Privacy Policy

This policy explains what personal information Luna Sky LLC collects, why we collect it, who else sees it, and the choices and rights you have. It covers 12lunasky.com and every application and service we publish.

1. The short version

• We collect what we need to run your account, deliver what you asked for, keep the Service working, and meet our legal obligations.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• Payment card details never reach us. Apple, Google and our payment processor handle them.
• You can see, correct, export or delete your information at any time by writing to us, and you can delete your account yourself. A short list of records — tax, consent and fraud records — survives deletion because the law requires it; our Account Deletion page lists them.

2. What we collect

Category	Examples	Where it comes from
Identifiers and account data	Name or display name, email address, account ID, and a salted cryptographic hash of your password — we never store the password itself	You, when you register
Contact and enquiry data	Your name, email, and the content of messages you send us	You, when you contact us
Profile and preference data	Language, topics you follow, notification settings, saved items, goals and journal entries you create	You, as you use the Service
Habit, goal and progress data	Habits and goals you set, streaks, and what you marked complete — all entered by you. See section 13	You, as you use the Service
Age-screen result	Whether you told us you are 18 or over, or 13–17. A neutral age screen is shown once at registration; we store the answer, not a date of birth. If you tell us you are under 13, registration stops, no account is created, and we keep no record of the answer beyond a flag on your own device that prevents an immediate retry	You, at registration
Optional personal detail you choose to enter	Date of birth, and where a reflective feature asks for it, time and place of birth. This is separate from the age screen above and is never required	You, only if you choose to provide it
Purchase records	Which plan you bought, when, and its status. Not your card number	Apple, Google, or our payment processor
Device and diagnostic data	Device model, operating system version, app version, crash reports, performance data, approximate region derived from IP address	Automatically, as you use the Service
Usage data	Which screens and content you opened, and when	Automatically, as you use the Service
Website logs	IP address, browser type, pages requested, referring page	Automatically, for security and reliability

We do not collect government identification numbers, precise geolocation, biometric data, contact lists, health records, or data from HealthKit or Google Fit.

3. Sensitive personal information

Three categories deserve their own paragraph.

Birth date, time and place. Where a reflective feature calculates positions from a birth moment, we need that data to perform the calculation. It is optional, you can leave it blank or enter an approximate value and still use the rest of the Service, and you can remove it at any time from Settings → Profile → Birth details → Remove. Depending on where you live, it may be treated as sensitive personal information because it can imply a philosophical belief. We use it only to produce the material you asked for. We never use it to infer characteristics about you for advertising, and we never sell or share it.

Anything you write. Journal entries, reflections and notes are yours. We store them so you can read them back. We do not read them to profile you, we do not use them to target advertising, and we do not disclose them to anyone except as section 6 describes.

Your account credentials. Under California law, log-in credentials are sensitive personal information. We store only a salted hash of your password, we use it for nothing except signing you in, and we never disclose it.

If you are in California, section 11 explains your right to limit the use of sensitive personal information. We already use all three categories only for the purpose you gave them to us for.

4. Why we use it

• To provide the Service — run your account, deliver the content and features you asked for, save your progress across devices.
• To take payment and manage subscriptions — confirm entitlements, renewals and cancellations.
• To support you — answer your messages and investigate problems you report.
• To keep the Service working and secure — diagnose crashes, prevent fraud and abuse, protect our systems and our users.
• To improve what we publish — understand, in aggregate, which material people find useful.
• To communicate with you — service messages about your account always; marketing messages only if you asked for them, and you can stop those at any time.
• To meet legal obligations — accounting, tax, and responding to lawful requests.

We do not use your information for a materially different purpose than the one it was collected for without telling you first and, where the law requires it, obtaining your consent. We do not use your personal information to make decisions about you that produce legal or similarly significant effects, and we do not profile you for advertising.

4.1 Legal bases, for people in the EEA and the UK

We rely on: performance of a contract for account, content and subscription processing; legitimate interests for security, fraud prevention, and aggregate product improvement; consent for optional birth data, marketing messages and any non-essential cookies, which you may withdraw at any time; and legal obligation for accounting and compliance records. Where optional birth data could imply a philosophical belief, we rely on your explicit consent under Article 9(2)(a).

