Privacy Policy

This policy covers weirmoon.com and everything on it: the devlog, the benchmarks, the gaming writing, the Valley of Spirits pages, the store, and the account system. It is written to be read, not skimmed past. If something here does not match what the site actually does, that is a bug — tell us through the contact form and we will fix the site or fix this page.

The short version

• No advertising, no analytics, no tracking pixels, no social-media widgets. Nothing on this site profiles you or follows you to other sites.
• We do not sell your information, and we do not share it for cross-context behavioural advertising.
• You can browse everything public without an account and without giving us anything except what your browser sends with any web request.
• If you make an account or write to us, we keep the details you give us, for the purposes listed below and no others.
• You can ask to see, correct, or delete your information at any time, from any country, using the data request form.

Who we are

Weirmoon LLC ("Weirmoon", "we", "us") operates weirmoon.com. Weirmoon is a small independent game-development project. For anything in this policy, the way to reach us is the contact form or, for privacy requests, the data request form. We deliberately do not publish a personal email address or telephone number here.

What we collect, and why

When	What	Why	Kept
You visit any page	Your IP address, browser type, the page requested, and the time. This is the standard record any web server keeps, held by our hosting provider.	To deliver the page, keep the site secure, and diagnose faults.	In the host's server logs for the period that provider sets.
You create an account	Your name, your email address, and either a password (stored only as a salted hash by Google Firebase Authentication — we never see or store the password itself) or, if you choose Google or Microsoft sign-in, the name and email that provider shares with us. Our own database also stores a user record: your Firebase user ID, your name and email, and the role and permissions on your account.	To let you sign in and to decide what you are allowed to see or do.	While your account exists. Deleted when you ask us to delete it.
You favourite or like a store product (signed in only)	The product, your account ID, and the time.	To show your favourites and likes on your dashboard.	While your account exists. A favourite is removed from your account when you remove it.
You use the contact form	The name, email address, subject, and message you type, plus your account ID if you are signed in, and our replies.	To read and answer your message.	Only as long as needed to respond and keep a record of the exchange, then deleted on request.
You send a data request	The same fields as the contact form, plus the type of request.	To verify and carry out your request, and to show that we did.	For as long as the law expects us to be able to show we responded.
Something breaks in your browser	An error report: the error message and technical trace (both truncated), the page address without any query string or fragment, your browser's user-agent string, and a severity label. No account ID, name, or email is included.	To find and fix bugs.	Only as long as needed to diagnose and fix the problem.
You read a story	Nothing is sent to us. Your reader settings and the last chapter you opened are kept in your own browser's local storage.	To remember your setup and offer "Continue reading".	On your device, until you clear site data.
You add something to the cart	Nothing leaves your device. The cart lives only in your browser's memory and disappears when you reload or close the tab.	To show you a cart.	Not stored.
You choose to play an embedded video	Nothing, until you click. After you click, YouTube or Twitch loads and receives your IP address and browser details under their own policies.	To play the video you asked for.	By that provider, under its policy.

We do not collect sensitive personal information — such as health, biometric, precise location, government ID, financial account, racial or ethnic origin, religious, or sexual-orientation information — and we do not collect payment card details. Checkout is not open — no order can be placed on this site at the moment. If that changes, this policy and the Terms of Use will be updated to name the payment processor before any payment is accepted.

Who else handles your information

We use a small number of service providers to run the site. They may only use your information to provide their service to us.

• Google (Firebase Authentication) — creates and verifies accounts, and stores account credentials. If you choose Sign in with Google, Google also sees that you are signing in to Weirmoon.
• Microsoft — only if you choose Sign in with Microsoft, in which case Microsoft sees that you are signing in to Weirmoon.
• Web hosting and content delivery — serves the site's pages, scripts, images, and fonts. It sees the request data described above.
• Backend and database hosting — stores account records, contact messages, data requests, and error reports.
• Image hosting — product and library images may be delivered from an image service, which sees your IP address when your browser fetches an image.
• YouTube and Twitch — only if you click play on an embedded video. We use YouTube's privacy-enhanced mode (youtube-nocookie.com).

Fonts are hosted on weirmoon.com itself. We do not load fonts, scripts, or styles from Google Fonts or any other outside content network.

We may also disclose information when the law requires it (for example a valid court order), to protect the safety or rights of our visitors or of Weirmoon, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply to the information.

What we do not do

• We do not run advertising, ad networks, or affiliate trackers today. If advertising is ever added — for example on story pages — this policy, the cookie and local storage notice, and a consent choice will be put in place before any ad or advertising cookie loads, and ads will be clearly labelled.
• We do not use analytics or session-replay tools.
• We do not build profiles, and we do not make automated decisions about you that have legal or similarly significant effects.
• We do not sell personal information and we do not "share" it in the sense California law uses for cross-context behavioural advertising.
• We do not knowingly collect information from children under 13.

