
• Email delivery: Brevo (Sendinblue SAS, France, EU) — sends the service emails described in 2.5; receives your email address, name and the content of the email.
• Google LLC — when you sign in with Google; and as the provider of Google Analytics (section 3). Our mailbox mail@kokasoku.com is hosted on Google Workspace, so correspondence you send us is stored there.
• Yandex LLC — as the provider of Yandex Metrica (section 3).
• Tournament organisers — receive registration data for the tournaments they organise (2.4).
• Source platforms listed in 2.1 — we read public data from them; we do not send your data to them.

4.2. Some of these recipients are located outside the European Economic Area. Where data leaves the EEA, the transfer relies on the recipient’s standard contractual clauses or an equivalent safeguard.

5. How long we keep data

• Account and profile data — until you delete your Account or ask us to delete it.
• Accounts whose email address is never confirmed — may be deleted after 24 hours.
• Tournament registration data — for the duration of the tournament and up to 3 years afterwards for the tournament history, unless you ask for earlier removal.
• Email confirmation and password reset links — up to 7 days after they expire, then deleted.
• Server logs — up to 90 days.
• Public player data — for as long as it is public at the source and relevant to the rating; you may ask for your record to be removed at any time.

6. Your rights

6.1. You have the right to access the data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to receive the data you provided in a portable format, and to withdraw consent at any time where processing is based on consent.

6.2. To exercise any of these rights, write to mail@kokasoku.com. We reply within 30 (thirty) days. We may ask you to confirm your identity — usually by writing from the email address linked to your Account.

6.3. If you believe your rights have been violated, you may lodge a complaint with the Personal Data Protection Agency of the Republic of Armenia or with the supervisory authority of your country of residence.

7. Security

7.1. All connections to the Portal are encrypted (HTTPS). Passwords are stored only as bcrypt hashes; email confirmation and password reset links are single-use, time-limited, and stored only as hashes. Access to the server is restricted to the Administration and protected by key-based authentication.

8. Changes to this Policy

8.1. We may update this Policy. The current edition is always published at kokasoku.com/privacy with its effective date; material changes are announced on the Portal. Continued use of the Portal after a change means you accept the updated Policy.

8.2. Questions about this Policy: mail@kokasoku.com.