Privacy Policy

This Privacy Policy explains how Luna (“Luna,” “we,” “us”) collects, uses, shares, and safeguards information when you visit veryluna.com, create a Luna account, or use the Luna service (the “Service”). By using the Service you agree to the practices described here.

If you do not agree with this Policy, please do not use the Service. Capitalized terms not defined in this Policy have the meaning given to them in the Terms of Service.

1. Information we collect

1.1 Information you provide

• Account information. Your email address and a password (stored only as a salted hash — we never store the plaintext password).
• Content you submit. The messages you send to Luna, files and images you attach, notes you save, and any custom instructions you set.
• Billing information. If you subscribe, your payment is processed by Stripe. Stripe collects card details on its own infrastructure — Luna receives only an identifier, your subscription tier, and the status of your subscription (active, canceled, past‑due, etc.). Luna does not see or store your card number.
• Communications. If you contact support, we keep the contents of those messages so we can respond and improve the Service.

1.2 Information we collect automatically

• Usage data. Token consumption per request (used to enforce your monthly plan), timestamps, and which features you used (chat, image generation, web search, image analysis, notes).
• Page views. When you visit a page in the authenticated app, we record the path and your user ID so that admins can see aggregate product usage. We do not log IP addresses with these records.
• Cookies and local storage. A first‑party authentication cookie keeps you signed in; an anti‑forgery cookie protects forms from cross‑site request forgery; we use browser localStorage to remember UI preferences (for example, whether the sidebar is collapsed). We do not use third‑party advertising or analytics cookies.

2. How we use information

• To operate the Service — deliver model responses, generate images, run web searches, analyze attached images, and save your notes.
• To meter your monthly token usage and enforce subscription limits.
• To process payments through Stripe and apply, change, or cancel subscriptions you initiate.
• To send transactional email (for example, account‑confirmation and password‑reset messages) through our email provider.
• To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
• To debug errors, monitor performance, and improve the Service.
• To comply with applicable law and respond to lawful requests.

We do not use your conversations, notes, or uploads to train AI models. Luna does not sell your personal information, and we do not share it with advertisers.

3. How we share information

We share information only with the service providers required to run the Service (each acting as a processor on our behalf), and as required by law. Our current sub‑processors are:

Each of these providers has its own privacy policy. We require sub‑processors by contract to use information only to provide the service to us and to protect it with reasonable security.

We may also disclose information when we believe in good faith that disclosure is necessary to (a) comply with a law, regulation, legal process, or governmental request; (b) enforce our Terms of Service or investigate potential violations; (c) detect, prevent, or address fraud or security issues; or (d) protect against harm to the rights, property, or safety of Luna, our users, or the public.

If Luna is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to the receiving party honoring the commitments in this Policy or providing notice and choice.

4. Data retention

• Account data. Retained for as long as your account is active.
• Chat history, notes, and attachments. Retained until you delete them or close your account. Deleted items are removed from our active databases promptly; encrypted backups may retain them for a limited period before being overwritten in the normal course of business.
• Image‑analysis cache. Vision results are cached in memory for up to 24 hours so that re‑sending the same image in a follow‑up turn does not incur a second analysis cost. The persisted per‑attachment analysis is deleted with the attachment.
• Usage events. Retained for as long as needed to operate, audit, and bill the Service.
• Closed accounts. When you delete your account, we delete your content within 30 days, except where retention is required by law (for example, tax, accounting, or fraud‑prevention obligations) or is necessary to resolve open billing disputes.

5. Your rights and choices

Depending on where you live, you may have the right to access, correct, port, or delete your personal information, to withdraw consent, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority.

You can exercise the most common of these rights directly in the product:

• Access. Your chats and notes are visible in the app at any time while signed in.
• Delete. Delete individual chats, notes, or attachments from inside Luna. Delete your account from Settings → Account; this removes your content as described in § 4.
• Manage subscription. Open the Stripe Billing Portal from the Billing page to switch tiers or cancel.
• Email preferences. Luna sends only transactional email (no marketing) by default. If we add marketing email in the future, every message will include an unsubscribe link.

For requests we cannot fully service through the product (for example, a portable export of all account data), contact us at [email protected]. We may need to verify your identity before acting on the request.

We will not retaliate against you for exercising any of these rights.

6. Children’s privacy

Luna is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users between 13 and the age of majority in their jurisdiction must have consent from a parent or legal guardian to use the Service. If you believe a child has provided information to Luna, please contact [email protected] and we will delete it.

7. International data transfers

Luna’s infrastructure and several of our sub‑processors are located in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries that may have different data‑protection laws than your country. By using the Service, you consent to this transfer.

8. Security

We take reasonable administrative, technical, and organizational measures to protect information against loss, theft, and unauthorized access, disclosure, alteration, or destruction. Passwords are stored as salted hashes; traffic to and from the Service is encrypted in transit using TLS. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.

9. Region‑specific notices

9.1 If you are in the EEA, UK, or Switzerland

For the processing described in this Policy, the legal bases on which we rely are (a) performance of the contract between you and us (to provide the Service you signed up for), (b) compliance with legal obligations (for example, tax and anti‑fraud), and (c) our legitimate interests (for example, securing the Service, preventing abuse, and improving Luna), balanced against your rights.

9.2 If you are a California resident

Subject to certain exceptions, the California Consumer Privacy Act (as amended) gives you the right to know what personal information we collect, the right to request deletion or correction, and the right to opt out of the sale or sharing of personal information. Luna does not sell or share personal information for cross‑context behavioral advertising. To exercise any of these rights, email us at [email protected].

10. Third‑party links and content

Luna’s replies sometimes contain links to third‑party websites (for example, citations from a web search). Those sites have their own privacy policies; we are not responsible for them. Please review their policies before providing personal information.

11. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by updating the “Last updated” date above and, where appropriate, by additional notice (for example, an in‑product banner or email). Your continued use of the Service after the changes take effect constitutes acceptance of the revised Policy.

12. Contact

Questions about this Privacy Policy can be sent to [email protected].