Last reviewed: September 1, 2026
Local browser storage
Mesozoic Haven uses limited browser local storage for small site preferences. This currently includes optional accessibility settings, dismissed notices, and whether an optional browser-notification prompt should wait before asking again.
These values stay in that browser unless site data is cleared. They are not used by Mesozoic Haven for advertising, cross-site tracking, profiling, or identifying a visitor.
Cookies & tracking
Mesozoic Haven does not set advertising or analytics cookies for normal browsing, and there is no site-wide tracking cookie system.
If you choose to sign in, Mesozoic Haven sets one strictly necessary session cookie named __Host-mh_session. It exists only to keep that browser signed in. The cookie is HTTPS-only, unavailable to page JavaScript, and not used for analytics, advertising, profiling, or cross-site tracking.
If “Keep me signed in on this device” is not selected, the browser cookie is a session cookie and the server-side session expires after a limited period. If it is selected, the login may persist for up to 30 days. Signing out removes the browser cookie and invalidates that server-side session.
Accounts
Accounts are optional and do not require an email address. An account stores a username, public nickname, password-verification data, account timestamps needed to operate sign-in, and limited site settings such as future comment-trust status.
Passwords are never stored in plain text or in reversible form. Mesozoic Haven stores a unique random salt and a PBKDF2-HMAC-SHA-256 derived password hash. Recovery codes are generated randomly, shown to the account owner, and stored only as cryptographic hashes. Each recovery code can be used once.
There is no social-login profile, advertising identifier, behavioral tracking profile, or mandatory email identity attached to an account.
Browser notifications
Signed-in users may optionally enable browser push notifications on individual devices. Permission is requested only after the user chooses to enable notifications.
Each enabled browser creates its own Web Push subscription. Mesozoic Haven stores the subscription endpoint and the public subscription keys needed to deliver notifications, linked to the signed-in account. No browser fingerprint is created. A user may enable notifications on multiple devices and disable a device at any time.
The browser's own push infrastructure may be operated by its platform provider, such as Apple, Google, or Mozilla. Mesozoic Haven uses the Web Push standard and does not use those subscriptions for advertising or analytics.
Comments
Comments are enabled only on selected pages. Guest commenting remains available without an account. A nickname and comment are required. Email is optional and is never displayed publicly.
For abuse prevention, Mesozoic Haven derives a short-lived server-side abuse identifier using an HMAC of the connection IP address with a private secret. The raw IP address is not stored in the comments database. Temporary abuse identifiers and related events are designed to expire after a limited retention window.
If an optional email address is supplied on a guest comment, it is used only for transactional comment notifications. Rejected, spam, severe-spam, and deleted comments discard the stored email address. Approved comments may retain it for comment-notification purposes.
Optional guest comment email delivery
If transactional comment email is configured, Mesozoic Haven may use Resend only for an optional notification requested by a guest commenter who supplied an email address. Account sign-in does not depend on Resend or email delivery.
If you do not provide an email address on a guest comment, no commenter email is stored for that comment and no notification information is sent to an email provider.
Third-party services
Some pages may include or link to external services such as Discord, Root, or live-streaming platforms. When an external embed loads, that provider may receive ordinary connection information and may apply its own cookies, local storage, or other privacy practices.
Cloudflare Turnstile may be used on forms, comment submission, account creation, sign-in, and account recovery to reduce automated abuse. Optional Web Push delivery uses the browser platform's push service only after the user opts in.
Mesozoic Haven keeps third-party embeds limited, lazy-loads them where practical, and provides normal fallback links so the core site does not depend on them.
Server and platform logs
Like most websites, the hosting and delivery platform may process standard technical information needed to deliver pages, protect the service, diagnose failures, and operate its network. Mesozoic Haven does not add a separate advertising-tracking layer for normal site use.
Future changes
If Mesozoic Haven later adds analytics, advertising, expanded account features, or another feature that materially changes how visitor information is handled, this page should be updated before or alongside that feature. Privacy-friendly or self-hosted options are preferred where practical.
Questions or concerns?
If something on the site raises a privacy question, the current contact path is the Mesozoic Haven community. Please avoid posting sensitive personal information publicly when asking for help.