Privacy Policy

2. What we collect, and why

We collect only what the game needs to run. In full:

• Account details: your email address, your display name, and whether your email is verified. Why: to create and secure your account, to verify it is yours, and to contact you about it. Basis: performance of our contract with you.
• Password: stored only as a salted hash by our authentication library. We never see or store your actual password. Why: to log you in. Basis: contract.
• Session data: a session token, its expiry, and the IP address and browser user-agent recorded when you sign in. Why: to keep you signed in, and to detect and investigate abuse and account compromise. Basis: contract, and our legitimate interest in keeping the game secure.
• Game data: your character, level, stats, inventory, currency, location, guild, quest progress, market listings, duel history, and similar. Why: this is the game. Basis: contract.
• Things you write: chat messages, character and guild names, profile text, mail to other players, and messages you send us through the contact form or support. Why: to deliver them, and to moderate. Basis: contract, and our legitimate interest in a safe community.
• Moderation records: reports you make or that are made about you, mutes, suspensions, bans and the reason for them. Why: to enforce the Rules consistently and to handle appeals. Basis: legitimate interest, and legal obligation where one applies.
• Purchase records: what you bought, when, the amount, and the payment provider’s reference. We never receive or store your full card number. Why: to deliver what you bought, to support you, and to keep required financial records. Basis: contract, and legal obligation for tax and accounting.
• Consent record: the fact that you accepted these documents, which version of each, and when. Why: to be able to show what you agreed to. Basis: legal obligation and legitimate interest.
• Anti-bot signals: a token from Cloudflare Turnstile when you sign up or use the contact form, and your IP address for rate limiting. Why: to keep bots and spam out. Basis: legitimate interest.

We do not run advertising or analytics trackers. There is no Google Analytics, no advertising pixel, and no third-party behavioural tracking on this site. We do not sell or rent personal data to anyone, and we do not profile you for advertising.

3. Cookies

We use a small number of strictly necessary cookies: a session cookie that keeps you signed in, and cookies set by Cloudflare Turnstile to tell humans from bots. These are required for the site to work and are not used to track you across other websites.

We set no advertising, analytics, or profiling cookies.

4. Who we share it with

We share personal data only with the service providers we need to run the game, each acting as our processor under contract:

• Stripe: payment processing. They handle card details; we do not.
• Resend: sending transactional email (verification, account notices).
• Cloudflare: Turnstile bot protection.
• Our hosting and database provider: to run the servers the game lives on.

We may also disclose data where we are legally required to, or where it is necessary to investigate fraud or abuse, to protect someone’s safety, or to establish or defend a legal claim. If the game is ever sold or merged, data may transfer with it; this policy continues to apply until you are told otherwise.

Other players see your character name, level, class, guild, titles, leaderboard standing, market listings and anything you post in chat or on your profile. Treat that as public. They never see your email address.

5. International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the EEA or the UK, we rely on the transfer mechanisms those providers offer. These are normally the European Commission’s Standard Contractual Clauses together with the UK Addendum, or an adequacy decision where one applies.

6. How long we keep it

• Account and game data: while your account is open. If you close it, we delete or anonymise your personal data within 30 days, except where a line below applies.
• Chat and mail: kept for a limited period so moderation and appeals can look at context, then deleted.
• Moderation and ban records: kept after account closure where needed to enforce a ban, since a ban you can erase by deleting your account is not a ban.
• Purchase and consent records: kept for as long as tax, accounting, and limitation periods require, typically six to seven years.

7. Your rights

Depending on where you live, you have some or all of these rights:

• to access a copy of the personal data we hold about you;
• to have inaccurate data corrected;
• to have your data deleted;
• to restrict or object to processing based on legitimate interests;
• to receive your data in a portable format;
• to withdraw consent where we relied on it, without affecting past processing; and
• to complain to your data protection authority.

If you are in the EEA or the UK, those are the GDPR/UK GDPR rights and your supervisory authority is the one for your country. If you are a California resident, you additionally have the rights to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these, email support@mythenia.com from the address on your account. We respond within one month.

8. Children

Mythenia is not for children under 13, and we do not knowingly collect personal data from them. In the EEA and the UK, a user below their country’s age of digital consent, which is 16 unless their country has set it lower, needs a parent or guardian’s permission, as the Terms explain.

If you are a parent or guardian and believe your child has given us personal data, write to support@mythenia.com and we will delete the account and its data.

9. Security

Passwords are stored only as salted hashes, traffic is served over HTTPS, payment card details never reach our servers, and access to the production database is restricted. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the relevant authority as the law requires.

10. Changes to this policy

If we change this policy we will bump the version and, for a material change, tell you in the game or by email before it takes effect. The version and effective date at the top always say which policy is current.