Privacy Policy

Last updated: 9 October 2026. This policy applies to moonlightpoker.fun and its game, account and support features.

1. About MoonLight Poker

MoonLight Poker (“we”, “us” and “our”) is a free-to-play Texas Hold’em website for fun and casual play by adults. All chips are virtual, have no monetary value and cannot be redeemed. There is no real-money play and no cash, prizes or real-world rewards. This policy explains how the site handles your information. To contact us about privacy, use our contact form and select the privacy topic. Include a reply email address if you want a response.

2. Information we collect

Guest play and gameplay

You can play without providing an email address or creating an account. We assign a random guest identifier to your browser and process your chosen nickname, avatar, table membership, connection state, game actions, virtual chips and results to operate the game. Guest identifiers can be linked to activity; they are pseudonymous rather than a guarantee of anonymity. If you register, guest progress may be linked to your new account.

Optional accounts

If you register, we store your email address, display name, avatar, password hash, verification status, account status, registration and login timestamps, session and verification/reset token records, preferences, virtual-chip balance and transactions, hand statistics and tournament results. Passwords are stored as hashes, not readable passwords. Registration and password recovery require an email address; you can continue as a guest if you do not want to provide one.

Tables, chat and reports

We process table settings, host and player identifiers, invitation codes, any table password in hashed form, and gameplay state. Chat messages are delivered to people connected to the table, and a short recent chat buffer may be replayed to new arrivals. If you report a player, we store the reporting and reported player identifiers, table reference, reason and moderation status. Reports about you may provide us with information from another player.

Contact messages

We store the name, optional email address, topic, message, submission time and handling status you submit through the contact form. The contact-message record does not include your IP address, although infrastructure processes it as described below. Do not send passwords, payment information or unnecessary sensitive information.

Technical information

Our hosting and security infrastructure processes IP addresses, request URLs, browser and device information, approximate country, connection details and diagnostic information to deliver the site and protect it. Operational and error logs may contain request or game context. We use approximate country information for service configuration, advertising restrictions and aggregate reporting, not precise GPS location.

3. Why we use information

• To deliver pages, seat players, maintain connections, run hands and tournaments, reconnect you and record progress.
• To manage accounts, authenticate sign-ins and send verification and password-reset messages.
• To remember settings, answer support requests and investigate player reports.
• To prevent abuse, enforce our Terms of Use, investigate faults and maintain security.
• To understand aggregate use and, where enabled, display and measure advertisements.
• To meet legal obligations and handle disputes and lawful requests.

Where applicable law requires a legal basis, we rely on providing the service you request, legitimate interests in operating and protecting it and understanding its use, compliance with legal obligations, and consent for optional advertising technologies where required. You may object to processing based on legitimate interests and withdraw consent where we rely on it. Agreeing to our terms does not by itself constitute consent to optional advertising.

4. Cookies and browser storage

• Guest cookie: __Host-g identifies a guest browser and expires 180 days after it is issued.
• Sign-in cookie: __Host-s maintains an account session for up to 30 days, unless revoked or you sign out. Authorised administrators use a separate __Host-a cookie with an eight-hour session.
• Preferences: local storage remembers settings such as your nickname, sound, motion and card display. Account preferences may also be saved on our servers.
• Game session: session storage can hold table connection and rejoin information for the browser session.
• Advertising choice: ml_consent_v1 in local storage records your choice and its timestamp.
• Usage counting: ml_landed in session storage and ml_first_seen and ml_last_return in local storage help count landing and returning visits without sending a unique analytics identifier.

Local storage generally remains until you or your browser clears it; session storage generally ends with the tab’s browsing session. You can clear or block site data in your browser. Blocking essential cookies can prevent sign-in, guest continuity or reconnection. Clearing a guest cookie does not automatically delete server-side records associated with the old identifier.

5. Aggregate analytics

When enabled, our own analytics records daily counts of events such as starting a game, completing a hand, registration, connection errors and advertising choices. Counts are grouped by event, coarse country code and device class; some events include a broad referral or duration category. The analytics database does not store IP addresses, account or guest identifiers, chat or card information with these counters. Browser storage used to avoid duplicate counts is described above. Our analytics endpoint and client honour Global Privacy Control and Do Not Track signals by skipping event recording; this does not switch off essential gameplay or security processing and is not a promise about third-party advertising behaviour.

