Privacy Contract
Mythic Match is built around fictional creature personas, not real-world identity.
Not requested as dedicated fields
The profile model does not ask for real name, email, phone, address, real photos, social login, date of birth, exact location, contacts, browser fingerprint, advertising ID, or analytics ID. Free-text fields can still contain identifying details, so keep them out of lore, labels, reports, and screenshots.
What the app stores
The app stores your Creature ID, salted recovery hash, persona, lore, avatar URLs and history, drafts, symbolic interactions, blocks, reports and moderation records. Your phrase is also kept in this tab’s session storage while signed in. Save your ID and phrase securely: operators cannot retrieve a lost phrase.
Custom input handling
Custom realm, archetype, affinity, intent, boundary, and related labels are saved in separate moderation tables. They are not mixed into the official deterministic taxonomy unless the operator deliberately promotes them in a future code or data update.
AI and storage providers
Google Gemini processes submitted profile/report text for moderation, persona choices for lore, requested text for translation, image prompts for generation and generated images for quality checks. Supabase stores app records and public avatar objects; a server filesystem or configured image provider can also be used. We do not intentionally include credentials in AI prompts. Provider retention is separate from app deletion. Google documents 55-day abuse-monitoring retention for prompts, context and outputs. Paid-service training protections depend on billing and sharing settings; optional datasets can persist without a fixed expiry. We verified a paid project with optional GenerateContent logging disabled. Deleting a persona does not delete provider logs.
Communication limits
Direct match interaction is limited to symbolic reactions and preset cards. There is no unrestricted private text chat in the beta, which reduces pressure to share real identity, contact details, or sexual content.
Production handling
Hosting providers process network metadata. Apache access logs include IP address, time, request path, status, size and duration; paths may contain a public Creature ID. Access logs rotate daily with seven rotations. Application rate limits store HMAC-derived keys. We found no app analytics or advertising trackers; Azure collects host metrics/heartbeat; the inspected workspace retains these for 30 days, with activity/usage records up to 90 days. Provider copies and legal exceptions are outside app deletion.
Retention
Hiding retains data. Deletion removes the profile and related records and queues unreferenced managed images for cleanup after a grace period. Reports and operator audit records have an 18-month cutoff with bounded hourly cleanup. Local backup bundles rotate after 14 days; Supabase Pro provides seven-day backup/log retention under its published plan. A separate deletion-intent ledger prevents restored backups from republishing known deleted accounts. Provider, downloaded and cached copies have separate lifetimes; immediate erasure everywhere is not guaranteed.
Browser storage
A language cookie lasts up to one year. This tab stores credentials while signed in; signing out clears them. Browser session restoration can retain tab data. Static files and images may remain in browser/offline caches. Keep real identity, contact details and credentials out of public fields.
Adult-only controlled beta
Adult-only controlled beta: invited participants must be 18 or older and acknowledge eligibility before entering. We do not collect birth dates or identity documents, and do not claim verified age. A signed browser cookie grants access for up to 12 hours. Do not share access. Existing accounts can export, delete or appeal without entering the beta.
Profile controls
Profile controls let you edit, hide, export or delete. Export, deletion and account-safety appeals remain available with your Creature ID and secret phrase when hidden or restricted, without reactivation. Exports omit others’ private reports and blocks. Persona browsing requires adult beta access; previously public avatar URLs and shared copies may remain accessible. Personal blocking does not erase these copies.