Do Not Track, Global Privacy Control, and tracking by others

Weirmoon does not track you across other websites, and it does not allow other companies to collect information about your activity on this site over time or across other sites — no advertising, analytics, or social-media code runs here. The only exceptions are ones you start yourself: if you click play on a YouTube or Twitch video, or choose Google or Microsoft sign-in, that company receives the request and handles it under its own policy.

Because there is no cross-site tracking to stop, the site behaves the same whether or not your browser sends a Do Not Track signal. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of any sale or sharing of your personal information — which we already do not do. If that ever changes, we will honour GPC automatically.

Cookies and local storage

We do not set any cookies of our own. Signing in uses your browser's local storage to keep you signed in, and the story reader remembers your reading settings and last chapter in your browser's local storage — on your device only, never sent to us. Everything is listed, item by item, in the cookie and local storage notice. Because nothing used for tracking or advertising is stored, there is no consent banner to click through.

How long we keep information

We keep information only as long as we need it for the purpose it was collected for, or as the law requires. When you ask us to delete your account, we delete the account and its associated records, except for anything we must keep to meet a legal obligation, resolve a dispute, or enforce our terms. Backups roll off on the backup provider's normal schedule.

Your rights

Wherever you live, you can ask us to:

• tell you what information we hold about you and give you a copy;
• correct anything that is wrong;
• delete your information, including your account;
• stop using your information for a particular purpose, where that applies.

Use the data request form. We will reply to the email address you give us; to protect you, we may ask you to confirm that you control that address (or, if you have an account, that you can sign in to it) before we hand over or delete anything. We aim to respond within 30 days, and always within 45 days; if a request is unusually complex we may extend that once, by up to 45 more days, and we will tell you why. Requests are free. You will not be treated differently for making one. You may use an authorised agent with your written permission.

Appeals. If we turn down a request, in whole or in part, we will explain why. You can appeal by sending the data request form again and choosing "Appeal a decision". We will answer an appeal within 60 days and explain the result. If you still disagree, you can contact the attorney general or privacy regulator where you live — for example the Indiana Attorney General, the Florida Attorney General, or the California Privacy Protection Agency.

If you are in the European Economic Area, the United Kingdom, or Switzerland

We act as the controller of your personal data. Our legal bases are:

• Contract — to provide your account and what it does;
• Legitimate interests — to keep the site secure and fix bugs (error reports), and to run and improve a small site, balanced against your rights;
• Consent — for videos you choose to play, and for anything optional we may ever add; you can withdraw consent at any time;
• Legal obligation — where the law requires us to keep or disclose something.

You also have the right to object to processing based on legitimate interests, to restrict processing, to data portability (a copy in a common, machine-readable format), and to complain to your local data protection authority. Information may be processed outside your country, including in the United States, by the providers listed above; those providers rely on recognised transfer mechanisms such as standard contractual clauses or the EU–US Data Privacy Framework.

If you live in California or another US state with a privacy law

Depending on where you live, you may have the rights to know, access, correct, delete, and obtain a copy of your personal information, to opt out of the sale or sharing of personal information and of targeted advertising, to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights. In the last twelve months we have not sold or shared personal information and have not used it for targeted advertising, and we do not sell sensitive personal data, so there is nothing to opt out of. We extend these rights to everyone in the United States, whatever state you live in, using the process and appeal route described above.

The categories of personal information we collect are identifiers (name, email, account ID, IP address), internet or network activity (pages requested, error reports, store favourites and likes), and the content of your messages. We do not collect sensitive personal information. We collect them directly from you and from your browser, for the purposes in the table above.

Security

The site is served over HTTPS, account passwords are handled by Google Firebase Authentication (we never see them), the site's administration tools require an administrator account, and the site's code is checked for known-vulnerable dependencies. No system connected to the internet is perfectly secure, so we cannot promise that nothing will ever go wrong. If a breach affects your information, we will tell you and the relevant authorities as the law requires.

Children

Weirmoon is a general-audience site, but accounts are for people aged 13 or older (or the higher age of digital consent where you live). We do not knowingly collect information from children under 13. If you believe a child has given us information, tell us through the contact form and we will delete it.

Links to other sites

Where a page links to another site, that site has its own policy and we do not control it.

Changes to this policy

When this policy changes, we update the version and dates at the top of this page and add a line to the version history below. Earlier versions are available on request. If a change is material — a new kind of data, a new provider that sees your information, or any advertising — we will say so plainly on this page and, where we have your email because you made an account, we will tell you before the change takes effect.

Contact

Use the contact form, or the data request form for anything about your information. Both go to the same place and are read by the person who runs the site.

Version history

Version	Effective	What changed
1.1	2026-10-02	Added store favourites and likes, Do Not Track and Global Privacy Control, the appeal process, the 45-day response limit, a statement that no sensitive information is collected, and US-wide rights.
1.0	2026-09-30	First version of this policy.