McMai Privacy Policy

Effective date: August 20, 2026
Last updated: August 20, 2026

This Privacy Policy explains how Chips Team ("Chips Team," "we," "us," or "our"), an independent project operator located in Mainland China, collects, uses, stores, protects, and deletes personal information in connection with McMai (the "Service").

The Service is available through mcmai.moev.cc, id.moev.cc, and supported social networking and messaging platforms linked from the McMai website.

McMai is a free, non-commercial, unofficial fan-made tool. It is not affiliated with, endorsed by, or sponsored by SEGA or any other game publisher, platform provider, music publisher, record label, artist, or rights holder.

1. Contact

• Operator: Chips Team
• Location: Mainland China
• Privacy, support, and data-rights contact: support@moev.cc

2. Scope

This Policy applies to personal information processed by Chips Team when you use McMai. Third-party platforms and services, including social networking platforms and game network services, process information under their own privacy policies and terms.

3. Information We Process

Depending on how you use the Service, we may process the following categories of information.

3.1 Platform and identity information

• Platform user identifiers, usernames, display names, profile images, and email addresses where made available by the relevant platform and authorized by you;
• QQ, LINE, Discord, or other supported platform identifiers;
• Group identifiers, friend relationships, and cross-platform account relationships;
• Language and platform preferences;
• Information required to authenticate your request or associate it with your McMai data.

3.2 Game account and player information

• SEGA ID, password, authentication cookies, tokens, and related login information that you submit for account binding;
• Aime card information and card-slot selections;
• Player names, ratings, scores, achievements, play history, rankings, friend codes, circles, titles, icons, nameplates, frames, and other game-related profile or performance information;
• Other information returned by a supported rhythm game network when McMai accesses your account on your behalf.

You must only submit credentials for an account that you are authorized to use. McMai transmits credentials to the relevant game network only when necessary to authenticate and retrieve data on your behalf.

3.3 User-submitted media and imported data

• Images submitted through supported social networking or messaging platforms for OCR or related processing;
• Uploaded webpage or HTML bundles used to import game data;
• Usernames and other profile information submitted for display or internal safety review.

McMai does not persistently store submitted screenshots. Screenshots are processed in memory by our self-hosted OCR service and are discarded when processing ends. OCR output is not retained. The social networking or messaging platform through which you submitted an image may retain its own copy under that platform's policies.

3.4 Operational and security information

• IP addresses, device and browser information, request times, requested pages or endpoints, and network metadata;
• Authentication, token issuance and revocation, error, rate-limiting, abuse-prevention, and security-event records;
• Service diagnostics and administrative security records.

4. How We Use Information

We process information only as necessary to:

• Authenticate users and bind accounts;
• Retrieve, store, analyze, synchronize, and display game data;
• Generate statistics, rankings, profile views, and other user-requested results;
• Process screenshots in memory using self-hosted OCR;
• Review submitted usernames through an internal automated safety-review system;
• Maintain service security, investigate abuse, enforce rate limits, and diagnose errors;
• Respond to support, privacy, security, and copyright requests;
• Comply with applicable legal obligations.

Submitting a username authorizes its use as input to McMai's internal automated safety review. Username-review information is not used for advertising or external model training and is retained for no more than seven days.

5. Public Information and Rankings

McMai profiles are public by default. Other users may query public player information, and eligible users may be included in public rankings. Public information may include usernames, profile elements, ratings, scores, and related game statistics.

McMai does not intentionally make public profiles available for search-engine indexing. However, we cannot guarantee that third parties will never copy or independently index information that has been made public.

You may use the available privacy settings to hide supported profile fields. Cross-platform account relationships and data synchronization may operate automatically where McMai identifies linked platform accounts.

6. Account Binding and Consent

Before initiating account binding, McMai displays the location of this Privacy Policy and the Terms of Service and explains that account credentials and related player data will be processed. Selecting or invoking the clearly labelled binding action constitutes your affirmative request for McMai to bind the account and your consent to the processing described in that notice and this Policy.

If you do not agree, do not initiate account binding or submit credentials.

