Cookies & privacy

Last updated: 27 October 2026

Who we are

Mythic City is a trading name of Rumil One Ltd, a company registered in England and Wales under company number 16936021. Our registered office is Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE.

Rumil One Ltd is the controller responsible for the personal information described in this notice. For privacy questions, support or requests about your information, email mythiccityapp@gmail.com or write to our registered office, marked “Mythic City privacy”.

This notice covers the Mythic City promotional website, its email-update signup and enquiries sent to us. For the mobile game, local saves and TestFlight testing, read the mobile app privacy policy. For help with the game, visit game support.

What we collect and why

• Email updates: your email address, signup time, the consent wording and version you agreed to, and the signup source. We use these to manage your subscription and send the Mythic City updates you requested. Our lawful basis is consent (UK GDPR Article 6(1)(a)). Signing up is optional and is not required to browse the website or play the game.
• Enquiries: your email address, message and any details you choose to send. We use these to answer you and resolve your enquiry. Our lawful basis is our legitimate interest in helping visitors and supporting the game (Article 6(1)(f)). We rely on legal obligation where processing is necessary to fulfil a data-protection rights request (Article 6(1)(c)).
• Website delivery and security: hosting services process technical details such as IP address, requested page, browser information and request time. Our signup protection uses a short-lived hash derived from connection information and a request counter. We use this processing for our legitimate interests in operating a reliable website and preventing spam, abuse and unauthorised access (Article 6(1)(f)). The subscription record itself does not contain your IP address.

We do not use this website to make solely automated decisions with legal or similarly significant effects on you. We do not sell the mailing list or use it to advertise other organisations’ products.

Mythic City email updates

If you enter your email address and tick the consent box, we use it to email you about Mythic City news, features and new content. We keep a record of the permission given with each subscription.

After a new signup, the form shows a private “Manage your signup” link. Save it and keep it confidential: it lets you remove your entry from the live signup database without signing in. The website also saves the private link token in your browser’s local storage, so you can return to Manage your signup on the same device. Your email address is not stored in that browser entry.

You can withdraw consent at any time using that link or by emailing mythiccityapp@gmail.com. Withdrawing consent does not affect processing that was lawful before withdrawal. Every marketing email we send will include a way to unsubscribe.

Who processes the information

The signup list is stored in a private database through OpenAI’s Sites hosting service and Cloudflare infrastructure. Authorised site administrators can manage it through protected tools; it is not published on the website. OpenAI processes hosted signup data to provide the hosting service under its applicable data-processing terms.

Google provides the Gmail mailbox used for enquiries. If you email us, Google processes the message as part of providing that service. Fonts on this website are loaded from Google Fonts, so your browser sends Google connection details when requesting them. We may also export subscriber records to a private Google Sheets spreadsheet for list administration; there is no automatic Sheets sync or bulk-email delivery service connected at present.

We share information with service providers only as needed for these purposes, and may disclose information where required by law or necessary to establish, exercise or defend legal claims. Provider information is available in OpenAI’s Sites data-processing terms, Cloudflare’s privacy policy and Google’s privacy policy.

International processing

Our providers operate internationally, so information may be processed outside the UK, including in the United States. OpenAI’s published Sites data-processing terms provide for Standard Contractual Clauses with the UK Addendum for UK personal data. Cloudflare and Google describe their use of recognised transfer frameworks, including the UK Extension to the EU–US Data Privacy Framework and contractual safeguards where applicable.

See the OpenAI transfer provisions, Cloudflare transfer information and Google transfer frameworks. Contact us if you would like further information or a copy of the relevant safeguards.

How long information is kept

• Subscriptions: we keep your live signup record while you remain subscribed and we need it for the updates you agreed to receive. We remove it when you withdraw consent, when we close the list, or when it is no longer needed for that purpose. Any working spreadsheet copies must follow the same subscription status and retention rules.
• Enquiries and rights requests: we keep correspondence for as long as needed to handle the matter and necessary follow-up. If a legal obligation or dispute requires longer retention, we keep only the information needed for that purpose.
• Signup abuse protection: counter records are marked to expire after 20 minutes and expired records are cleared on subsequent form submissions.
• Browser storage: the private signup-link token stays on your device until removed through the signup-management page or by clearing the website’s local storage.
• Recovery copies and provider records: deletion from the live list does not necessarily erase every recovery copy immediately. Cloudflare’s database recovery history can retain previous versions for up to 30 days, depending on the hosting plan, as described in its backup documentation. These are recovery copies, not active mailing lists. Provider operational and security records are retained under the purposes, legal requirements and deletion criteria described in their linked policies.

Cookies and browser storage

We do not add advertising cookies, analytics trackers or social-media tracking pixels to the promotional page. Its animation, screenshot carousel and locally hosted gameplay videos run in your browser. The functional signup-link storage described above helps you manage your subscription. Hosting services may use essential security technologies to deliver and protect the site; a private preview may also require authentication storage.

YouTube promotional video

The trailer shows a locally hosted preview until you press play. Pressing play loads YouTube’s embedded player in privacy-enhanced mode and connects your browser to Google/YouTube. YouTube then receives connection and device information, including your IP address and the page origin, and may use cookies or browser storage to provide playback, security and other player functions. See Google’s privacy policy and YouTube’s embedding information. You can browse the rest of the website without loading the player.

You can manage cookies and local storage in your browser settings. Clearing this site’s storage removes the saved signup-link shortcut, but does not by itself remove your subscription; use the private link or email us to unsubscribe. We will update this notice and provide any required choices before adding optional tracking technologies.

Your rights and choices

Depending on the circumstances, you can ask to access or correct your personal information, have it erased, restrict its use, or receive a portable copy. You can withdraw consent at any time. To make a request, contact mythiccityapp@gmail.com. We may need proportionate information to verify that a request relates to you.

You can object at any time to the use of your information for direct marketing. You can also object, on grounds relating to your particular situation, to processing based on legitimate interests.

You can complain to the UK Information Commissioner’s Office or your local data-protection authority. You do not have to contact us first, although we welcome the opportunity to resolve a concern.