Website privacy notice.

Who is responsible

Mythic Brain is operated by EDM doo (LLC), at Kalmija Baruha 1, Sarajevo, Bosnia and Herzegovina. For personal information handled for this website, EDM doo (LLC) is the data controller: the organisation responsible for deciding why and how that information is used.

For a privacy question or a request about your information, email info@mythicbrain.com or write to the postal address above. You can browse this website without creating a Mythic ID or giving us your name or email address.

What this notice covers

This notice covers the public Mythic Brain website: its pages, browser preferences, optional newsletter signup and enquiries about the studio. Forms show whether their delivery service is available before you can submit them.

The Lookout at play.mythicbrain.com and the games are separate services. Account registration, sign-in, game activity, saves and achievements need the privacy information provided by those services. Reading this website does not sign you in or give this site access to your account records.

This is a draft for review. The public hosting and email arrangements, including log retention and processing locations, must be confirmed before this notice is published as the final policy.

Information needed to deliver a page

A browser must send technical information to the server to load a website. This includes an IP address, the requested page or file, and request headers that may describe the browser and a referring page. A hosting service may keep some of this information in access or security logs.

Technical information is used to deliver pages and, where logs are kept, investigate errors, protect the service and respond to abuse. The current local preview server does not write a visitor access log. That does not establish what a future public host will retain; its logging settings and retention period still need confirmation.

When you hover over or focus a link, the site may load another page from this website in advance. A Lookout link may also open a connection to the Lookout before you click it, which can disclose your IP address to that service. This prepares the connection; it does not sign you in.

Browser storage and cookies

The site remembers your sound preference, your Calm motion preference and the games you mark with a local game reminder in local storage in your browser. These are device preferences, not a player profile. The website does not upload these stored values to us.

The current website code sets no cookies and includes no analytics tags, advertising trackers, tracking pixels or session recording. Fonts, icons and artwork load from the website’s own origin. Serving those files locally does not mean that a hosting provider cannot receive the technical information needed to deliver them.

Change preferences with the site controls, or clear this website’s site data in your browser settings to remove them entirely. The site code sets no automatic expiry. If storage is blocked, controls still work on the current page; reloading or navigating to another page may reset your choices.

Local storage is covered by rules on device storage where those rules apply; calling it “local storage” does not create a consent exemption. Any storage beyond what is permitted for a feature you request must have the appropriate consent before it is used. A new tracker or storage purpose requires a review of this notice and the controls offered to you.

Newsletter and contact forms

When enabled, the contact form sends your topic, name, email address and message to the studio through its form service and Resend email delivery. “Message accepted” means the delivery service accepted the request; it does not guarantee that somebody has read it. If the service is unavailable, the form stays disabled and offers another way to contact us.

To contact us now, send an email directly to info@mythicbrain.com. Opening an email link uses your chosen email application; a message reaches us only if you send it. The address, message, attachments and ordinary email metadata you send are then handled by the email services involved.

Please share only what is needed for your enquiry. Do not send passwords, verification codes, payment details, identity documents or sensitive personal information unless we explain why a particular item is necessary and provide a suitable way to share it.

Newsletter signup is optional. When you submit the signup form with the consent box checked, the service sends a confirmation email through Resend. You must open its link and press the confirmation button before your address is added to the studio newsletter segment in Resend. Each newsletter must provide an unsubscribe link. Existing unsubscribe preferences are preserved; contact the studio for help subscribing again.

The form service uses the requested email address, consent wording version, request time and confirmation result to process signup and record the choice. It uses limited, keyed identifiers derived from email and network addresses to control abuse. Website form requests do not use your Mythic ID cookies or sign you in. A local game reminder only marks a game in this browser; it does not subscribe you to email. A studio enquiry or a Mythic ID registration is not permission to send marketing.

Why information is used

Where a legal basis is required, necessary website delivery and proportionate security processing rely on the legitimate interest in operating a working, safe website. Handling an enquiry relies on the legitimate interest in answering it; an enquiry about entering a contract may instead involve steps you request before that contract.

Information necessary to meet a legal requirement is handled on the basis of that obligation. Optional marketing, if enabled, requires the appropriate consent. Each basis must match the actual processing and applicable law; the final hosting and email arrangements need to be reviewed on that basis before launch.

