Last updated: October 11, 2026

Privacy Policy

This policy explains what personal data Masa (“we”, “us”) collects when you use the Masa apps for iPhone, Android and Mac, the web game at masa.io/play and this website (together, the “Services”), why we collect it, who processes it and how you can control or delete it. Masa is operated by BIVEX AI INC. (Delaware, United States), which runs masa.io and its web payments, together with its affiliate Bivex Teknoloji A.Ş. (Istanbul, Türkiye), which publishes the Masa apps on the App Store and Google Play.

What we collect

Account: your username, avatar and bio, the email address or phone number you sign in with, and your confirmation that you are 18 or older and accept the Terms. We never ask for your birth date; where your app store provides an age-range signal, we keep it. Guest accounts use an identifier created on your device instead.
Friends: your friends and friend requests, the players you follow or block, and the invites you send or accept. Masa never reads your phone’s contacts.
Messages and posts: direct messages, table chat, clips with their captions, comments and likes, and the reports you send.
Voice: voice-overs you record for clips and, only if you agree, your voice at a table for clips (see “Voice, video and clips”).
Gameplay: tables you join, moves and results, stats and achievements, Chips and Gems balances and history, gifts, predictions, rewards and your avatar’s items.
Purchases: what you bought, when and for how much. App Store and Google Play purchases are processed by Apple or Google and managed through Adapty; web purchases are processed by Stripe. We never receive your card details.
Device and identifiers: device model, operating system, app version, language and time zone; an identifier Masa creates for your installation; on iPhone, Apple’s identifier for vendors (IDFV); a push token if you turn on notifications; and your advertising identifier (the IDFA on iPhone, only if you allow tracking; the Android advertising ID, unless you delete it).
IP address and country: we and our partners receive your IP address and the country derived from it. We never use GPS or your precise location.
Usage and ads: what you watch, like, share and follow on Explore; app events such as sign-up, your first seat and your first finished game; how you use the store screens; and the rewarded ads you start, watch, click and finish.
Diagnostics: error and performance data when you export a clip, and anonymous performance data from the web game and the apps: device type and model, operating system and browser with their versions, screen size and graphics chip, your country, your connection type and a rough estimate of its speed, the screen and game you are in, frame rate, memory use, load times, the device’s heat level and power-saving mode, the app language, the battery level and free storage in broad ranges, display and accessibility settings such as text size and dark mode, where the app was installed from (an app store, a test version or elsewhere), and whether the game stopped unexpectedly. It is sent without your account and without any lasting identifier of you or your installation: with it we keep only a code that changes every day, calculated from your IP address and browser or app details, which lets us count the devices of that day and cannot be followed from one day to the next. We do not store your IP address itself with it, and we keep it for 90 days; after that only daily counts per device type remain (no code, no session), for up to 400 days. The apps (not the web game) also send crash and error reports to Firebase Crashlytics, a Google service: they include your Masa account ID, the device model, the operating system version and the screen and game you were in. The AppLovin ad SDK may also collect technical data such as performance, battery, network, storage and crash information.

Voice, video and clips

Live voice and video chat happens in real time and is not recorded. It runs on LiveKit software on our own servers and reaches only the players and spectators at your table, or the player in a one-to-one video call.

Your voice goes into clips only with your consent. When you sit at a public table, we ask whether your voice may be in clips (the box may already be ticked; you can untick it before you sit or at any time). While everyone with an open mic at that table has said yes, our server keeps the last 15 minutes of table voice in memory so a fun moment can become a clip. Table sound that no clip uses is deleted, usually within an hour and at the latest within a day. If a clip uses your voice, we tell you, and one tap removes it. You can turn this off at the table or in Settings › Clips & Explore.

Voice-overs you record in the clip editor are stored with your clip until you or we delete it. Your mic may also pick up people around you. We never use voices to identify anyone (no voiceprints).

How we use it

To run Masa: sign you in, seat you at tables, keep your progress, balances and friends, and deliver messages, clips and purchases.
To personalize: Explore orders clips by what you watch, like and follow and by the games you play most, and the game list follows what is popular in your country.
To keep Masa safe and fair: age and regional rules, fraud and cheat checks, reports, bans and abuse prevention.
To show rewarded ads and measure our marketing (see “Ads and tracking”).
To improve Masa: find bugs and measure performance.
To contact you: sign-in codes and account or security notices by email or SMS. We do not send marketing messages.

Ads and tracking

Rewarded videos: in the iPhone and Android apps you can choose to watch a video ad to earn in-game rewards such as Daily Rewards. The ads are served by AppLovin MAX and the ad networks it works with. To serve, verify and measure ads and to prevent fraud, they receive your device and ad data, IP address and Masa user ID. The web game and the Mac app show no ads, and the Mac app uses no attribution and no tracking.

