Mythbound: Battle Cards - Privacy & Online Services

Effective 18 September 2026. Operator: MutatedStudios.

Offline play

The campaign, inventory, settings and saved progress stay on your device. Save backups are created only when you choose Export, through your browser or Android document picker. This release does not include advertising, analytics SDKs, billing, location access or advertising-ID collection.

Automatic game-player identity

When the updated game starts, it automatically creates and saves a random game-specific player ID and a private ownership credential on this device, not a hardware identifier. The first signed campaign score creates the website player and score together; there is no separate Connect, registration, email or password step. The server stores a hash of that credential. It does not ask for your name, email address or website password to play. A generated Wayfarer alias is public; your local character name is not sent.

What is sent and displayed

Automatic campaign uploads are enabled by default. When the game starts with a network connection, it submits current leaderboard progress, including an existing save. Changed completed stages, rank and unlocked-card count are submitted automatically unless you turn automatic updates off or pause online uploads. Failed uploads are retained for retry. A previous explicit opt-out is preserved during upgrade. The service receives the profile ID, completed stage IDs, rank (capped for scoring), number of unlocked cards, platform, app version and a random submission identifier. The leaderboard displays the generated alias, journey score, player level, stages cleared and platform. The full save file is not uploaded. Reward-code requests send the code and profile credentials; redemption receipts and awarded items are stored to handle retries.

Optional multiplayer deck sharing

Multiplayer requires a separate opt-in. Publishing sends only your three selected card IDs, levels and their equipped item IDs, with your existing profile credentials. Other players can see and challenge that saved deck while you are offline; an AI controls the defender. Your whole collection and full save are not uploaded. The server stores deck snapshots, battle actions/results, ratings and match history. A public multiplayer leaderboard shows your generated alias, rating, deck tier, power and win/loss/draw totals. NPC opponents are clearly labelled and do not appear as players on the leaderboard.

Battle outcomes and rating updates are calculated by the server, but card ownership and levels originate in an offline save and cannot be independently verified. Multiplayer is a community feature, not a cheat-proof prize competition. Temporary road boosts and campaign consumables do not carry into these battles.

Use Withdraw defense deck in Multiplayer to stop new challenges. This does not erase ratings or already-started snapshots. Pausing online uploads alone does not unpublish a saved deck. Deleting the online profile also deletes its shared deck, matchmaking offers and battles involving the profile from the active database; offline progress remains. An unfinished multiplayer battle can be resumed for 24 hours; expiry counts as a loss. Expired offers and old completed battle details may be removed by maintenance after 90 days; aggregate results remain until profile deletion.

Network and security records

HTTPS protects requests in transit. Game requests also use the studio Key ID and Shared secret for MS1 request signing; your separate private profile credential still protects profile ownership. The application stores keyed hashes of network addresses for rate limits and abuse review. The hosting provider may retain ordinary access logs, including IP addresses. Administrators can hide scores or suspend profiles. Community scores come from offline clients and are not cheat-proof.

Leaderboard diagnostics

This diagnostic build keeps a local, rotating log of up to 400 events from the last 24 hours. It records version and module state, short profile references, progress counts, request IDs, response status, and leaderboard visibility checks. It does not include the shared secret, player token, signed request body, complete save or raw IP address. The local log stays on this device unless you choose Download game log or Download page log and share that file. Trace leaderboard now submits your current real campaign progress once, automatically creating the website player on the first accepted score if needed, and reads back the stored entry and public boards. Explicitly paused uploads stay paused. The trace creates no fake scores or test players.

The website keeps protected operational logs for leaderboard requests, authentication, database outcomes and public reads. Logs are bounded to three files of up to 1 MiB each; old rotated files are removed after seven days on the next relevant request. Current files rotate by size. Administrators can download a redacted report with database counts and visibility information. These reports may contain public game titles, pseudonymous profile references, scores and technical error details; share them only for support. Ordinary hosting logs are separate and controlled by the hosting provider.

Retention and deletion

Online profile, score and redemption records remain until you delete the online profile or request deletion. In the game, open Online & rewards and choose Delete online profile. This removes the profile, credentials, scores, score submissions and linked reward receipts from the active application database without erasing offline progress. Pausing uploads only stops submissions; it is not deletion. Deleting the online profile also pauses automatic uploads on this device so a replacement is not created on the next launch. You can explicitly resume later to create a new player. Network rate-limit records are removed by the website maintenance job after their expiry; hosting logs and backup retention are controlled by the hosting operator and may persist until rotation.

Support and recovery

A private connection backup contains the credential that controls this profile. Keep it private; anyone holding it can manage or delete the online profile. To request deletion without that backup, use the website data-deletion form and provide your profile ID; identity verification may be required. Support forms and website accounts have their own website privacy terms.

Choices

Automatic campaign leaderboards are on by default; you can pause them in Online & rewards or turn off automatic progress updates. No website login is required. Multiplayer deck publication is still a separate opt-in. You can play the campaign offline, export local progress in Settings, or delete the online profile. Do not include personal information in support messages unless it is necessary for your request. The game is not specifically directed at children.

Contact: DerkaDecay@gmail.com · Support form · Data-deletion request