What this is

This Privacy Policy describes how Ages of Myth ("we", "us", "the game") collects, uses, stores, and discloses information when you use the Ages of Myth mobile application and related services (the "Service"). It also describes your rights and how to exercise them. If anything here is unclear, contact us at privacy@agesofmyth.com.

Who we are

Ages of Myth is operated by an independent developer. We act as the data controller for the personal information described below. Operational hosting is in the European Union (Frankfurt, Germany); see "Where data is stored".

Information we collect

We only collect what we need to run the game and provide your account. Specifically:

Account identity. An email address (or a synthetic guest identifier), a display name you choose, and a password — stored only as a one-way bcrypt hash, never in plain text. You can sign in with Apple or Google instead of a password; in that case we receive only the provider's stable subject identifier (the OIDC sub claim) plus the email the provider releases to us. We never see your Apple or Google password.
Gameplay data. Cards in your collection, decks you have built, completed match results (outcome, score, anonymized opponent reference, the deterministic seed used for the match), per-season rating and rank, lifetime peak rating, clan membership history, weekly clan-war contributions, and in-game mail ("inbox") messages we deliver to you.
Purchase records. When you buy a card pack or other in-app purchase, we record the purchase via our merchant-of-record (RevenueCat) and store an internal entitlement row — pack identifier, transaction identifier from the store, event type. We do NOT see or store your payment card, Apple ID password, or full billing address. Refunds, taxes, and chargebacks are handled by the store (Apple App Store or Google Play) and RevenueCat.
Security and abuse data. When you reset your password, we store a one-hour, single-use hashed token. We rate-limit endpoints by IP and/or account; the resulting counters live in volatile memory (Redis) and are not used to profile you.
Diagnostic telemetry. When the app or server encounters an error, an error report is sent to our error-monitoring vendor (Sentry). Reports include device model, OS version, app version, the stack trace, and — when relevant — an opaque user identifier so we can correlate a crash with a single affected account. Reports do not include card lists, deck contents, message bodies, or payment data.
Product analytics. We send anonymized usage events to our product-analytics vendor (PostHog, EU region) to understand how the game is used and to ship features incrementally via feature flags. Events include the event name, an opaque user identifier, and gameplay properties (for example, which lobby tile was tapped or whether a match ended in a win). Events do not include your display name, message content, or email address. From your connection's IP address, PostHog derives an approximate location (country or region) for analytics and then discards the raw IP address, which is not stored with the event.
Advertising attribution. To measure whether our advertising reaches new players, the app sends a small number of basic events (such as app install, app open, and — where applicable — a purchase event) to advertising-measurement providers (Meta and Singular). These events are used only for aggregate ad-campaign measurement and do not include your display name, email, message content, card lists, or deck contents. We do not use the iOS advertising identifier (IDFA), do not present an App Tracking Transparency (ATT) prompt, and do not use the Android advertising ID (GAID) — on iOS, attribution is performed through Apple's privacy-preserving SKAdNetwork framework, and on Android the advertising ID is stripped from the build.
Push-notification tokens. If you grant the app permission to send push notifications, your device registers a push token with Google's Firebase Cloud Messaging (FCM) service, and we store that token on our server so we can deliver notifications (in-game mail, clan events, match-related alerts). The token identifies the device to Google, not to us; we hand the token plus the notification text (title + body + a small deep-link payload) to FCM and FCM relays the message to your device. We do not send message content beyond what you would see in the notification itself, and you can revoke push permission at any time from your device's system settings, which causes the server to mark the token revoked on the next delivery attempt.
Server logs. Our server records request paths, response status, timing, and the truncated IP of the request, for operations and abuse-prevention. Logs are retained for up to 30 days and then deleted.

We do not collect contact lists, photos, microphone audio, precise location, or advertising identifiers (we use neither the iOS IDFA nor the Android advertising ID). Aside from the basic ad-measurement events described above, we do not collect third-party advertising data, and we do not build advertising profiles about you. We do not use cookies (the app is a native client, not a web client). We do not sell or rent your personal information to anyone.

How we use it

To create and run your account, including sign-in and password reset.
To save your collection, decks, ratings, season history, mail, and clan progress so they are available across devices.
To match you with opponents, run matches, and compute rating changes.
To verify in-app purchases and grant the corresponding card packs.
To send password-reset and (where applicable) account-related emails.
To detect and prevent abuse, cheating, fraud, and unauthorized access.
To debug crashes and errors and improve reliability of the Service.
To comply with legal obligations.

Our legal bases (where the GDPR applies) are: performance of a contract for account, matchmaking, purchases, and gameplay data; legitimate interests for security, abuse prevention, crash diagnostics, and aggregate advertising measurement; and consent where we explicitly ask for it (for example, push-notification permission when we add it).

