Privacy Policy

1. Introduction

Luna is made by Dotty Apps LLC ("we", "us", or "our"). We are committed to protecting your privacy, especially because Luna is used by young people and handles sensitive health information.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights. Please read it carefully. If you have questions, email us at [email protected].

2. Information We Collect

Account information

When you create an account, we collect your email address. Your password is handled by Google Firebase — it is hashed and encrypted, and we never see it.

Period and health data

Before you make an account, data from Luna are only stored locally on your device. If you create an account, we store and sync your data to provide the app's backup service. You can delete your account and all your data at any time in Settings.

Luna collects the information you log such as period dates, cycle and period lengths, symptoms, mood, and any notes you write. This is sensitive health information and we take extra care to protect it.

Device information

We collect your device type, operating system version, and app version. This is used only to fix crashes and bugs.

Anonymous usage data

We collect anonymous events (like "opened the calendar screen") to understand how people use Luna and improve it.

Subscription information

If you subscribe, RevenueCat processes your payment. We receive a subscription status — not your payment card details.

Ask Luna questions

If you use Ask Luna, we receive the questions you type so we can answer them. Ask Luna first searches a library of answers written by public health professionals, then uses OpenAI to tailor an answer to your question. OpenAI receives the text of your question and a random code that stands in for your account. It does not receive your name, email address, or anything you have logged in Luna, such as your period dates, symptoms, or notes. OpenAI keeps questions and answers for up to 30 days.

We also store Ask Luna questions and Luna's answers on our servers, anonymously: they are not linked to your account, your name, or your email address. We store them for auditing and review, to improve Ask Luna, and to use as example questions inside the app. The developer reviews them with help from an AI tool. Because they aren't linked to your account, they are not deleted when you delete your account.

Example questions can be seen by other people using Luna. We remove any personal details first, and they never show who asked them.

Please don't put personal details like your full name, address, or phone number in your questions.

3. How We Use Your Information

Our legal bases for processing your information include:

• To provide and sync the app across your devices
• To authenticate your account (log you in securely)
• To establish age and parental consent as necessary
• To process your subscription through RevenueCat
• To answer the questions you ask Ask Luna
• To show anonymous example questions in Ask Luna, with personal details removed
• To fix crashes — Bugsnag receives device info and app state at crash time; no health data is included
• To improve the app — Mixpanel receives anonymous event names and device type only; no health data and no email
• To respond to your support requests
• To comply with the law

4. COPPA — Children Under 13

Luna complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from anyone under 13 without a parent or guardian's verifiable consent.

If you are under 13 — or under the minimum age set by the laws of your own country, which is higher than 13 in much of Europe — a parent or guardian must create your account with you as described in Section 6. By creating an account, a parent or guardian confirms their consent to the collection and use of their child's information as described in this policy.

Parents and guardians may contact us at [email protected] to:

• Review information collected about their child
• Request correction or deletion of that information
• Withdraw consent and have the account deleted

Ask Luna questions are the exception, because they are stored anonymously.

If we learn that we have collected personal information from a child under 13 without parental consent, we will delete it promptly.

5. Minimum Age by Country

Different countries set different ages at which a young person can agree to their own data being used. Below that age, Luna requires a parent or guardian. These are the ages Luna applies:

• United States — 13, under the Children's Online Privacy Protection Act (COPPA)
• United Kingdom — 13, under the UK GDPR
• Canada — 14, under PIPEDA and Quebec's Law 25. Law 25 sets 14; your device tells us your country but not your province, so we apply 14 everywhere in Canada.
• Australia — 15, under the Privacy Act 1988. When the Children's Online Privacy Code comes into effect, we will update our policies to comply with it.
• European Union, Norway, Iceland, and Liechtenstein — 16 under the GDPR, except Ireland, Denmark, Spain, and Poland (13); Austria and Italy (14); and France and Czechia (15)
• Everywhere else — 13

We work out which country you are in from your device's region setting. We do not use your location, your IP address, or anything else to check it.

