Mythfate

Privacy Policy

Last updated: October 1, 2026

Plain-language summary

We collect the minimum needed for you to play: a user ID, your summoner name and — only if you choose to — your email.
Match data (which cards you play, how long they last, how they end) is only collected if you turn it on, and by default carries no name, email or account. Switch it off anytime in Settings.
No third-party analytics or advertising SDKs. No ads. We never sell your data or share it with third parties for their own purposes.
You can play as a guest without providing any personal data.
You can delete your account and all its data from the game itself, or request it through the contact form on the website.
The game database is located in the European Union (Ireland).

1. Who is responsible

The data controller is Manuel Villanueva ("the developer", "we"), developer of the video game Mythfate and of the website www.mythfate.com.

Privacy contact: soporte@mythfate.com or the form at www.mythfate.com/en/contact.html.

This policy covers both the game (iOS and Android) and that website.

2. What data we collect

Data	Required?	When it is collected
User identifier (technical ID generated by Supabase Auth)	Yes — without it your progress cannot be saved.	Created the first time you open the game, including in guest mode.
Summoner name	Yes — you type it when you create your character and other players can see it.	It can be a nickname; it does not need to be your real name, and we never take it from your Google or Apple account.
Email	No — guest mode does not ask for it.	Only if you sign up with email or sign in with Google or Apple. If you choose to hide your email with Apple, we receive an Apple relay address, not your real one.
Sign in with Google or Apple	No.	Besides the email, we receive your account identifier on that platform, used to recognise you when you come back. We do not ask for your name or photo. Google always includes them in its response, but we discard them at sign-in and do not store them.
Avatar	Yes — you pick one of the avatars unlocked inside the game.	No photos are uploaded.
Character (how you want the game to address you and your birth month)	Yes — both chosen when you create your character.	If you prefer not to say how you want us to address you, one of the options is assigned at random; it only affects the game texts and your portrait, nobody else sees it and we do not use it for anything else. The month is used to give you a gift that month; we ask for the month ONLY, never the day or the year, so we cannot work out your age, and it is not used for age checks.
Game data (card collection, decks, in-game currencies —gold, gems, arcane dust—, level and XP, rank, match and pack-opening history, and in-game purchase and transaction history)	Yes.	This is your game state and is stored linked to your ID while you play.
Match telemetry (mode, duration, how the match ended, and which cards and abilities were played)	No — the game works the same without it.	Only if you turn it on. We ask you when you start, in two independent levels: basic telemetry is stored without your identifier, your name or your email, without linking it to your account and with the date only, not the time; in online matches, not with your opponent's data either. We do not use it to identify you, but because your deck and your moves could match data the game keeps in order to work, legally it is pseudonymous data, not anonymous. Linking it to your account adds your identifier so we can look into your case if you report a bug. Without the basic level we store none of your matches. Change it anytime in Settings > Account.
Support and reports (your email if you write to us by email or through the website form, your summoner name if you give it to us, the message content and any screenshots you choose to attach)	No.	Only if you write to us. Tickets you open from the game are linked to your account so we can reply in your in-game inbox. If you report another player, we store who you reported, the reason and their name at that moment.
Blocked players: the list of players you block, to stop them sending you requests or challenges.	No.	Only you can see it and it is deleted with your account.
Ratings (whether you like the game and, if you want, why not; and the score you give at the end of a match)	No.	Only if you answer. They are linked to your account so we can follow up on a complaint, but they are never shown to other players.
Achievements	No.	If you are signed in to Google Play Games (Android) or Game Center (iOS), we report the achievements you unlock so they appear on your profile on that platform.
Surveys (your answers and, separately, whether you have completed each survey)	No.	Only if you answer. Answers are stored WITHOUT your identifier, your name or your email, apart from the record of who completed each survey, and with the day only, no time, so we cannot tell what any person answered. That record is used only to avoid asking you again and to deliver any gift that comes with the survey, which is given for completing it and never depends on what you answer. Do not write personal details in free-text answers.
Push notifications (your device notification identifier, operating system and device language)	No.	Only if you turn them on. That identifier is issued by your phone's notification system (Google's Firebase Cloud Messaging on Android, Apple's APNs on iOS) and is the only thing that lets a notice reach your device; it does not tell us who you are or what you do outside the game. It is deleted when you turn notifications off or delete your account; if you uninstall the app it stops being valid and we delete it as soon as the notification system tells us so. You can choose which notices you want, and the hours when you want none, in Settings > Notifications.