Attribution: Roasit measures which ad or link brought you to Masa and how our campaigns perform (install, sign-up, first table, first finished game, purchases and ad revenue). It receives your Masa user ID, device identifiers, IP address and country, and Apple’s ad attribution data (Apple Search Ads and SKAdNetwork).

iPhone: Masa asks once, with Apple’s App Tracking Transparency prompt, whether it may track you. Only if you allow it do AppLovin, Roasit and Adapty receive your IDFA, and only then may your data be linked with data from other companies’ apps and websites for advertising. Without it, no IDFA is used: Roasit still estimates which ad brought you to Masa from your IP address, Apple’s attribution data and the ad platforms’ own signals, and sends limited install and purchase events without your IDFA, marked as not allowing tracking, to the ad platforms where we advertise Masa (for example Meta), so they can measure campaigns in aggregate. You can change your answer at any time in Settings › Privacy & Security › Tracking. If you do not allow it, rewarded videos still work, without that tracking.

Android: our partners use the Android advertising ID. You can reset or delete it at any time in your phone’s settings (Settings › Google › Ads, or Settings › Privacy › Ads on some phones).

What other people see

Other players see your username, avatar, profile, game results and table chat and, when you turn them on, your voice and video. Clips you post can be seen on Explore, by your followers or by anyone with the link, as you choose.

Legal bases

Where the GDPR or similar laws apply, we rely on our contract with you (running the Services), our legitimate interests (safety, fraud prevention, improving Masa and measuring our own marketing), your consent (tracking with your advertising identifier, website analytics cookies in the EU / EEA, the UK and Switzerland, your voice in clips, the microphone and the camera) and legal obligations (such as tax records).

Retention and account deletion

We keep your data while your account is active, some of it for less: table chat for up to 7 days, unused table voice usually for less than an hour, clip-export diagnostics for 90 days, sign-in and security logs for 180 days and records of the codes we send for 13 months.

You can delete your account in the app (Settings › Account › Delete account) or by emailing info@bivex.com; step-by-step help is at masa.io/delete-account. Your account closes at once: you are signed out everywhere, your profile disappears, your phone number or email is unlinked, and your follows, clips with their voice, comments, likes, shared links, invite code and settings are deleted. 30 days later we permanently delete or anonymize the rest, such as your messages, friends and blocks, game history, sign-in and device records, IP addresses, country and avatar. Your username stays reserved for 30 days so nobody can pose as you.

We keep only what the law or fraud prevention requires, without your name or contact details: purchase records and the records of Chips, Gems and other in-game points, with the gifts, rewards, invite bonuses and predictions behind them (for refunds, chargebacks, tax and fraud checks), a one-way code (hash) of your phone number and device so welcome and invite bonuses cannot be claimed twice, and, if the account was banned, a record of the ban. Reports you sent, and reports about you, stay with our moderators without any link to your account. Games you played stay in other players’ histories under a neutral “deleted player” name. What our partners already received keeps that same protection (see “Who we share it with”), and they keep it only as long as their job for us and the law require.

Your rights and choices

Depending on where you live, you can access, correct, export or delete your data, object to or restrict some processing, and withdraw your consent at any time. In the app you can edit your profile, turn your voice in clips off, remove your voice from a clip, block players and delete your account; tracking is controlled in your phone’s settings (see “Ads and tracking”). For anything else, email info@bivex.com; we may ask you to confirm that the account is yours. You can also complain to your local data protection authority.

US state privacy rights

If you live in California or another US state with a privacy law, you can ask to know, access, correct and delete your personal data and opt out of its “sale” or “sharing” for targeted (cross-context behavioral) advertising. We do not sell personal data for money. But when you allow tracking on iPhone, or have not deleted your advertising ID on Android, we share identifiers, app and ad activity, purchase history and approximate location with AppLovin, Roasit and the ad platforms we work with for targeted advertising and ad measurement, which these laws may treat as “sharing” or a “sale”. To opt out, turn off tracking for Masa (iPhone) or delete your advertising ID (Android), and email info@bivex.com with the subject “Do not sell or share”. We will not treat you differently for using these rights.

Children

Masa is intended only for adults aged 18 and over (21+ where required). We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.

Security and international transfers

We protect your data with encryption in transit, access controls and regular reviews. Our servers and partners may be located in countries other than yours; where required, we use appropriate safeguards such as standard contractual clauses.

Cookies and similar technologies

This website uses Google Analytics to count visits and see which pages and games people look at. It sets first-party cookies kept for up to 13 months, with advertising features and Google signals turned off. In the EU / EEA, the UK and Switzerland it sets them only after you allow it; elsewhere it runs unless you decline. You can change your choice at any time with “Cookie settings” at the bottom of every page, and a Global Privacy Control signal from your browser counts as a no. Cloudflare, which delivers the site, may set a cookie it needs for security. The web game uses your browser’s local storage to keep you signed in and to save an anonymous performance note (it is used only to see whether the game stopped unexpectedly and holds nothing that identifies you), and Roasit’s SDK stores an identifier and the campaign details of the link that brought you, to measure our marketing. The website itself keeps only your cookie choice and your language choice in your browser’s local storage.

Changes and contact

We will post updates on this page and, for significant changes, tell you in the app. Questions or requests? Email info@bivex.com.