Effective 25 August 2026 · Last updated 13 September 2026
The short version. You can play Mythwild without giving us anything — no name, no email, no account. If you make an account, we store the username and password you chose and the progress attached to them. We record what happens in the game (where you went, what you found, how long you played) to understand how the game is being played.
We do not sell your data and we do not share it for advertising. The game does load Google AdSense, which may set cookies and read device information to select adverts — see section 7. You can delete your account and everything in it at any time, from inside the game or from this page.
Mythwild is an online multiplayer game at mythwild.com, also distributed as an Android app. This policy covers both — they are the same game and the same servers.
For any question about your data, or to exercise any right described here, write to privacy@mythwild.com.
Most players never make an account, and nothing here requires one. When you first open the game,
your browser generates a random identifier — a string like
7c9e6679-7425-40de-944b-e07fc1f90ae7 — and stores it on your own device. That identifier
is how the server recognises the same player returning, so your progress is still there tomorrow.
It is not derived from anything about you or your device. We cannot tell from it who you are, and neither can anybody else.
Your guest progress is saved on our servers, not only in your browser — the identifier is what points at it. So clearing your browser's site data does not delete that saved progress; it destroys your only copy of the identifier, which means neither you nor we can ever reach the record again. What is left behind holds a character name you chose and game statistics, and nothing that identifies you. If you would rather it were deleted outright than left stranded, write to privacy@mythwild.com quoting the identifier before you clear anything — the deletion page explains where to find it. (Section 8 is about deleting an account, which a guest does not have.)
Mythwild itself sets no cookies. Google's advertising script may set its own — see section 7; those are Google's, not ours, and we cannot read them. Everything we keep is six values in your browser's local storage, and they never leave your device except where noted:
ow-pid — the random player identifier above. Sent to the game server, because it is
how your save is found.ow-token, ow-username — only if you sign in. The token keeps you signed
in and is sent to the server to prove it is you.ow-muted, ow-mouseaim, ow-appearance — sound, control and
appearance preferences. These stay on your device.An account exists so your progress survives a new phone or a cleared browser, and it is required before any real-money purchase. To make one we store:
We do not ask for an email address, a phone number, a date of birth or a real name, and there is nowhere in the game to enter one.
Two records, kept for different reasons and for very different lengths of time.
Your display name, appearance, what you have collected and unlocked, your credit balance, and your records: best lap, top speed, longest glide, places discovered, creatures seen. This is the save file. It exists so the game can be the game.
Discrete things that happen: joining and leaving, discovering a place, meeting a creature, a race result, a death, watching an ad, an arena run, a purchase. Each is recorded with the moment it happened, your player identifier and display name, the in-game location it happened at, which website address you arrived through, and a two-letter country code.
About the country code. Our CDN, Cloudflare, determines a country from your IP address before the request reaches us and passes us the two-letter code. We do not receive, log or store your IP address ourselves — the country code is the finest-grained location information this game has, and it exists to answer "which parts of the world is this being played in", nothing more.
The leaderboards have a daily version that pays rewards at midnight UTC. For that we record, per day and per leaderboard, your best result that day (or your number of wins), under your player identifier; what you were paid when a day's board closed, and whether the game has told you yet; and how much of the daily cap on climbing rewards you have used. Your display name is shown next to your result on the boards, which other players can see. A player marked as a test account is kept off the boards and is not paid.
Once a day, per player, we bank counts: sessions, minutes played, ads watched, and tallies of which places, rides and creatures were visited or seen. This is how we know whether the game is growing. We also bank what kind of device you played on — one of three words, phone, tablet or desktop, counted per session. It tells us which of those the game needs to be good on, and nothing else. It is not a device identifier and cannot be used to recognise your device or you: it is the same word for every phone in the world. Your browser works it out from the screen size and whether it has a touchscreen, and sends us only the word. When you delete your account, the name is stripped from these rows and the counts remain under the random identifier, which by then is attached to no account and no device — see section 8, which also sets out the one case where that identifier still appears somewhere else.
Chat messages are passed live between the players in the world with you. In the ordinary case they are never written to our database. Other players see what you type, so do not type anything you would not say out loud to strangers.
The server remembers the last few minutes of chat, in memory only. So that you can report something you have just watched scroll past, the game server holds the most recent chat lines — at most the last 50, and none older than five minutes — in its own memory. Nothing writes them anywhere. If nobody reports a line, that temporary copy disappears when it ages out or when the world empties, and it is never saved.
If you report a message, that message is stored. Reporting is the only thing in this game that puts a chat message in our database. When you report one we save: the text of the reported message, the player identifier of whoever sent it, the display name they were using at the time, your own player identifier as the reporter, which world it happened in, and when. We store the message as it was originally typed, including anything the automatic filter had starred out for everyone else — a report of an offensive message would be useless without the offensive part in it.
Reports are kept for 90 days, then deleted automatically. The expiry is enforced by the database itself rather than by the game.
What a report does, stated honestly: it is a record, and nothing happens immediately. There is no moderator on call, no automatic ban and no live review. Nobody is alerted, the reported player is not told and is not removed, and you will not receive a reply. What a report does is create a record that can be looked at later. We would rather say that plainly than imply a safety net that is not there.
The game also filters chat automatically, for everyone, all the time. Messages are checked against a list of offensive words and matching words are replaced with asterisks before anyone else sees them; display names are checked the same way, and a name that does not pass is replaced with a default. This happens on our server, to the copy other players receive. It is automated word matching and nothing more — no human reads your chat.