What we DO NOT collect: location, contacts, advertising identifiers, card or bank account details (payments, when enabled, are processed entirely by Apple or Google), browsing history, microphone or any other device data. The game integrates no analytics, advertising or cross-app tracking SDKs: the only third-party components are the push notification delivery described above (optional, and never used for analytics or profiling), Google or Apple sign-in if you choose it, Google Play Games or Game Center achievements if you are signed in to them, and Cloudflare's anti-bot check when you create your account, sign in or register. Telemetry is our own, not a third party's, and is also optional.

3. Why we use your data, and on what legal basis

Providing the service (creating your account, saving your collection and progress, matchmaking in online games, syncing across devices): performance of the contract (art. 6.1.b GDPR).
Security and fraud prevention (server-side validation of matches and transactions, anti-cheat and anti-abuse protection): legitimate interest (art. 6.1.f GDPR).
Purchase management (recording in-game transactions and, where real-money payments exist, meeting the associated legal and tax obligations): performance of the contract and legal obligation (art. 6.1.c GDPR). While the game is in early access, real-money purchases are disabled.
Player profile (summoner name, avatar and how you want us to address you): performance of the contract, because they are part of your character in the game. You can change the name and the avatar from your profile.
Match telemetry (balancing cards, finding broken combinations and fixing bugs): your consent (art. 6.1.a GDPR), revocable at any time in Settings and without losing access to anything in the game.
Push notifications (telling you it is your turn, that your pack is ready or that the season is ending): your consent (art. 6.1.a GDPR), given when you allow them on your phone and withdrawable at any time, notice by notice, in Settings > Notifications or from your system settings. We send no advertising or purchase promotions through this channel.
User support (answering your messages and requests, including password recovery and account deletion requested from the website): performance of the contract, legitimate interest and, for rights requests, legal obligation.
AI-controlled opponents (deciding the opponent's moves and its name): performance of the contract. We only send the AI game data: the state of the match (cards, points and turn) or, in Forge Mode, the cards in your collection; never your name, your email or your identifier.
Translating your support messages (if you write to us in a language other than Spanish, so we can understand you): legitimate interest. Only the text of the message is sent to the AI, without your name, your email or your identifier.
Ratings (learning what players like and dislike in order to improve the game): your consent (art. 6.1.a GDPR), given when you answer.
Blocks and reports between players (protecting you from other players and moderating the game): performance of the contract and legitimate interest.
Anti-bot protection (when you create your account, including a guest account, sign in, register and on the website form): legitimate interest in preventing abuse and automated sign-ups.
Surveys (learning what players think in order to decide how to improve the game): your consent (art. 6.1.a GDPR), given when you send the survey. The record of whether you have completed it relies on our legitimate interest in not asking you again and in delivering its gift.

We do not use your data for advertising and we build no commercial profiles. We make no automated decisions with legal effects on you.

4. Who we share it with

We do not sell your data or share it with third parties for their own purposes. To operate, the game relies on these providers (data processors):

Supabase: database, authentication, storage (support screenshots) and real-time match communication. Data is hosted in Ireland (European Union) and always travels encrypted (HTTPS/WSS).
Google: "Sign in with Google", only if you choose it (it gives us your email); Firebase Cloud Messaging if you enable push notifications on Android; Google Play as the distribution platform on Android; the Gemini API, which decides the moves of AI-controlled opponents, suggests decks in Forge Mode and translates support messages, always without data that identifies you; Google Play Games, for achievements on Android; and Firebase, which hosts our own newsletter tool.
Apple: the App Store as the distribution platform on iOS, "Sign in with Apple", the APNs notification service if you enable push notifications on iOS, and Game Center, for achievements on iOS.
Cloudflare: Turnstile, the anti-bot check when you create your account, sign in, register and on the website form. It processes your IP address and technical signals from your browser or device, only to tell people apart from bots.
Umami: the cookie-free analytics on the website, described in section 10.
Vadavo: hosting of the website www.mythfate.com, in Spain.

