Privacy policy

The data controller is DevCake AB at hello@devcake.se. Use this address for privacy questions, account deletion and requests about your personal data.

When you register with email, we store your email address, display name and a password hash. We do not store your password in plain text.

If you ask to reset your password, we email a single-use link to your address. The link expires after an hour, and setting a new password signs you out on every device.

If you choose Discord sign-in, we receive account information from Discord, including your identifier, display name, email address, verification status and avatar when provided. We store the linked account information and authentication tokens needed for that sign-in method. Discord also processes data under its own Privacy policy.

Sign-in sessions include a session token, expiry time and technical information such as your IP address and browser information. We use these details to authenticate you and protect the service.

If you continue as a guest, we create a temporary account with a generated name such as "Guest 4821" and a placeholder email address. It holds the same game records as any account. If you then create an account, your guest runs, matches and gold move to it and the guest account is deleted. Signing out of a guest account ends access to it.

We store your run drafts, chosen god, decks, wins, losses, run status and relevant timestamps, along with your gold, daily run tokens, unlocked portraits and golden cards. To refill tokens at midnight where you are, we note which of four broad regions (the Americas, Europe and Africa, Asia, Oceania) your browser's time zone falls in when you start a run. Match records include player identifiers and display names, chosen gods, the result, number of turns, whether an AI opponent played and match times.

Your opponents can see your display name and the game information needed to play a match. The Roll of Honour publicly shows display names and run records. Do not use a display name that contains information you want to keep private.

Live match state and the combat log are held in server memory for the match and reconnection. We do not save a full combat-log replay archive in the database.

We process account details and game records to provide the game you request and perform our agreement with you. We process security information and operational logs for our legitimate interests in preventing abuse, investigating faults and keeping the service reliable.

Optional analytics relies on your permission, which you can withdraw at any time in Cookie settings. We may also retain or disclose information when necessary to meet a legal obligation. We do not sell your personal data or use account details for advertising.

Stripe processes payments for extra run tokens. We send Stripe your account identifier, email address and selected token pack so we can credit the correct account. You enter payment details on Stripe's checkout page. Mythos does not receive or store your full card details.

We keep the Stripe checkout identifier, account identifier, pack, token quantity, amount, currency and purchase and fulfillment times. We use this record to deliver tokens, prevent duplicate credits and help with payment questions. Stripe processes payment information under its Privacy policy.

Mythos uses essential first-party authentication cookies to keep you signed in, cache your session and secure the sign-in process. Sessions last up to 30 days, and the session cache lasts up to five minutes. Temporary sign-in cookies may also be used when connecting Discord.

Your browser stores your sound preference and your cookie and analytics choice in local storage. These preferences remain on that device until you change them or clear your browser data. If storage is blocked, your analytics choice applies only until the page reloads.

If you allow analytics, we keep a short local history of reported god choices and game results to avoid counting them twice. These identifiers stay on your device.

You can block or clear cookies and local storage in your browser. Blocking essential authentication cookies can prevent sign-in and play.

Analytics stays off until you choose Allow analytics. If enabled, we use Vercel Web Analytics to understand visits and improve Mythos. It does not use analytics cookies. Its reports can include page paths, referring sites, approximate location, browser, operating system, device type and visit times.

We also collect god choices and game outcomes to improve game balance, including both gods and whether the opponent was a player or a bot. We do not add account details, decks, run identifiers or match identifiers to analytics events. We remove query strings and URL fragments from page URLs, and exclude API and development routes.

Vercel describes its visitor identification as a hash derived from request information, with a visitor session discarded after 24 hours. This is separate from the retention of aggregated reports. Read Vercel's analytics privacy documentation for details.

Choose Essential only in Cookie settings to stop future analytics events. This does not remove statistics already collected. Your analytics choice is independent of accepting the terms or signing in.

We use Vercel to host the website and provide optional analytics, Railway to host the game server and PostgreSQL database, and Resend to deliver account emails such as password reset links. These providers process data needed to deliver and secure their services. Discord is involved only if you choose its sign-in option.

Providers may process data outside your country, including outside the European Economic Area. Where a transfer is subject to data protection restrictions, applicable safeguards, such as an adequacy decision or standard contractual clauses, are required. Contact us for information about the safeguards applicable to your data.

We may disclose data when required by law or when necessary to establish, exercise or defend legal claims.

We keep account and game records while your account is active and as needed to operate the game. Authentication sessions expire after their configured lifetime. Operational logs and backups follow the retention settings of the hosting services.

You can request deletion by email. We will remove or anonymise personal data unless we need to retain it for a legal obligation, security issue or legal claim. Some match records contain historical display names, which we will consider as part of a deletion request. Backup copies may remain until they expire under the backup schedule.

Subject to applicable law, you can request access to your personal data, correction, deletion, restriction of processing and a portable copy. You can object to processing based on legitimate interests and withdraw analytics permission without affecting the lawfulness of earlier processing.

Send requests to DevCake AB at hello@devcake.se. We may ask for information needed to verify that the account is yours. You can also complain to your local data protection authority. In Sweden, this is Integritetsskyddsmyndigheten, IMY.

Mythos is not intended for children who cannot lawfully use the service or provide any required permission under the law where they live. If you believe a child has provided personal data without the required permission, contact us.

We update this policy when our data practices change and show the latest date above. We will communicate material changes through the service and request new permission where required.