Privacy Policy — Moonlit Foundry

Moonlit Foundry LLC (“Moonlit Foundry”, “we”) makes the games and the website at moonlitfoundry.dev. This policy explains what those collect, who receives it, and how to stop it. We are the data controller for that information.

Our games are currently released in the United States and Canada only.

The short version

You can play without telling us anything about yourself, and most people do. Signing in is optional — it exists so your progress follows you to another device. An account is a username and a password, and an email address only if you choose to add one.

Our games are free and show ads. The ad networks collect a device advertising identifier and basic device information in order to choose which ad to show. You can turn that off in your phone's settings and the games keep working — you'll just see less relevant ads.

What we collect

Information you give us

Account details, if you choose to sign in — a username and a password. We store the password only as a hash, so we can't read it. An email address is optional, and we use it only to let you reset a forgotten password and to send receipts for anything you buy on the website.
Whatever you write to us. If you email support we get your address and your message, and we use them to answer you and nothing else.

Information collected automatically

Device advertising identifier — the IDFA on iOS or the Advertising ID on Android, where you have allowed it. This is a resettable ID that is not tied to your name.
Device and app information — model, operating system version, language, country, screen size, and the version of the game you're running.
Approximate location — derived from your IP address, at country or region level. We do not collect precise or GPS location.
Gameplay events — levels started and finished, session length, settings changed, and similar, so we can tell which parts of a game are working. These go to our own servers rather than to an analytics company.
Crash and performance data — what the app was doing when it broke.
Ad interactions — which ads were shown, and whether they were viewed or tapped.
Saved progress, if you are signed in — your position in the game, stored against your account so another device can pick it up.

What we don't collect

Your name, postal address, phone number, contacts, photos, microphone or camera input, or precise location. We never see payment card details either: those go straight to Stripe, and we hold only a customer reference and a record of what was bought.

Accounts and saved progress

Signing in is optional on every platform — iOS, Android, and the web. Play signed out and your progress is written only to that device, where we can't see it and can't recover it if the device is lost or the game is reinstalled.

Sign in and your progress is stored on our servers against your account so it follows you between devices. Deleting your account deletes that saved progress along with it, and there is no way for us to get it back afterwards.

Who receives it

We use third parties to serve ads and to understand how the games perform. They act as independent controllers or as our processors depending on the service, and each has its own privacy policy:

AppLovin — serving and measuring ads. AppLovin also operates the mediation layer that decides which network fills each ad slot, so the demand networks it selects receive your advertising identifier as well. AppLovin publishes the list of those networks, and its privacy policy covers what they may do with it.
Sentry — crash and error reporting. Privacy policy.
Stripe — payment processing, and only for purchases made on the website. Stripe receives your card details directly; we never hold them. Privacy policy.
Apple and Google — app distribution, in-app purchases made on a phone, and aggregate download and crash statistics we cannot tie to an individual.

We don't use a third-party analytics company. Gameplay events go to servers we run.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising outside the ad partners named above.

How we use it

To run the game and remember your settings and progress.
To sync that progress between your devices, when you are signed in.
To show ads, and to cap how often you see the same one.
To measure whether an ad campaign or a game update worked.
To find and fix crashes and bugs.
To take payment for anything you buy on the website.
To answer you when you get in touch.

Legal bases (UK and EU)

We don't currently offer the games in the UK or the EU. If we release there, this is the basis on which we would handle your information, and we would appoint the representatives that the UK and EU regimes require before doing so.

Where the UK GDPR or EU GDPR applies, we rely on your consent for personalised advertising, collected through the consent prompt shown when you first open the game. We rely on performance of a contract for running your account, syncing your progress, and completing a purchase. We rely on our legitimate interests for crash reporting, security, preventing ad fraud, and understanding which parts of a game are working. You can withdraw consent at any time from the game's settings screen.

Children

Our games are not directed at children under 13, or the equivalent age in your country, and we do not knowingly collect personal information from them. If you believe a child has provided us with information, contact us and we will delete it.

Your choices

iOS — Settings › Privacy & Security › Tracking. Turning off “Allow Apps to Request to Track” stops apps receiving your IDFA.
Android — Settings › Privacy › Ads, where you can delete your advertising ID or opt out of personalised ads.
In game — the settings screen has a privacy option that reopens the consent prompt so you can change your answer.
Your account — you can play signed out, and you can delete your account from the settings screen at any time.

Opting out doesn't remove ads. It means the ads you see are chosen without using your advertising identifier.

Your rights

Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, object to or restrict how we use it, receive a portable copy, and complain to your data protection authority. Residents of California have these rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them, and several other states now grant comparable ones. Canadian players have equivalent access and correction rights under PIPEDA.

If you have an account, deleting it from the settings screen is the fastest route — it removes your username, your saved progress, and your email address if you added one.

For anything held against your device rather than an account, resetting your advertising ID severs the link between you and the data our ad partners hold. If you want us to act on a request, email privacy@moonlitfoundry.dev with your username, or your device advertising ID if you play signed out, and we'll respond within 30 days.

Retention and transfers

Accounts and saved progress — kept until you delete the account.
Support emails — 12 months.
Crash reports — 90 days.
Gameplay events — 12 months, then aggregated so that they no longer identify a device or an account.
Payment records — 7 years, which tax law requires of us.

Our partners set their own retention periods, described in their policies.

We operate from the United States, and our partners operate internationally, so information may be processed outside your country. Where required, those transfers rely on Standard Contractual Clauses or an adequacy decision.

Security

We keep what we collect to a minimum, which is the most effective protection available to a studio our size. Passwords are stored only as hashes, so a copy of our database would not reveal them. Data in transit is encrypted. No system is perfectly secure, and we don't claim otherwise.

Changes

If this policy changes materially we'll update the effective date above and, where the change affects how we handle your data, show a notice in the game.

Contact

Moonlit Foundry LLC
REGISTERED ADDRESS
privacy@moonlitfoundry.dev