In-app purchases are processed entirely through Apple or Google: we never see or store your card details. While the game is in early access, real-money purchases are disabled.

We may disclose data to authorities where a legal obligation requires it.

5. International transfers

The game database is located in the European Union (Ireland). Even so, several of our providers are United States companies (Supabase, Google, Apple and Cloudflare) and may access or process data from outside the European Economic Area, for example to give us technical support.

Where that happens, the transfer relies on the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) if the provider participates in it, or on the standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards through the contact channels.

6. How long we keep your data

Your account and game data are kept for as long as the account exists.
If you request deletion, we delete the account and all associated data, including your support tickets and their screenshots; any request you sent us through the website form is kept separately, for the period in the next point. From the game you can delete it instantly or schedule it for 30 days later; from the website we do it as soon as we confirm the account is yours, and within one month of your request at most. Backups, where your data may persist for a few days, are overwritten within 30 days at most.
Requests sent through the website form are kept for 2 years after they are closed, so that we can prove we handled them, and are then deleted.
The newsletter list keeps your email until you unsubscribe.
Your list of blocked players and your ratings are kept while your account exists and are deleted with it. Reports are support tickets and follow the same rule.
Survey answers, being anonymous, are kept for as long as they remain useful for analysis. The record of which surveys you have completed is deleted with your account.
Records of real-money purchases, once enabled, are kept for up to 6 years, as required by Spanish commercial and tax law, even if you request account deletion. During that time they are only used to meet those obligations.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time through the form at www.mythfate.com/en/contact.html or by writing to soporte@mythfate.com. We reply within one month at most.

To delete your account and all your data: you can do it from the game itself (Settings > Delete Account), or request it through the website form (www.mythfate.com/en/contact.html, option "Delete my account") or by email. In these last two cases, before deleting it we will write to the address associated with the account to confirm it is yours. If you play as a guest (no email), tell us your summoner name so we can find the account, and we will ask you for details only the person using it would know (for example, your House, your level or cards in your collection) to confirm it is yours.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of the EU country where you live: for example, the CNIL in France (www.cnil.fr) or, in Germany, the data protection authority of your federal state.

8. Security

All data is encrypted in transit (HTTPS/WSS). Passwords are stored as secure hashes managed by Supabase Auth, never in plain text. Data access is restricted through row-level security rules, and sensitive game operations (matches, rewards, transactions) are validated server-side.

9. Minors

Mythfate is aimed at players aged 16 and over and is not directed at children. We ask for 16 because it is the highest digital consent age set by any European Economic Area country (article 8 GDPR), so the consent you give us for telemetry and push notifications is valid wherever you live. We do not collect your date of birth —only the month, and only to give you a gift— so your age is a declaration you make. If we detect an account below that age, we will delete it.

10. The Mythfate website

The website www.mythfate.com uses no cookies at all. It only stores your language preference (mythos-lang) in your browser's local storage. Fonts are loaded from Google Fonts, which means your browser requests those files from Google's servers.

We do use cookieless audience analytics (Umami) to know how many visits each page gets and which buttons are clicked. It creates no persistent identifiers, does not track you across websites, builds no profiles, and the data is aggregated and anonymous — which is why, under article 22.2 of the Spanish LSSI and the AEPD guidelines on audience analytics, it needs no prior consent or cookie banner. If your browser sends the Do Not Track or Global Privacy Control signals, nothing about your visit is recorded.

If you sign up for the newsletter (on this website or when registering with email in the game) or for the game access list, we collect your email with your consent to manage your access and, if you expressly accept it, to send you game news. The newsletter is our own tool, hosted on Firebase (Google). You can unsubscribe at any time using the link included in every email or by writing to us.

If you use the contact form, we process your email, the type of request and what you write to reply to you and, if you ask, to delete your account. The form goes through Cloudflare Turnstile's anti-bot check; of your IP address we only store an irreversible summary (hash) to limit abusive submissions.

11. Changes to this policy

If this policy changes substantially, we will announce it in the game or on the website with reasonable notice and ask you to accept it again inside the game before you keep playing. The date of the latest version always appears in the header.

12. Contact

soporte@mythfate.com · www.mythfate.com/en/contact.html