5. How long we keep it

Category	Retention
Account and profile data	While your account is active; deleted within 30 days of a deletion request
Content you created (journals, saved items)	While your account is active; deleted with the account
Habit, goal and progress data	While your account is active; deleted with the account
Age-screen result	While your account is active; deleted with the account. Where the answer prevented registration, no record is kept
Optional birth date, time and place	While your account is active; deleted with the account, or sooner if you remove it
Usage data (screens and content opened)	Up to 14 months, then aggregated or deleted
Support correspondence	Up to 24 months, unless it relates to an unresolved dispute
Crash and diagnostic data	Up to 12 months
Website and security logs	Up to 12 months
Fraud and abuse records	Up to 24 months, in the narrowest form that serves the purpose
Subscription and auto-renewal consent records	Three years, or one year after the subscription ends, whichever is longer, as consumer-protection law requires
Purchase and tax records	Up to seven years, to meet our tax, accounting and audit obligations

When a retention period ends, we delete the data or irreversibly de-identify it. If you delete your account, everything above is deleted within 30 days except the records listed as exceptions on our Account Deletion page, which is the authoritative list.

6. Who else sees your information

We disclose personal information only to parties who need it to deliver the Service, and only for the purposes below:

• Hosting and cloud infrastructure providers that store and serve the Service on our instructions.
• Crash reporting and product analytics providers, so we can find and fix faults and understand aggregate usage.
• Email and customer-support providers we use to reply to you.
• Payment processors, to take payment and manage subscriptions.
• Apple and Google, as the platforms and payment providers for our applications.
• Third-party artificial-intelligence providers, where a feature depends on them. See section 7.
• Professional advisers — accountants and lawyers — under a duty of confidence.
• Authorities or other parties, where we are required by law, by court order, or where necessary to protect the rights, safety or property of Luna Sky, our users or the public.
• A successor, if we are acquired or merged. We will tell you before your information transfers, this policy continues to apply to it, and the acquirer may change it only on notice to you and subject to the choices this policy and the law give you — including deleting your account before any change takes effect.

7. Artificial intelligence

Some features may use artificial-intelligence models, including models operated by third-party providers, to generate or personalise text. Where any content you provide would be sent to an external AI service, we tell you at that point and ask your permission before sending it. You can decline and continue to use the rest of the Service.

Permission is off by default, is asked for separately for each feature, and can be withdrawn at any time in Settings → Privacy → AI features without losing access to the rest of the Service.

Where we use such providers, our contracts prohibit them from using your content to train their models. AI-generated output is produced by software, not by a person, and may be inaccurate — see our Disclaimer.

8. We do not sell or share your information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act and comparable state laws. We have not done so in the preceding twelve months, and we do not sell or share the personal information of minors under 16.

We do not use third-party advertising networks or advertising identifiers in our applications. If this ever changes, we will update this policy, tell you before the change takes effect, and publish a working opt-out control that also honours the Global Privacy Control browser signal.

9. International transfers

We are based in the United States and our providers may operate in the United States, the European Union, the United Kingdom and elsewhere. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy law differs from the law where you live.

Where information about people in the EEA or the UK is transferred out of those regions, we rely on the European Commission’s Standard Contractual Clauses and, for the United Kingdom, the International Data Transfer Addendum. Wherever the data sits, this policy and those contractual protections travel with it.

We have no establishment in the European Union or the United Kingdom. We control the territories in which our applications are offered, and until we appoint a representative under Article 27 of the GDPR and of the UK GDPR we do not make them available for download in the EEA or the United Kingdom. When we do make them available there, we will appoint that representative and publish their name and address in this section first.

If you are in the EEA or the United Kingdom and use our website or Service in the meantime, this policy applies to you in full: the rights in section 11 are yours, the consumer rights described in our Terms and our Refunds and Cancellations policy are yours, you may contact us directly at contact@12lunasky.com, and you may complain to your local supervisory authority.

10. Security

Traffic is encrypted in transit using HTTPS/TLS, and stored data is encrypted where the underlying service supports it. Access is limited to the people who need it and removed when they no longer do. Administrative accounts require multi-factor authentication. We keep no payment card data on our systems. We test backups and log administrative access.

No system is perfect. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires, and without undue delay.

