You can explore the site and play guest Solo without a game account. Automatic account saves and private camps with friends use a verified account.
Moonlit Cabin is an independent game operated by its creator, Poobearski. For privacy questions or requests, use the private contact form, choose “Something else,” and add an email if you want a reply. Don’t send a password or identity document.
What we keep
| Feature | What is stored and why |
|---|---|
| Browser progress | Game saves and settings use your browser’s local storage. Guest Solo, your account’s Solo adventure, and each private camp keep separate progress on that device. |
| Optional account | Email, a password hash, verification status, and account dates. Your password is never stored as readable text. |
| Account & private-camp saves | Choosing Solo with a verified account enables automatic uploads of that adventure’s progress. Private camps also save your progress automatically. We store saves and update times, plus camp names, modes, membership, nicknames, readiness, shared time, scores, completion, and your latest in-game scene, position, and facing direction for spirit sightings. |
| Camp mail | Your email and confirmation status. A confirmation link is required before you join the list. Subscribing is separate from making an account. |
| Feedback | Your note, category, optional rating and email, date, and account reference if you are signed in. Notes are private, not public testimonials. |
| Optional analytics | Counts of visits and a small set of actions such as starting the demo or playing for five minutes. We use a changing daily session identifier, not your email or account ID. |
| Security & hosting | Temporary session data, hashed rate-limit identifiers, and hosting access/security logs used to operate and protect the service. |
Analytics are your choice
We ask before collecting optional analytics. Refusing does not prevent play, accounts, saves, or feedback. We don’t use advertising trackers or sell personal information.
Our application’s analytics do not contain your email, account ID, IP address, full browsing history, search queries, save contents, chat, or typed feedback. Hosting access logs can still include connection details such as an IP address and requested page, independently of optional analytics.
“Do Not Track” and Global Privacy Control signals disable our optional analytics. You can also change your choice here:
Cookies and browser storage
A necessary session cookie keeps you signed in, protects forms, and remembers the preview unlock. It is HttpOnly and Secure on the live HTTPS site. Sessions expire after 24 hours of inactivity or seven days at the latest. The preview unlock lasts up to 12 hours.
Your analytics preference is kept for up to one year. The game uses local storage for progress and settings. A safety backup is kept locally when you restore a different save. Clearing browser site data removes these local copies.
How long information stays
- Accounts and their Solo and private-camp data remain until you delete the account. Leaving a private camp keeps your reserved place and save for returning later.
- Unverified accounts and unconfirmed mailing requests are removed after seven days.
- Confirmed camp-mail subscriptions remain until you unsubscribe.
- Feedback is kept for up to one year. Deleting an account removes its link from feedback; a note you sent is not automatically erased by account deletion.
- Individual analytics events are removed after 90 days.
- Temporary rate limits are cleaned within 48 hours. Expired verification and reset tokens are cleaned within 48 hours.
- Queued emails are encrypted while waiting to be sent. They are removed after the sending server accepts them, or after seven days of failed attempts.
Cleanup runs through scheduled maintenance. Hosting logs and provider backups follow the hosting service’s retention settings and can outlast a deletion from the live database. They are not used to restore a deleted account into ordinary service.
Who processes the information
The website and database are hosted with Hostinger. The configured email provider processes addresses and messages to deliver confirmations, password resets, and camp mail. The launch setup uses Hostinger SMTP when enabled. We do not load YouTube embeds, analytics services, or remote fonts when you visit a page. Members of your private camp can see your camper nickname, readiness and online state, score, completion, and nearby spirit presence. Your email, inventory, and full save contents are not exposed to other campers.
Links to YouTube and HexaGameHub open other websites with their own privacy practices. We share no account or save information with them. Hosting and email processing may take place outside your country.
Your controls
From your account, you can export your own account data, Solo save, and private-camp membership and save data. Account deletion removes these records. If you host an unfinished camp, it is paused and cannot resume after deletion; other members retain their own saved progress. Browser saves and camp-mail subscriptions are separate. Every camp newsletter has an unsubscribe link. Use the private contact form for other access, correction, or deletion requests; we may need to verify you control the relevant email.
Accounts are optional for Solo, required for private camps with friends, and intended for people 13 or older. People under 13 should play locally and not submit personal information, feedback, or an email address here. If you believe a child has submitted personal information, contact us so it can be removed.
Changes to this notice
If the site adds features that use information differently, this notice will be updated. New optional uses will not be treated as part of an old analytics choice.