Biometric data: weight, height, age, body fat percentage.
Meal photos: analyzed by artificial intelligence to estimate nutritional values. Photos may be stored securely in your account for reference, and are sent to Google's Gemini API for analysis.
Apple HealthKit data (if authorized): step count, active energy, sleep data.
Account identifier: Luna uses anonymous authentication. No personal email address or real name is required. An auto-generated identifier is used solely to secure and isolate your data.
2. How We Use Your Data
Your data is used exclusively to personalize your nutritional recommendations based on your menstrual cycle, your goals, and your physical activity.
3. Data Storage and Security
Data is stored securely on Supabase (hosted on Amazon Web Services).
Data access is protected by Row Level Security (RLS): each user can only access their own data.
Communications are encrypted in transit (HTTPS/TLS).
Nutritional calculations and cycle predictions are computed on your device. Meal photos, food logs, and cycle data are synced to our secure servers.
4. Data Retention
Your data is retained for as long as your account is active. When you delete your account, all personal data — including meal photos, food logs, cycle data, and health metrics — is permanently and immediately erased from our servers. Anonymous accounts that have been inactive for more than 12 months are automatically deleted along with all associated data, in accordance with GDPR data minimization principles.
5. Third-Party Services
Luna uses the following third-party services to operate:
Supabase (database hosting, AWS EU — Frankfurt, eu-central-1) — stores your profile, nutrition, and cycle data.
Google Gemini API (food photo analysis) — your meal photos are sent to Google's servers for AI analysis. Photos are processed in real-time and not stored by Google beyond the API call.
Apple HealthKit (optional) — reads steps, active energy, sleep, and menstrual data from your device. This data never leaves Apple's ecosystem except to sync with your Luna account.
RevenueCat (subscription management) — verifies in-app purchases and manages your subscription status. RevenueCat receives your anonymous user identifier and Apple purchase receipts. No health or nutrition data is shared with RevenueCat.
Sentry (crash reporting) — collects anonymous crash reports and performance data to help us identify and fix bugs. No health, nutrition, or cycle data is included in crash reports (explicitly stripped before transmission). Sentry receives device information (OS version, device model) and error stack traces.
PostHog (product analytics) — measures feature usage and retention so we can improve the app. PostHog receives your pseudonymous account identifier and interaction events only. No health data — cycle, symptoms, weight, food, or calories — is ever transmitted. Data is hosted in the European Union (PostHog EU cloud) and retained for 12 months.
6. International Data Transfers
Your data may be processed outside the European Economic Area (EEA) by our service providers (Supabase/AWS, Google). These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection.
7. Third-Party Sharing
Your data is never sold to third parties. However, the following data is shared with third-party services as part of the app's operation:
Google Gemini (Google LLC): meal photos are sent to the Google Gemini API for nutritional analysis. Google may process this data in accordance with its own privacy policy.
Supabase / AWS: secure data hosting and storage.
RevenueCat (RevenueCat Inc.): anonymous user ID and purchase receipts for subscription verification and management.
Sentry (Functional Software Inc.): anonymous crash reports and device diagnostics for application stability monitoring. Health data is explicitly stripped before transmission.
PostHog (PostHog Inc.): pseudonymous account identifier and interaction events for product analytics. No health, nutrition, or cycle data is transmitted. Hosted in the European Union and retained for 12 months.
8. Your Rights (GDPR)
In accordance with the General Data Protection Regulation (GDPR), you have the following rights:
Right of access: you can view all your data within the app.
Right to rectification: you can modify your personal data at any time in the settings.
Right to erasure: you can delete your account and all your data at any time. Deletion is permanent (CASCADE DELETE).
Right to portability: you can request an export of your data.
9. Cookies and Trackers
Luna is a native mobile app and does not use cookies. No advertising trackers are integrated into the app.
10. Children's Data
Luna is not intended for persons under the age of 16. If you are under 16, please do not use this app.
11. Contact
For any questions regarding the protection of your personal data, you may contact us at the following address: