The small print

Privacy

Effective November 4, 2026

Moondle is a daily puzzle game. The short version: you can play without an account, a name or an email. Your answers are checked on your own device, not on our servers. There are no ads, no analytics and no tracking cookies, and we don't sell or rent anything we hold.

The long version follows.

What stays on your device

Your game in progress, your finished days, your stats and streak, and your settings (sound, calm sky, high contrast) live in your browser's local storage, on this device only. So does a random receipt for each day you finish, which unlocks that day's worldwide stats and lets you rate the puzzle. It says nothing about who you are. If you sign in, your browser also keeps a sign-in token there until you sign out. Clearing this site's data in your browser erases all of it.

What reaches our server

While you play, nothing. Every answer is checked in your browser against that day's puzzle file, so what you type never leaves your device mid-game.

When you finish a day, your browser sends your five final answers (lowercased, the way the game reads them), the tier you earned on each level and how many circles each level had. That's what powers “You beat X% of players” and “how many people said the same thing”. No name, email, account or device id is attached, even if you're signed in. The random receipt mentioned above comes back to your browser and is the only link to that finished game.

If you rate the day's puzzle, we store the number of stars with that same anonymous receipt. Only totals and averages are ever shown.

If you press “This should count”, we receive the answer you typed, the date, the level and which circles it missed. We use it only to improve the answer lists.

Google sign-in

Signing in is optional and only keeps your stats and streak in sync across devices. When you sign in with Google, Google shares your email address, name and profile picture with our sign-in provider, Supabase, which keeps them with your sign-in record. We use only the email, to tell your account apart. For each day you finish while signed in, we save the date, your score, your five moons and whether level 5 was a Totalipse. Your answers are never saved to your account.

When you sign in on a device that already has history, the two are merged: the same day keeps its higher score and counts once. Your saved history is private to you. Signing out stops syncing. The My Moondle page has a “Delete my account” button that permanently removes your account and everything saved to it, right away.

Cookies

Moondle sets no cookies of its own. Signing in keeps its token in local storage, not a cookie. If you use Google sign-in, Google's own sign-in page sets its own cookies on google.com, under Google's policy.

Analytics and advertising

None. There are no ads, no analytics, no tracking pixels and no third-party trackers on the site.

Abuse protection

To stop scripted spam of the worldwide stats, each finished game is stored with a scrambled version of your network address: it's hashed with a secret key, so it can't be turned back into the address. It's used only to limit how many games one network can submit in an hour.

Reports are limited the same way: we keep the same scrambled address for about an hour to count how many reports one network sends, then delete it. It's never stored with the report itself.

Who touches the data

Each of these services holds only what its job needs:

• Vercel hosts the site and keeps standard short-lived server logs (such as IP address and pages requested) for security and reliability.
• Supabase runs our database and sign-in, on servers in the United States. See Supabase's privacy policy.
• jsDelivr serves the code library that talks to Supabase, and sees your IP address like any web request.
• Google serves the site's fonts and provides the optional sign-in. Loading the fonts means your browser contacts Google, which sees your IP address. See Google's privacy policy.

Nobody else gets anything.

Your data, your call

Everything on your device you can erase yourself by clearing this site's data in your browser. Your account and everything saved to it you can delete yourself, any time, on the My Moondle page. Finished games in the worldwide stats aren't linked to you, so we can't pick out yours.

Children

Moondle isn't directed at children under 13, and we don't knowingly collect personal information from them. You can play without giving any personal information at all. If a child has created an account, it can be deleted right away from the My Moondle page.

Changes

If this policy changes, the new version appears here with a new effective date. Bigger changes get a note on the site, not a silent edit.