Third parties we share data with

We use a small number of trusted service providers ("processors") to operate the game. Each is bound by a data-processing agreement and only acts on our instructions.

Apple Sign In with Apple — identity provider, when you choose Apple to sign in.
Google Sign-In — identity provider, when you choose Google to sign in.
Apple App Store / Google Play — purchase processing, store-side receipt validation.
RevenueCat — purchase entitlement and webhook verification (USA).
Sentry — error monitoring (USA / EU regions, depending on routing).
PostHog — product analytics and feature-flag platform (EU region). Receives event identifiers and gameplay properties; does not receive display name, message content, or email.
Meta — advertising-campaign measurement (USA). Receives basic app events (install, open, and purchase events) for aggregate ad measurement; does not receive your display name, email, or message content.
Singular — mobile install-attribution measurement (USA). Receives install and basic app events for aggregate ad-campaign attribution; on iOS via Apple's SKAdNetwork. Does not receive your display name, email, or message content.
Google Firebase Cloud Messaging (FCM) — push-notification delivery (Google, global). Receives the device push token plus the notification text we hand it (title + body + small deep-link payload); does not receive your display name, email, or message content beyond what is shown in the notification itself.
Resend — transactional email (password reset, account email).
DigitalOcean — server and managed database hosting (Frankfurt, Germany).
Cloudflare — domain name resolution (DNS).

We may also disclose information when required by law, valid legal process, or to protect the rights, property, or safety of our players or the Service.

Where data is stored

The primary database and game server are located in Frankfurt, Germany (DigitalOcean fra1 region). Some processors (notably RevenueCat, Sentry, Meta, and Singular) operate in the United States; in those cases the relevant processor relies on Standard Contractual Clauses or equivalent safeguards under applicable EU data-protection law.

How long we keep it

Account data — until you delete your account (see "Your rights" below).
Match results — retained indefinitely for ladder integrity and replay reconstruction. If you delete your account, your seat is anonymized but the match row survives so your opponents' history is intact.
Mail / inbox — soft-deleted on user action; we retain the row for audit and abuse review.
Password-reset tokens — invalidated after one hour or first use, whichever comes first.
Server access logs — up to 30 days.
Crash reports — retained per Sentry's default retention (typically 90 days).
Product-analytics events — retained per PostHog's default retention on their EU Cloud.
Advertising-attribution events — retained by Meta and Singular per their default retention for ad-measurement data.
Push-notification tokens — retained while the device remains registered; marked revoked the next time delivery fails with a token-invalid response from FCM, or immediately on sign-out / account deletion.
Purchase / entitlement records — retained as long as legally required for tax, refund, and chargeback handling.

Your rights

Depending on where you live, you may have the right to: access the personal information we hold about you, correct inaccurate information, delete your account and personal data, object to or restrict certain processing, receive a portable copy of your data, and lodge a complaint with a supervisory authority.

Specifically:

Delete your account. In-app, sign in and use the account-deletion option. This calls our server endpoint DELETE /auth/me, which removes your user record and cascades to your collection, decks, ratings, mail, clan membership, and any password-reset tokens. Match results survive as anonymized rows.
Access and portability. You can request a copy of the personal data we hold about you by writing to privacy@agesofmyth.com. We aim to respond within 30 days.
Correction. You can update your display name in-app at any time. For other corrections, contact privacy@agesofmyth.com.
EU/UK residents (GDPR). You may object to processing based on legitimate interests, restrict certain processing, or contact a supervisory authority in your country of residence.
California residents (CCPA/CPRA). We do not sell or share personal information for cross-context behavioural advertising. You may request access, deletion, and correction as described above. We do not discriminate against users who exercise their rights.

Children

Ages of Myth is not directed to children under 13 (or under 16 in jurisdictions that require it). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at privacy@agesofmyth.com and we will delete the account. The App Store and Google Play also enforce age-rating gates at install time.

Security

Passwords are stored as bcrypt hashes only. Authentication tokens are short-lived and signed. All traffic between the app and the server is encrypted in transit using TLS. The database is hosted on managed infrastructure with provider-side encryption at rest. No system is perfectly secure; if we ever become aware of a breach affecting your personal data, we will notify affected users and, where required by law, the relevant supervisory authority without undue delay.

Changes to this policy

We may update this policy as the game evolves. Material changes will be communicated in-game (via the inbox or a sign-in notice) at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the latest version. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

Contact

Questions, requests, or complaints about this policy or our handling of your personal information can be directed to privacy@agesofmyth.com.