Privacy and security

The stance

• No advertising, no data brokers, no behavioral tracking.
• No data sale, and no third parties beyond a short, named list in the policy.
• Crash reports, when crash reporting is on, are scrubbed on the device first — health data, notes, dates, and identity are removed before anything is sent.
• An account is optional: logging, history, and estimates work without one, and before you sign in nothing leaves the device.

On your device

The local database sits inside your device's own encryption (iOS Data Protection or Android device encryption), and its contents are shown only after your face, fingerprint, or passcode. On top of that: an optional in-app PIN, automatic relocking after inactivity plus immediate locking when you leave the app, and app-switcher previews that are masked. The database is also excluded from cloud backups on both platforms, so a copy of it never leaves your control.

In sync — stated plainly

Sync is not end-to-end encrypted. When you sign in and turn sync on, entries travel over TLS (1.2/1.3) and are stored in Supabase's Postgres, which encrypts data at rest with AES-256 — the same platform-level protection any well-run cloud database uses. lunarlog does not encrypt entry content on your device before it reaches Supabase: your entries are readable Postgres columns protected by row-level security and Supabase's own infrastructure controls, not by a cipher only your devices hold. That is the trade-off, stated in the open, and the policy's security section says the same.

What row-level security means in practice: the database refuses to return a row to anyone whose guardian memberships don't entitle them to it. Each accepted guardian — each role, exactly — sees what their role allows, and no more.

The browser app is built to a stricter rule than the phone apps: it keeps nothing at rest. No copy of your entries is ever written to browser storage, so closing the tab leaves none of them behind in that browser. What keeps you signed in is a cookie that no script on the page can read; the short-lived token the page itself uses lives only in the open tab's memory. The policy's security section describes exactly what that means.

What never leaves with your data

Guardian alerts ride the same push infrastructure as any app's notifications, but the payload carries only a push token and a profile identifier — never a note, tag, flow level, date, or profile name. What appears on a lock screen is fixed generic text.

Family data, including minors'

lunarlog is licensed for people 13 and older. Someone under 13 does not sign up: a parent creates the profile and invites them through the app, and accepting that invitation is the record of parental consent. Minor profiles get exactly the same protections as adult ones — the same row-level security, the same transport and storage encryption — and nothing about a minor's profile is shared or analyzed. In keeping with the app's own transparency, guardian notes on a young person's profile are visible to every guardian — including the young person, once they hold an account on their own profile. The app never offers a hidden note about a child.

Deleting, and how long things are kept

Deleting your account in the app deletes the server rows and the account immediately and permanently — not a request queued for later. Individual entries and whole profiles can be deleted any time. A few narrow bookkeeping records (an alert delivery record, merge disclosures, change history) delete themselves on fixed schedules, measured in weeks or months — the policy's retention section lists every one.