If you delete your account: reports you filed are deleted with everything else. Reports about messages you sent are kept until their own 90-day expiry, with your display name stripped from them. This is a deliberate exception and section 8 explains why.
Purchases of in-game credits are handled by Google Play Billing. Your card details, billing address and payment method go to Google and never touch our servers — we cannot see them.
What we keep is the record that a purchase happened: which store it came from, the store's own purchase and order identifiers, what was bought, how many credits it granted, when, and the confirmation message the store sent us. This is what lets us answer a refund request, resolve a dispute, and satisfy tax and accounting rules. It is the one thing that outlives account deletion, in a form no longer attached to you — see section 8.
Mythwild uses Google AdSense. The previous version of this section said the game contained no advertising SDK. That stopped being true on 19 September 2026, and this section was rewritten in the same change that made it untrue — which is what the old wording promised would happen.
What that means concretely:
adsbygoogle.js, served by Google, and it runs on mythwild.com whether or
not you ever see an advert.The game also contains an optional rewarded-video system — watch something, get some credits. It is built but is not yet connected to Google's adverts, so nothing in the game currently offers you an advert to watch for a reward. When that is switched on it will always be something you choose: nothing will interrupt play, and declining costs you nothing but the reward.
If you are in the EEA or the UK and we have not yet asked you for advertising consent, you should treat adverts here as not yet available to you; we will ask before any personalised advert is served to you.
You can delete your account and its data at any time, and you do not need to contact anyone to do it. There are two ways in, and they do exactly the same thing:
Both ask for your password to confirm it is you. Deletion is immediate and irreversible: there is no grace period, no recovery window and no backup we can restore you from.
| What | Outcome | Detail |
|---|---|---|
| Username, password, sign-in token | Deleted | Removed entirely. There is nothing left to sign in with, and the username becomes available to somebody else. |
| Character, progress, credits, unlocks, records | Deleted | Every field is erased. Credits and purchased items are destroyed with it and cannot be refunded or restored. |
| Gameplay events (section 4) | Deleted | All of them, immediately, rather than waiting for the 30-day expiry. |
| Daily leaderboard results and rewards (section 4) | Deleted | Every day's results, the record of what you were paid, and the climbing-reward cap. You disappear from past and present daily boards. |
| Daily totals (section 4) | Anonymised | Your name is stripped. The counts stay, under the random identifier, so historical player counts do not silently change. That identifier is attached to no account and no device once deletion is done — but read the note below the table if you ever made a purchase. |
| Chat reports you filed (section 5) | Deleted | All of them, immediately, rather than waiting for the 90-day expiry. |
| Chat reports about you (section 5) | Kept | Kept until their own 90-day expiry, with your display name stripped. Read the note below the table — this is the one place where deleting your account does not remove something about you. |
| Purchase records (section 6) | Kept | Retained without your account attached, because tax, accounting and payment-dispute rules require it. Kept for as long as those rules require, then deleted. |
Why reports about you are not deleted. If deleting an account erased every report filed about it, then anybody could clear the record against them by deleting an account they were finished with anyway — and reporting would be a button that does nothing. So those rows stay until they expire on their own. What is left is the message, the time, and a random identifier pointing at an account that no longer exists: the display name is stripped, exactly as it is from the daily totals above. Reports you filed carry no such argument and are deleted outright.
The game tells you how many purchase records were kept at the moment it deletes your account, so the number is measured rather than promised.
The one honest caveat, if you ever bought anything. The retained purchase record and the anonymised daily totals carry the same internal identifier, so those two records can still be connected to each other. That identifier means nothing on its own and we hold nothing that turns it back into you — but the payment record contains the store's own order number, and the store can connect that to the person who paid. So we will not claim the leftover data is beyond all possible re-identification: it is unlinked from your account and your device, and for anyone who never made a purchase there is nothing left to link it to at all.
We use four service providers to run the game. They process data on our instructions, in order to deliver the service, and none of them receives anything for advertising or their own purposes:
Because these providers operate globally, data may be processed outside your own country. Cloudflare and Render keep their own short-lived operational logs, which include IP addresses, for security and reliability — that is ordinary infrastructure logging that we do not control and do not query.
Mythwild is not directed at children under 13, and we do not knowingly collect personal information from them. We do not ask any player's age, because we would rather not hold that either. If you believe a child has created an account, write to privacy@mythwild.com and we will delete it.
Depending on where you live you may have the right to access, correct, export or erase the personal data we hold about you, and to object to how it is used. Deletion is built into the game and needs no request (section 8). For anything else, write to privacy@mythwild.com and we will answer within 30 days.
We ask for your password before deleting an account for exactly this reason: it is the only way we can tell that the person making the request is the person the account belongs to. We hold no other identifying information that could verify you.
Passwords are hashed with scrypt and never stored or logged in readable form. Traffic between your device and our servers is encrypted. Accounts are bound so that knowing a player identifier is not enough to load somebody else's save.
No system is perfectly secure, and this one is run by a very small team. If you find a security problem, please tell us at privacy@mythwild.com before telling anybody else.
If this policy changes, the date at the top changes with it. For a change that materially affects what we collect or who receives it — switching on an advertising network, for instance — we will say so in the game before the change takes effect, not afterwards.