7. Storage Locations and Service Providers

McMai's application servers and primary data storage are located in Mainland China and are operated on infrastructure controlled by Chips Team.

We use Cloudflare services, including DNS, CDN, R2, Workers, and Analytics, to provide network routing, static content delivery, availability, and security. Cloudflare may process necessary technical and network information, such as IP addresses, hostnames, request paths, routing information, and analytics data. McMai is configured so that application cookies, Authorization headers, account credentials, submitted images, and API request bodies are not made available to or stored by Cloudflare through these services.

Social networking and messaging platforms process messages and attachments that you send through those platforms under their own terms. The relevant game network processes authentication requests and game-account access initiated by McMai on your behalf.

We do not sell personal information or disclose it to third parties for advertising, profiling, or marketing. Except for the infrastructure and platform processing described above, McMai does not send personal information to external OCR, AI, analytics, advertising, or data-broker services.

8. Security

McMai uses technical and organizational safeguards designed to protect personal information, including:

• HTTPS/TLS encryption for network transmission;
• Database- and storage-level encryption for stored data;
• Additional AES-256-GCM application-layer encryption for SEGA IDs and passwords;
• Encryption keys stored separately from the database;
• Access controls that permit only the application to decrypt credentials when authentication is required;
• Key rotation and separately protected backup encryption keys;
• Controls intended to prevent credentials from appearing in application logs, error reports, or debugging output.

Administrators cannot directly view decrypted SEGA credentials through ordinary database or administration access. Credentials are decrypted only temporarily by the application when required to perform an authorized login.

No Internet service can guarantee absolute security. Please use a unique password for your game account and promptly unbind or delete your McMai data if you suspect unauthorized access.

9. Retention

We currently apply the following retention periods:

Category	Retention
Binding verification codes	Up to 10 minutes, or until successfully used
SEGA credentials	Until you unbind the account or delete your McMai data
Player profiles and scores	Until you delete your McMai data
Submitted screenshots	Not persistently stored; discarded when in-memory processing ends
OCR output	Not stored
Uploaded HTML bundles	Up to 7 days
Internal username-review information	Up to 7 days
Ordinary operational logs	Up to 7 days
Security-event records	Retained indefinitely where necessary to document abuse, protect the Service, or establish the handling of a security incident
Encrypted database backups	Maintained indefinitely as part of the Service's backup history, subject to synchronized deletion of account-linked data as described below
Cloudflare technical logs and analytics	May be retained indefinitely under the current Service configuration, subject to deletion or de-identification where the records can be linked to a deleted McMai account
Data-deletion request records	Not retained after completion

10. Deletion and Other Rights

You may use McMai's self-service deletion function to permanently delete your McMai account data. Deletion requires independent authentication and a second confirmation.

Once confirmed, McMai immediately deletes the account's primary user record, SEGA credentials, player profile, and scores. Account-linked data is also removed from active systems and synchronized backups. Where technical or security records must be retained to document abuse or protect the Service, we retain only the minimum information necessary and remove or de-identify account linkage where reasonably possible.

You may also contact support@moev.cc to request:

• Access to personal information held by McMai;
• Correction of inaccurate information;
• Deletion of your information;
• Withdrawal of consent for optional processing;
• Assistance with privacy settings or account unbinding.

Withdrawing consent does not affect processing that occurred before withdrawal. Some game data originates from third-party game networks; corrections to source data may need to be made with the relevant network operator.

11. Children

McMai is intended for users aged 12 or older. If you are under 14, you may use McMai only with the informed consent and supervision of your parent or legal guardian. A parent or guardian may contact support@moev.cc to request access to, correction of, or deletion of a child's information.

If we learn that information from a child under 14 was processed without the required guardian consent, we may suspend the account and delete the information.

12. Changes to This Policy

We may update this Policy when the Service, our data practices, or applicable requirements change. We will publish the updated version, effective date, and last-updated date on the McMai website. Material changes may also be announced through the Service.

The English version of this Policy is the authoritative version.

13. Contact

Questions, privacy requests, security reports, and complaints may be sent to support@moev.cc.