6. How Consent Works

Setting up the app

When someone first sets up Luna, everything stays on their phone. The period dates, symptoms, and notes they log are saved only to that device. We cannot see them and we do not receive them. No account is needed to use the app this way.

The only things that reach us at this stage are crash reports and the anonymous usage data described in section 2. Neither contains anything a person has logged.

Agreeing to this policy

During setup we ask for agreement to three things separately: our Terms of Service, this Privacy Policy, and the processing of health data. Setup cannot continue until each one has been agreed to, and we record the date and time of each agreement.

Creating an account to back up data

Data only ever leaves the phone if someone chooses to back it up, and backing it up requires an account. Before that can happen we ask for a birthday, so that we can work out whether the person is old enough to agree for themselves in their country (see section 5).

If a child is under the age in their country

A child below that age cannot turn on backup by themselves. A parent or guardian has to agree first, and from then on they are the person consenting on the child's behalf. The parent creates their own Luna account, generates a code, and gives it to their child. The child enters that code on their own device, and the parent confirms it. Nothing is backed up before that confirmation.

Until a parent confirms, Luna keeps working on the child's phone exactly as before; it just doesn't back anything up. A child can also delete their own account at any time in Settings.

Parents can delete their child's data

A parent or guardian who has consented for a child below the age in their country can withdraw that consent at any time in the app. Withdrawing it deletes the child's account and everything backed up with it. Once the child is old enough to agree for themselves, their consent is their own: the parent can end the link, but only the child can delete the account.

7. Linked Parent and Guardian Accounts

Luna lets a parent or guardian link their account to their child's. The link is only created with the child taking part: the parent starts it, the child enters the code on their own device, and the parent confirms it. Nothing is shared before that.

Once a link is in place, the parent or guardian can view the child's period history, logged symptoms, and app settings. They cannot read notes the child writes, and they cannot add to or change their child's data.

If the child is under the minimum age in their country, their parent or guardian can delete the child's account and all of the data in it. Once the child is old enough to consent for themselves, they can unlink from the parent at any time.

8. GDPR — Users in the EU and UK

If you are in the European Union or the United Kingdom, additional rights apply to you under the General Data Protection Regulation (GDPR).

Data controller

Dotty Apps LLC is the data controller for your personal information. Contact: [email protected].

Legal basis for processing

• Contract performance — to provide the app service you signed up for
• Explicit consent — to process your health/period data (you give this consent at sign-up)
• Legitimate interest — for security and anonymous analytics
• Legal obligation — to comply with applicable laws

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure ("right to be forgotten") — you can do this in Settings → Delete my data
• Restrict how we process your data
• Data portability — receive a copy of your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time — this won't affect the lawfulness of processing before withdrawal

Where we store your information

Your information may be sent to and stored in countries outside your own, which may have different data protection laws. Wherever it goes, we do everything we can to keep it safe and to make sure it is handled the way this policy describes.

Right to complain

If you think we have handled your data wrongly, you can complain to the data protection authority where you live.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal data we collect, use, or share
• Right to delete your personal data
• Right to opt out of the sale or sharing of your personal data — we do not sell your data
• Right to non-discrimination for exercising these rights

To exercise any of these rights, email [email protected].

10. Health Data Privacy Notice

This section applies to Washington and Nevada residents and describes how Luna handles health data under the Washington My Health MY Data Act and applicable Nevada privacy law.

Collection of Health Data

Luna collects the following categories of health data about you:

• Reproductive and sexual health information, including menstrual cycle dates and associated symptoms;
• Information about health conditions and symptoms you choose to log; and
• Other health and wellbeing information you provide, such as your age and logs for pain, sleep, mood, energy, and motivation.

Sources of Health Data

We collect health data directly from you when you create an account, use the app (including when you track periods, log symptoms, or browse the learning library), request support, or otherwise communicate with us.