11. Your rights and choices

Wherever you live, you may ask us to:

• Know what personal information we hold about you, where we got it, why we use it, and who we disclose it to;
• Access a copy, in a portable, machine-readable format;
• Correct anything inaccurate;
• Delete your information, in whole or in part, without deleting your account if you prefer;
• Opt out of marketing messages;
• Withdraw consent you previously gave, including for optional birth data or AI features;
• Limit the use of sensitive personal information to what is necessary to provide the Service — which is already all we do with it;
• Opt out of the sale or sharing of your personal information. We do not sell or share it, so there is nothing to opt out of, and that is why there is no “Do Not Sell or Share My Personal Information” link on our site;
• Object to or restrict processing, and be free from decisions made solely by automated means that produce legal or similarly significant effects — we make none;
• Ask for a list of the specific third parties to whom we disclosed your personal information, if you live in a state that grants that right;
• Not be discriminated against for exercising any of these rights. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

11.1 How to exercise them

Email contact@12lunasky.com from the address on your account, or use the controls inside the app. If you write from a different address we will send a confirmation code to the address on the account before acting, because acting on an unverified request would itself put your data at risk.

We aim to acknowledge every request within 2 business days, and will do so within 10 business days at the latest, and complete it within 45 calendar days if you are in the United States, or within one month if you are in the EEA or the United Kingdom. Where a request is complex we may extend once and will tell you why within that original period: by a further 45 days in the United States, or by up to two further months in the EEA and the United Kingdom. Exercising these rights is free.

An authorised agent may submit a request on your behalf with written permission signed by you; we may still contact you to confirm.

11.2 If we say no

We will tell you why. You may appeal by replying to our decision with the word Appeal in the subject line; a different person will review it and respond within 45 days. If we deny your appeal, you may contact your state attorney general. Residents of the EEA and the UK may also complain to their local data protection supervisory authority.

12. California disclosures

In the preceding twelve months we collected the categories of personal information listed in section 2, from the sources listed there, for the business purposes listed in section 4, and disclosed them to the categories of recipients listed in section 6. Under the California Consumer Privacy Act these correspond to: identifiers; customer records information; commercial information; internet or other electronic network activity; geolocation data, limited to the approximate region derived from your IP address; and sensitive personal information in the form of account log-in credentials and, if you provide it, a philosophical belief that could be inferred from birth data. We apply the same restrictions to journal entries and notes that we apply to sensitive personal information, whether or not they meet the statutory definition.

We did not sell or share any personal information, and we do not offer financial incentives in exchange for personal information.

13. Consumer health data

Washington State, Nevada and Connecticut give people specific rights over “consumer health data” — information that identifies a person’s past, present or future physical or mental health status, including data used to infer it. This section is our statement about that category, and it applies to everyone, not only residents of those states.

This section is linked from the footer of every page as our Consumer Health Data notice. If we ever intend to process information that would qualify as consumer health data, we will replace this section with a standalone Consumer Health Data Privacy Policy at that same link, obtain your consent before collecting anything, and obtain a separate signed authorization before sharing anything — before we begin, not afterwards.

To ask a question about this section, or to exercise a right under a consumer health data law, email contact@12lunasky.com with Consumer health data in the subject line.

14. Cookies and similar technologies

Our website stores only what it needs to work and to remember your preferences. We do not use advertising cookies and we do not track you across other websites. We set no analytics or other non-essential cookie until you agree to it — the consent basis described in section 4.1 — and refusing leaves the site fully usable. Where analytics runs with your agreement, it is configured not to build cross-site profiles.

Our applications use local device storage to keep you signed in and to save your settings and offline content. You can clear it by signing out or deleting the app.

If we ever want to set anything beyond the essentials, we will ask first, and refusing will be as easy as agreeing.

15. Third-party links

Our sites and apps may link to services we do not operate. We are not responsible for their content or their privacy practices, and this policy does not apply to them. Read their policies before providing information.

16. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are 13 or older but under 18, you may use the Service only with the agreement and supervision of a parent or guardian, and only they may make a purchase. We ask for age at registration through a neutral age screen.

A parent or guardian may write to contact@12lunasky.com to review or delete a child’s information. We act on a deletion request without requiring you to prove a purchase or produce identity documents. For a request to see the information, we first confirm the relationship and the account, using the least information that lets us do so safely. If we learn we have collected information from a child under 13, we delete it promptly.

We do not show behavioural or interest-based advertising to anyone, and we do not build advertising profiles of minors.

17. Changes to this policy

The current version is always at 12lunasky.com/privacy with the date it took effect. If a change materially affects you, we will announce it inside the Service or by email before it takes effect. We review this policy at least once a year.

18. Contact us

Privacy questions, requests and complaints: