Privacy Policy

1. Introduction

Luna is made by Dotty Apps LLC ("we", "us", or "our"). We are committed to protecting your privacy, especially because Luna is used by young people and handles sensitive health information.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights. Please read it carefully. If you have questions, email us at [email protected].

2. Information We Collect

Account information

When you create an account, we collect your email address. Your password is handled by Google Firebase — it is hashed and encrypted, and we never see it.

Period and health data

Luna collects the information you log such as period dates, cycle and period lengths, symptoms, mood, and any notes you write. This is sensitive health information and we take extra care to protect it.

Device information

We collect your device type, operating system version, and app version. This is used only to fix crashes and bugs.

Anonymous usage data

We collect anonymous events (like "opened the calendar screen") to understand how people use Luna and improve it.

Subscription information

If you subscribe, RevenueCat processes your payment. We receive a subscription status — not your payment card details.

Chat with Luna (AI assistant)

Luna includes an optional AI chat feature ("Ask Luna") that answers questions about periods, puberty, and growing up. When you send a message, the text of that message is sent to our AI provider, OpenAI, to generate a reply. We send only the text you type — never your name, email address, birthdate, or the period and symptom data you have logged.

OpenAI stores your chat messages and replies for about 30 days and then deletes them, and our team may review chats to keep the feature safe and age-appropriate. Your chats are not saved inside Luna and are not synced between your devices. For any child linked to a parent or guardian who is under 18, this feature stays off until the parent turns it on.

3. How We Use Your Information

• To provide and sync the app across your devices
• To authenticate your account (log you in securely)
• To process your subscription through RevenueCat
• To fix crashes — Bugsnag receives device info and app state at crash time; no health data is included
• To improve the app — Mixpanel receives anonymous event names and device type only; no health data and no email
• To answer your questions in the optional "Ask Luna" chat — the text of your message is sent to OpenAI to generate a reply; the health data you log elsewhere in the app, your name, and your email are not sent
• To respond to your support requests
• To comply with the law

4. COPPA — Children Under 13

Luna complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from anyone under 13 without a parent or guardian's verifiable consent.

If you are under 13, please ask a parent or guardian to create your account with you. By creating an account, a parent or guardian confirms their consent to the collection and use of their child's information as described in this policy.

Parents and guardians may contact us at [email protected] to:

• Review information collected about their child
• Request correction or deletion of that information
• Withdraw consent and have the account deleted

If we learn that we have collected personal information from a child under 13 without parental consent, we will delete it promptly.

The optional "Ask Luna" AI chat is turned off for every child who is linked to a parent or guardian and under 18, until the parent or guardian chooses to turn it on.

5. GDPR — Users in the EU and UK

If you are in the European Union or the United Kingdom, additional rights apply to you under the General Data Protection Regulation (GDPR).

Data controller

Dotty Apps LLC is the data controller for your personal information. Contact: [email protected].

Legal basis for processing

• Contract performance — to provide the app service you signed up for
• Explicit consent — to process your health/period data (you give this consent at sign-up)
• Legitimate interest — for security and anonymous analytics
• Legal obligation — to comply with applicable laws

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure ("right to be forgotten") — you can do this in Settings → Delete my data
• Restrict how we process your data
• Data portability — receive a copy of your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time — this won't affect the lawfulness of processing before withdrawal

Where we store your information

Your information may be transferred to and stored in countries outside your own, including countries that may have different data protection laws. Whenever we do this, we take appropriate steps to ensure your information is handled safely and in accordance with this Privacy Policy.

Right to complain

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data correctly.

6. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal data we collect, use, or share
• Right to delete your personal data
• Right to opt out of the sale or sharing of your personal data — we do not sell your data
• Right to non-discrimination for exercising these rights

To exercise any of these rights, email [email protected].

7. Health Data Privacy Notice

This section applies to Washington and Nevada residents and describes how Luna handles health data under the Washington My Health MY Data Act and applicable Nevada privacy law.

Collection of Health Data

Luna collects the following categories of health data about you:

• Reproductive and sexual health information, including menstrual cycle dates and associated symptoms;
• Information about health conditions and symptoms you choose to log; and
• Other health and wellbeing information you provide, such as your age and logs for pain, sleep, mood, energy, and motivation.

Sources of Health Data

We collect health data directly from you when you create an account, use the app (including when you track periods, log symptoms, or browse the learning library), request support, or otherwise communicate with us.

Use of Health Data

We use health data for the following purposes:

• Service delivery: to create and maintain your profile, track menstrual cycles and symptoms, and ensure the secure and reliable operation of the app.
• Protection and compliance: to detect and help prevent security incidents or fraudulent activity, protect the rights and property of Luna and our users, and meet our legal obligations.

We may use health data for additional purposes with your consent, as required by law.

Disclosure of Health Data

We may share health data only in the limited circumstances below:

• Service providers: vendors and contractors who need access to perform services on our behalf (such as cloud hosting or customer support), subject to confidentiality obligations.
• Legal authorities: when disclosure is required by law, a valid legal process, or to protect the safety, rights, or property of Luna, our users, or the public.
• Corporate transactions: in connection with a merger, acquisition, or sale of all or a portion of our business, subject to confidentiality commitments.
• AI chat provider: if you type health information into the optional "Ask Luna" chat, the text of that message is shared with OpenAI to generate a reply, retained by OpenAI for about 30 days, and may be reviewed by our team to keep the feature safe. The health data you log in the rest of the app is not sent.
• With your consent: when you direct us to share your data or otherwise give explicit consent.

We do not sell your health data.

Your Rights

You may request to access, delete, or withdraw consent for our processing of your health data, subject to certain exceptions. To exercise any of these rights, email us at [email protected].

If we deny your request, you may appeal by emailing [email protected]. If your appeal is unsuccessful, you may raise a concern with the Attorney General in your state.

8. Who We Share Your Data With

We only share your data with trusted service providers who help us run Luna:

• Google / Firebase — handles account authentication and encrypted cloud backup. Firebase's own Privacy Policy governs how they process your data.
• RevenueCat — manages subscriptions. They receive only a subscription identifier, never your health data.
• Mixpanel — anonymous app analytics. They receive only event names and device type — no health data, no email address.
• Bugsnag — crash reporting. They receive device information and app state at the time of a crash — no health data.
• OpenAI — powers the optional "Ask Luna" AI chat. When you send a chat message, OpenAI receives the text of that message to generate a reply and retains it for about 30 days before deleting it. OpenAI acts as our service provider (subprocessor) under a data processing agreement, and does not use messages sent through its API to train its models. For a child under 18 who is linked to a parent or guardian, chat stays off until the parent enables it.

We do not sell your data. We do not share your health data with advertisers or data brokers.

We may disclose your data if required by law, to protect user safety, or to enforce our Terms of Service.

If Dotty Apps LLC is acquired or merged, your data may transfer to the new owner. The new owner must honor the commitments in this policy.

9. Data Retention

We keep your data for as long as your account is active. When you delete your account (Settings → Delete my data), we delete your cloud data immediately. Backup copies are purged within 30 days.

You can also delete your data on this device only through the same settings menu.

Messages you send in the optional "Ask Luna" chat are stored by our AI provider, OpenAI, for about 30 days and are then automatically deleted. Luna keeps no copy of your chats. To have a specific chat deleted sooner, email us at [email protected].

10. Security

We protect your data with encryption in transit (TLS). Data stored on your device is protected by your device's built-in encryption (iOS Data Protection and Android file-based encryption). No method of transmission or storage is 100% secure, but we follow industry best practices to keep your information safe.

If you believe your account has been compromised, contact us immediately at [email protected] and change your password.

11. Third-Party Links

Luna may link to outside websites (like health resources). This Privacy Policy does not apply to those sites. Please read their privacy policies before sharing your information with them.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Continuing to use Luna after the changes take effect means you accept the updated policy.

13. Contact Us

Have questions about your privacy or want to exercise your rights? We're here to help.

Email: [email protected]
Dotty Apps LLC

We'll respond to all privacy requests within 30 days.