Privacy policy

Last updated 5 October 2026

Who we are

Lunara ("we", "us") runs this app and is responsible for your data (the "data controller"). A dedicated email address for privacy questions will be added here shortly. Until then, you can download or delete all of your data yourself at any time from Settings.

What we collect

• Your account: your email address and your password. Your password is never stored as you typed it, only as a one-way scrambled version (a "hash") that can't be turned back into your password.
• What you enter in the app: your first name, the dates your periods start, your average cycle and period length, and the journal entries, moods, habits, goals, plans and settings you save.
• Invites: if you join through a friend's invite link, we record whose link it was, so they can see how many friends have joined. They never see who joined. Each account also gets its own invite code.
• Sign-in security: a cookie that keeps you signed in for 30 days, and a short-lived record of failed sign-in attempts (the email address and time) used to block password-guessing.
• Technical logs: like any website, our hosting provider records basic request information such as your IP address, browser type and the pages requested, to keep the service running and secure.

Your health data

Information about your menstrual cycle, and things you write about your mood or body, is health information. Data protection laws give it extra protection. We only process it because you gave your explicit consent when you created your account, and we only use it to run the app for you: working out your cycle phases, showing your calendar and saving your entries.

You can withdraw your consent at any time by deleting your account (Settings → Delete account). This removes your health data along with everything else.

How we use your data

• To create and secure your account and keep you signed in.
• To save your entries and sync them across the devices you sign in on.
• To send you account emails you ask for, such as a password reset link. We don't send marketing emails.
• To protect the service from abuse, such as blocking repeated failed sign-ins or reset requests.

Sharing is always your choice. Forecast cards are created on your device, and they only go where you send them. Lunara doesn't post anything for you.

We do not sell your data, share it with advertisers or data brokers, use it for advertising, or use it to make automated decisions about you.

Who else handles your data

• Cloudflare, Inc. hosts the app and its database on our behalf. Your account and app data is stored in Cloudflare's Western Europe region. Cloudflare's global network delivers the app, so your requests may pass through servers in other countries, including the United States. Cloudflare only processes this data on our instructions.
• An email delivery provider sends account emails, such as password reset links, on our behalf. It receives your email address and the content of that email, and nothing else.
• Google Fonts supplies the app's typefaces. When a page loads, your browser requests the fonts from Google, which receives your IP address. Google does not receive any of your account or health data.

Where data is transferred outside the UK or European Economic Area, we rely on our providers' standard legal safeguards, such as Standard Contractual Clauses.

We may disclose data if the law requires it, for example in response to a valid court order.

How long we keep it

• Account and app data: until you delete your account. Deletion removes it from our live database straight away. Our hosting provider's automatic database backups may hold a copy for up to 30 days before it is permanently gone.
• Failed sign-in records: about 15 minutes.
• Password reset links: they expire after 1 hour and stop working once used. Records of reset requests are kept for about an hour, to prevent abuse.
• Sign-in cookie: 30 days, or until you sign out.

Your rights

Depending on where you live (for example under UK or EU GDPR, or US state privacy laws such as California's), you may have the right to:

• Access and take your data: Settings → Download backup gives you a complete copy in a standard format (JSON).
• Correct it: edit anything directly in the app.
• Delete it: Settings → Delete account.
• Withdraw consent to us processing your health data, by deleting your account.
• Object to or restrict how we use your data, or ask us any question about it, by emailing us.
• Complain to a data protection authority, such as the Information Commissioner's Office (ICO) in the UK or your local authority in the EU.

We'll answer requests by email within one month. We will never treat you differently for using your privacy rights.

Security

All connections use HTTPS encryption. Passwords are hashed with PBKDF2-SHA256 and a unique random salt. Sign-in cookies can't be read by scripts on the page, and only a scrambled version of each cookie is stored on our side. No system is perfectly secure, but we take reasonable steps to protect your data, and we will tell you and the relevant authorities about any serious breach as the law requires.

Children

Lunara is not intended for anyone under 16, and we don't knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it.

Lunara is not medical advice

Lunara's phase predictions are estimates based on averages. They are not medical advice, and Lunara must not be used as contraception or to diagnose or treat any condition.

Changes to this policy

If we make important changes, we'll update the date at the top and, where the change affects how we use your health data, ask for your consent again.