You choose whether to contact us. Without a return address or enough information about the question, we may be unable to reply or investigate. The current website does not make decisions with legal or similarly significant effects about visitors through automated profiling.

Who can receive information

Website hosting and email providers receive information needed to deliver their services. Enabled forms use the studio’s platform service and its Supabase database for request controls and confirmation records, and Resend for email delivery and the confirmed newsletter list. Provider arrangements, processing countries and the public hosting configuration still need review before release.

The current website includes no feature that sells personal information or shares it for targeted advertising. If disclosure is required by law or necessary to deal with a legal claim, it must be limited to the information justified by that purpose.

External links take you to services that have their own privacy practices. Review their notice before providing information. The privacy choices on this website do not control what another service stores.

Retention and international transfers

Browser preferences remain until you remove them or your browser clears them. The website does not save form drafts after the page is discarded; your browser may separately remember information through its own autofill or session features. Submitted contact messages are sent to the studio inbox through Resend rather than stored in the platform database.

Newsletter confirmation links expire after 30 minutes. The pending address is removed when its link is used; expired pending records are removed by the daily maintenance job and signup cleanup. Consent receipts use a keyed email identifier rather than the plain address and are retained for up to 365 days before scheduled cleanup. Confirmed addresses and unsubscribe preferences remain in Resend under the studio’s mailing-list retention policy, which must be approved before activation.

For correspondence, the retention criteria are the time needed to answer the enquiry, resolve any outstanding issue and meet applicable recordkeeping or legal requirements. Hosting logs and email records need a documented retention schedule; the precise settings have not yet been confirmed for public release.

The operator is based in Bosnia and Herzegovina. The countries where hosting and email providers process information still need confirmation. Any transfer subject to data protection restrictions must use a valid transfer mechanism, with information about the safeguards and how to obtain a copy in the final notice. No claim is made here that all information stays in one country.

Your privacy rights

Depending on the law that applies and the reason information is held, you may ask to access your personal information, correct inaccurate information, erase information, restrict its use or receive a portable copy where that right applies.

You may object to processing based on legitimate interests on grounds relating to your situation. Where information is used for direct marketing, you may object at any time. If processing relies on consent, you may withdraw it; withdrawal does not change the lawfulness of earlier processing.

These rights have conditions and exceptions. For example, a legal requirement to retain a record may prevent immediate deletion. If a request cannot be fulfilled, you should receive an explanation and information about the available complaint route.

Making a request or complaint

Send your request to info@mythicbrain.com or the operator’s postal address, describing the information or interaction involved. You do not need a Mythic ID to make a website privacy request. We may ask for proportionate information to verify your identity before disclosing personal records; do not send an identity document with your first message.

Requests must be handled within the time limits set by applicable law. Where the GDPR applies, the usual response period is one month; a permitted extension for complexity or the number of requests must be explained within that month. Requests are normally free, subject to the exceptions allowed by law.

You can raise a concern with the Personal Data Protection Agency in Bosnia and Herzegovina, or another competent data protection authority where applicable. You do not have to contact us first to exercise a right to complain. For GDPR rights, the European Data Protection Board’s rights guide explains the general framework.

Children and personal information

Reading the public website does not require a date of birth or a player account. This does not set the age or parental-permission rules for the Lookout or a game; check those rules before registering or playing.

If you are a parent or guardian concerned that a child has sent personal information to the studio, contact info@mythicbrain.com with enough context to locate the message. Please avoid including unnecessary information about the child.

Keeping information safe

The website is built without third-party tracking scripts or account credentials in its pages. Its public build includes a content security policy designed to restrict scripts and other resources to approved sources. These measures reduce exposure; they cannot guarantee that every browser, host or email service is risk-free.

For a privacy or security concern, send a brief description through the contact route above. Keep passwords, session tokens and other private data out of the report. Share only the details needed to understand the issue.

Changes to this notice

If forms, providers, storage or processing purposes change, this notice must describe them before the new processing begins. Where the law requires consent or a separate notification, a page update alone is not enough.

For the rules on using the website, read our Terms. For help using its controls or reporting a barrier, read our Accessibility statement.