Privacy Policy

1. Introduction

Mythea Ltd ("we", "us", "our"), company number 13332159, registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, operates the Mythea online game and the mythea.com website and its subdomains.

Mythea Ltd is the Data Controller for the purposes of the UK GDPR and EU GDPR. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.

Mythea Ltd is registered with the Information Commissioner's Office (ICO). Our registration is currently being processed and we will update this notice with our registration number once issued.

If you have questions, contact us at contact@mythea.com.

2. Information We Collect

We collect information you provide directly, including:

• ✦ Email address (for account creation and login)
• ✦ Username and display name
• ✦ Game activity data (actions, rankings, kingdom membership, chat messages)
• ✦ Player-content moderation reports (reported chat, private message, or forum post; sender; reason; and optional details)
• ✦ Account-level block preferences used to hide content and prevent private messages between blocked players
• ✦ Purchase information (processed by Stripe, Google Play, or the Apple App Store — we do not store card details)
• ✦ Communications you send to us

With your consent, we also collect technical and diagnostic data when you use the website or mobile app. This may include an app-instance identifier, approximate location derived from a masked IP address, device and operating-system information, app version, screens viewed, interaction events, purchase product and status information, performance timings, crash stack traces, and non-fatal error categories. We do not send account email addresses, player names, chat or message content, or purchase tokens to Google Analytics.

3. Legal Basis for Processing

Under UK GDPR and EU GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

• ✦ Contract performance — Processing your account data, game activity, and authentication is necessary to provide the Mythea service you signed up for.
• ✦ Legitimate interests — We analyse usage patterns to improve the game, maintain security, and prevent abuse. Our legitimate interest in running a safe, functional service is balanced against your privacy rights.
• ✦ Consent — Analytics, crash diagnostics, and performance monitoring are only activated with your explicit consent through our website consent controls or the mobile app setting. You may withdraw consent at any time.
• ✦ Legal obligation — We may process or retain data where required by law, including responding to lawful requests from authorities.

4. How We Use Your Information

The following uses are necessary to perform our contract with you or to operate the service:

• ✦ Provide and operate the Mythea game service
• ✦ Authenticate your account and maintain security
• ✦ Process in-game purchases via Stripe, Google Play, or the Apple App Store
• ✦ Send operational game notifications directly related to your account or gameplay (wars, rankings, age changes, account alerts)
• ✦ Respond to support requests and investigate reports
• ✦ Comply with legal obligations

The following uses are based on your consent, which you may withdraw at any time:

• ✦ Send the Mythea newsletter and devlogs — see Section 11 for how to unsubscribe
• ✦ Improve our service using aggregated usage, reliability, and performance information (only where you have consented)

5. Data Processors & Sharing

We do not sell your personal data. We use the following third-party processors who handle data on our behalf under appropriate data processing agreements:

• ✦ Google Firebase / Google Cloud — Authentication, hosting, database, real-time services, consented usage analytics, Crashlytics diagnostics, and performance monitoring. Data may be stored on servers in the United States.
• ✦ Google Analytics — Aggregated website and mobile-app usage analytics. Only activated with your consent. Advertising identifiers and ad personalisation are disabled in the Mythea mobile app.
• ✦ Google Play / Apple App Store — Mobile in-app purchase processing and purchase status reporting. We verify purchase tokens but do not send those tokens to Analytics.
• ✦ Stripe — Web payment processing for in-game purchases. Stripe processes payment data directly and is subject to its own privacy policy. We do not store card details.
• ✦ Facebook — A Facebook page plugin is optionally embedded in certain areas of the game. Facebook may process data if you interact with it.

We may also disclose data to law enforcement or regulatory authorities where legally required.

6. International Data Transfers

Some of our data processors, including Google (Firebase, Google Cloud, Google Analytics) and Stripe, operate in the United States. Transfers of personal data outside the UK and EEA are made under appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the relevant supervisory authorities. You can request details of these safeguards by contacting us.

7. Cookies

We use cookies for authentication, game preferences, and — with your consent — analytics. For full details of every cookie we use and how to manage your preferences, see our Cookie Policy.

8. Data Retention

We retain different categories of data for different periods:

• ✦ Account data — retained while your account is active, then deleted within 90 days of an account deletion request
• ✦ Game activity and rankings — retained for the duration of the age and summarised in historical records thereafter
• ✦ Analytics and diagnostic data — retained only for the configured service retention period and deleted or aggregated when no longer required
• ✦ Support correspondence — retained for 2 years
• ✦ Player-content moderation reports — retained while under review and for up to 2 years after resolution for safety and repeat-abuse prevention
• ✦ Account-level block preferences — retained until you unblock the player or your account is deleted
• ✦ Financial records — retained for 7 years as required by UK tax law

9. Your Rights

Under UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

• ✦ Right of access — Request a copy of the personal data we hold about you.
• ✦ Right to rectification — Request correction of inaccurate or incomplete data.
• ✦ Right to erasure — Request deletion of your personal data, subject to legal retention requirements.
• ✦ Right to restriction — Request that we limit how we process your data in certain circumstances.
• ✦ Right to data portability — Request your data in a structured, machine-readable format.
• ✦ Right to object — Object to processing based on legitimate interests, including direct marketing.
• ✦ Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time via our website cookie settings or the “Share anonymous analytics and diagnostics” setting in the mobile app.
• ✦ Rights related to automated decisions — We do not make automated decisions with legal or significant effects about you.

To exercise any of these rights, contact us at contact@mythea.com. We will respond within 30 days.

10. Right to Complain

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• ✦Website: ico.org.uk
• ✦Phone: 0303 123 1113

If you are based in the EU, you may also contact your local supervisory authority.

11. Marketing Communications

We send a newsletter and occasional devlog updates to players who have opted in. Under the UK Privacy and Electronic Communications Regulations (PECR), we only send marketing emails to individuals who have given prior consent.

The legal basis for processing your email address for marketing purposes is consent (UK GDPR Article 6(1)(a)). You can withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us at contact@mythea.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We do not send marketing emails to players under 13, and we do not sell or share your email address with third parties for their own marketing purposes.

12. Minimum Age

Mythea is intended for players aged 13 or older. We do not knowingly collect personal data from children under 13. If you are under 13, please do not create an account or provide any personal information.

If you are between 13 and 15 years old and based in the EU or UK, you should have parental or guardian consent before creating an account, as the minimum age for data processing consent under UK GDPR and EU GDPR is 16 in most member states (13 in the UK).

If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will delete that data promptly. To report an underage account, contact us at contact@mythea.com.

13. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights regarding your personal information.

We do not sell your personal information. We do share certain data with service providers (Google, Stripe, Firebase) for the purposes described in this policy. Under CCPA, this sharing may constitute "sharing" for cross-context behavioural advertising in respect of analytics data, which you have the right to opt out of.

As a California resident you have the right to:

• ✦ Know what personal information we collect, use, disclose, and share
• ✦ Delete personal information we hold about you (subject to certain exceptions)
• ✦ Correct inaccurate personal information
• ✦ Opt out of the sharing of your personal information for cross-context behavioural advertising
• ✦ Non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at contact@mythea.com. We will respond within 45 days as required by CCPA. To opt out of analytics data sharing, decline analytics cookies via our cookie settings or disable anonymous analytics and diagnostics in the mobile app's Account screen.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised date. Continued use of the service after changes constitutes acceptance of the updated policy.