Use of Health Data

We use health data for the following purposes:

• Service delivery: to create and maintain your profile, track menstrual cycles and symptoms, and ensure the secure and reliable operation of the app.
• Protection and compliance: to detect and help prevent security incidents or fraudulent activity, protect the rights and property of Luna and our users, and meet our legal obligations.

We may use health data for additional purposes with your consent, as required by law.

Disclosure of Health Data

We may share health data only in the limited circumstances below:

• Service providers: third parties who need access to perform services on our behalf (such as cloud hosting and backup), subject to confidentiality obligations.
• Legal authorities: when disclosure is required by law, a valid legal process, or to protect the safety, rights, or property of Luna, our users, or the public.
• Corporate transactions: in connection with a merger, acquisition, or sale of all or a portion of our business, subject to confidentiality commitments.
• With your consent: when you direct us to share your data or otherwise give explicit consent.

We do not sell your health data.

Your Rights

You may request to access, delete, or withdraw consent for our processing of your health data, subject to certain exceptions. To exercise any of these rights, email us at [email protected].

If we deny your request, you may appeal by emailing [email protected]. If your appeal is unsuccessful, you may raise a concern with the Attorney General in your state.

11. Who We Share Your Data With

We only share your data with trusted service providers who help us run Luna:

• Google / Firebase — handles account authentication and encrypted cloud backup. Firebase's own Privacy Policy governs how they process your data.
• Railway — hosts the servers and database that hold your synced data.
• Backblaze — stores encrypted backup copies of our database so your synced data can be recovered if something goes wrong.
• OpenAI — powers Ask Luna. They receive only the questions you type and a random code in place of your account — no email address and none of your logged health data.
• Anthropic — its AI assistant, Claude, helps the developer review Ask Luna conversations. It receives anonymous Ask Luna questions and answers, with no link to your account, no email address, and none of your logged health data.
• Expo — delivers app updates. They receive your device type, app version, and similar technical details — no health data.
• Google Sign-In and Sign in with Apple — used only if you choose one of them to sign in. They confirm your identity to us; they do not receive your health data.
• RevenueCat — manages subscriptions. They receive only a subscription identifier, never your health data.
• Mixpanel — anonymous app analytics. They receive only event names and device type — no health data, no email address.
• Bugsnag — crash reporting. They receive device information and app state at the time of a crash — no health data.

We do not sell your data. We do not share your health data with advertisers or data brokers.

No advertising or tracking

Luna contains no advertising SDKs of any kind. There is no ad network, no attribution or install-tracking SDK, no social media SDK, and no data broker code anywhere in the app. We do not show you ads, we do not build an advertising profile of you, and we do not let anyone else track you across other apps or websites.

We also do not collect your location. Luna does not ask for location permission, does not use GPS, and does not look up where you are from your IP address. The only thing we read about where you are is your device's country setting, which we use to work out the minimum age that applies to you (see section 5).

We may disclose your data if required by law, to protect user safety, or to enforce our Terms of Service.

If Dotty Apps LLC is acquired or merged, your data may transfer to the new owner. The new owner must honor the commitments in this policy.

12. Data Retention

We keep your data for as long as your account is active. When you ask us to delete your account (Settings → Delete my data), we process the request within 30 days. Backup copies are fully purged within up to 90 days. Ask Luna questions and answers are the exception: they are stored anonymously, so they are kept after your account is deleted (see section 2).

You can also delete your data on this device only through the same settings menu.

13. Security

Your data is encrypted on your device, at rest, and in transit.

If you believe your account has been compromised, contact us immediately at [email protected] and change your password.

14. Third-Party Links

Luna may link to outside websites (like health resources). This Privacy Policy does not apply to those sites. Please read their privacy policies before sharing your information with them.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Continuing to use Luna after the changes take effect means you accept the updated policy.

16. Contact Us

Have questions about your privacy or want to exercise your rights? We're here to help.

Email: [email protected]
Dotty Apps LLC

We'll respond to all privacy requests within 30 days.