Privacy Policy
Last updated: August 16, 20261. Who is responsible
The data controller is Manuel Villanueva ("the developer", "we"), developer of the
video game Mythfate and of the website www.mythfate.com.
Privacy contact: soporte@mythfate.com.
This policy covers both the game (iOS and Android) and this website.
2. What data we collect
| Data | Required? | When it is collected |
|---|---|---|
| User identifier (technical ID generated by Supabase Auth) | Yes — without it your progress cannot be saved. It is created even in guest mode. | When you first open the game or create an account. |
| Display name (summoner name) | No — defaults to "Guest" or your email prefix; you may customise it. | If you edit it in your profile. |
| Email address | No — guest mode never asks for it. | Only if you sign up with email or sign in with Google. |
| Avatar | No — you pick one of the avatars unlocked inside the game; no photos are uploaded from your gallery. | If you sign in with Google or Apple, their profile may provide us the URL of the photo linked to that account. |
| Game data: card collection, decks, in-game currencies (gold, gems, arcane dust), level and XP, rank, match and pack-opening history, and the game's purchase and transaction history | Yes — this is your game state, stored linked to your ID. | While you play. |
| Match telemetry: mode, duration, how the match ended and which cards and abilities were played | No — the game works exactly the same without it. | Only if you turn it on. We ask when you start, in two independent levels: basic telemetry is stored without your identifier, your name or your email (there is no way to tell whose it is), and linking it to your account adds your identifier so we can look into your case if you report a bug. Without the basic level we store none of your matches, not even anonymously. Change it anytime in Settings > Account. |
| Support communications: your address and the content of your message | No. | Only if you write to us. |
What we do NOT collect: location, contacts, advertising identifiers, card or bank details (payments, when enabled, are processed entirely by Apple or Google), browsing history, microphone, or any other device data. The game embeds no third-party analytics, advertising or tracking SDKs: the only telemetry is the one described above, and it is optional.
3. Why we use your data, and on what legal basis
- Providing the service (creating your account, saving your collection and progress, matchmaking in online games, syncing across devices): performance of a contract (art. 6.1.b GDPR).
- Security and fraud prevention (server-side validation of matches and transactions, anti-cheat and anti-abuse protection): legitimate interest (art. 6.1.f GDPR).
- Purchase management (recording the game's transactions and, where real-money payments are involved, meeting the associated legal and tax obligations): performance of a contract and legal obligation (art. 6.1.c GDPR). Real-money purchases are disabled during the closed beta.
- Match telemetry (balancing cards, finding broken combos and fixing bugs): your consent (art. 6.1.a GDPR), revocable at any time from Settings and without losing access to anything in the game.
- Optional personalisation (display name and avatar): your consent (art. 6.1.a GDPR), revocable at any time by changing or removing that data.
- User support (answering your emails, including password recovery): performance of a contract and legitimate interest.
We do not use your data for advertising, we build no commercial profiles, and we make no automated decisions with legal effects on you.
4. Who we share it with
We do not sell your data or share it with third parties for their own purposes. To operate, the game relies on these providers (data processors):
- Supabase — database, authentication, avatar storage and real-time match communication. Data always travels encrypted (HTTPS/WSS).
- Google — only if you choose "Sign in with Google" (which provides us your email); and Google Play as the Android distribution platform.
- Apple — the App Store as the iOS distribution platform, and "Sign in with Apple".
In-app purchases are processed entirely by Apple or Google: we never see or store your card details. Real-money purchases are disabled during the closed beta.
We may disclose data to authorities where a legal obligation requires it.
5. International transfers
Our providers may process data on servers located outside the European Economic Area. Where that happens, the transfer is protected by safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or applicable adequacy frameworks.
6. How long we keep your data
- Your account and game data are kept for as long as the account exists.
- If you request deletion, we erase the account and all associated data; it may persist temporarily in backups, which rotate within a limited period.
- Support communications are kept for as long as needed to resolve your query and keep a reasonable record.
- Records of real-money purchases and transactions may be kept for the periods required by tax and consumer law, even if you request deletion of your account.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to soporte@mythfate.com.
To delete your account and all your data: you can do it from the game itself (Settings > Account > Delete account) or by sending an email from the address linked to your account with the subject "Account deletion". If you play as a guest (no email), tell us your summoner name so we can locate the account.
If you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.
8. Security
All data is encrypted in transit (HTTPS/WSS). Passwords are stored as secure hashes managed by Supabase Auth, never in plain text. Data access is restricted through row-level security rules, and sensitive game operations (matches, rewards, transactions) are validated server-side.
9. Minors
Mythfate is aimed at players aged 13 and over and is not directed at children. If you are under 14 (the digital consent age in Spain), you need your parents' or guardians' authorisation to use the game. In other European Economic Area countries that age may be higher (up to 16), and the age applicable in your country of residence will apply. If we detect an account belonging to a minor without such authorisation, we will delete it.
10. The Mythfate website
The website www.mythfate.com uses no cookies at all. It only stores your language preference
(mythos-lang) in your browser's local storage. Fonts are loaded from Google Fonts, which means
your browser requests those files from Google's servers.
We do use cookieless audience analytics (Umami) to know how many visits each page gets and which buttons are clicked. It creates no persistent identifiers, does not track you across websites, builds no profiles, and the data is aggregated and anonymous — which is why, under article 22.2 of the Spanish LSSI and the AEPD guidelines on audience analytics, it needs no prior consent or cookie banner. If your browser sends the Do Not Track or Global Privacy Control signals, nothing about your visit is recorded.
If you sign up on this website for the beta waiting list or the newsletter, we collect your email with your consent to manage your beta access and, if you expressly accept it, to send you game news. You can unsubscribe at any time using the link included in every email or by writing to us.
11. Changes to this policy
If this policy changes substantially, we will announce it in the game or on this website with reasonable notice and ask you to accept it again inside the game before you keep playing. The date of the latest version always appears in the header.