When enabled, we also use two service providers after the page has finished loading: Sentry, which receives technical error reports (error message, stack trace, browser and device type, page URL), and PostHog, which receives page views and similar usage events together with a random browser identifier kept in local storage (not a cookie). We do not send names, emails, chat, or card information to either provider, and we do not use session recording or advertising features. Both are skipped when your browser sends Global Privacy Control or Do Not Track, and never run for search-engine crawlers.

6. Advertising and your choices

Advertising may be enabled to support the free service. Our advertising integration is Google AdSense. When it loads, Google and its advertising partners may receive your IP address, page URL and device/browser information and use cookies or similar technologies to deliver, personalise and measure ads and prevent fraud. See how Google uses information from partner sites and Google’s advertising information. You can also manage personalisation through Google My Ad Center.

Where the site presents an advertising consent choice, ad scripts are gated until you accept. You can revisit that choice through “Privacy & ad choices” in the footer when available. Declining blocks future ad loading through that gate. If an ad script has already loaded, reload the page after withdrawing consent; withdrawal does not undo previous processing or remove cookies already set by third parties. Use browser controls to clear those cookies. Availability of ads and consent controls depends on the site’s advertising settings and your region.

We do not sell account lists or provide your account email or password to advertisers. Advertising identifiers may nevertheless be shared through ad technologies when they are active; applicable law may treat that activity as sharing for targeted advertising. You can contact us about any applicable opt-out rights.

7. Who receives information

• Other players and spectators: your display name, avatar, chat and public gameplay are visible at your table. Cards are shown according to game rules. A private invitation restricts access; it does not make messages confidential or prevent another participant from recording them.
• Cloudflare: hosts the site, databases and game connections and provides delivery and security services. See Cloudflare’s privacy policy.
• Resend: when account email delivery is configured, receives the recipient email address and message content needed to send verification and password-reset emails. See Resend’s privacy policy.
• Advertising providers: receive information as described in section 6 when advertisements load.
• Authorised support and administrators: can access records needed for support, moderation and operation.

We may also disclose information where required by law or reasonably necessary to investigate abuse, protect people or legal rights, or resolve disputes. If the service changes ownership, information may transfer as part of that change, subject to applicable law and notice of material changes.

8. International processing

Our providers operate internationally, so information may be processed outside the country where you live, including in the United States. Privacy laws may differ between countries. Where applicable law requires safeguards for a transfer, we must use an appropriate lawful transfer mechanism or other permitted basis. Contact us for information about the safeguards applicable to your information.

9. Retention and deletion

Account records are generally kept while your account exists. Guest statistics and historical gameplay records are not automatically erased when a browser cookie expires. Support messages, reports and operational records may remain after the immediate interaction; we retain them for support, safety, troubleshooting, disputes and applicable legal requirements, and review deletion requests individually. Aggregate counters may be kept longer because they do not identify individual players. Cookie and session expiry is not a deletion schedule for database records.

Live tables are temporary. Public tables normally close after ten minutes without connected viewers, and private tables after 24 hours without connected viewers. Private invitation records also have an activity-based expiry. Closing a table removes live game state, but may leave its directory entry, completed-hand records, reports or diagnostic records.

Use Delete my account on the account page with your current password to remove your account, profile, account sessions, wallet, individual statistics, individual hand/tournament results and reports you submitted. This action does not automatically remove shared game-history records, private-table records, reports submitted by others, separately submitted contact messages or copies already received by other players. Contact us to request deletion or de-identification of remaining personal information, or if you cannot sign in. Backups and provider logs may retain copies until their retention cycles end; information may also need to be retained where law permits or requires it.

10. Your rights and requests

You can view your profile, statistics and recent results and edit supported profile settings on your account page. You may request access to or a copy of your personal information, correction, or deletion through the privacy contact form. Depending on the law that applies, you may also have rights to portability, restriction, objection, withdrawal of consent or opting out of targeted advertising. We will handle applicable requests within the time required by law and explain any lawful limits.

Please provide enough information to locate the relevant account, message or table and a reply address. We may need to verify your identity before disclosing or changing information; never send your password. For guest requests, retaining the browser that you used may help us verify the relevant identity. You may complain to your local privacy or data-protection regulator without giving up other legal rights.

11. Adults and security

The service is for people aged 18 or over, or the age of majority where they live if higher. We do not knowingly offer accounts to children. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

We use HTTPS, hashed passwords, protected session cookies, access controls and abuse controls. No online service is completely secure. Use a unique password and keep your account and invitation links safe. If a personal-information breach requires notification under applicable law, we will make the required notifications.

12. Changes to this policy

We will update this page and its date when our practices change. Where required, we will provide additional notice or obtain consent before a material change takes effect. Contact us through the contact form about this policy.