Privacy Policy

Last updated 9 October 2026

This Privacy Policy explains what personal data Lunaz collects, why we collect it, who we share it with, and the rights you have. It is written for the product as it works today: a companion chat, a manifestation list, Magic (signs and synchronicities), and calculated readings.

Lunaz is operated from Portugal. We are the controller of personal data processed through lunaz.app. The only contact for privacy, deletion, and data-protection questions is hello@lunaz.app. Please do not send extra personal data in that email beyond what we need to help you.

1. What we collect

We collect what we need to run your account and the companion. If you agree to advertising cookies, we also run the Meta (Facebook) Pixel on public website pages (Home, Manifestation, Guides, Privacy and Terms) so we can measure advertising — page views and, on a separate account confirmation page, a CompleteRegistration event for a newly confirmed free account. This includes an opaque identifier to avoid counting the same registration again. After Stripe confirms a paid membership, the payment-confirmation page can also send a Subscribe event with the amount paid, currency and an opaque identifier to avoid counting it twice. The Pixel does not load until that consent is given. With your permission, our server also sends CompleteRegistration and successful euro membership payment events (Purchase) to Meta through its Conversions API. These include a SHA-256 hashed email address, advertising cookie identifiers when available, browser user-agent for website events, event time and an opaque event identifier. Purchase includes the amount actually paid and currency, including renewal payments while consent remains valid. A hashed email can still be matched to you by Meta; it is not anonymous data. It is not loaded on private chat or reading pages. We do not run session-replay tools.

Account

If you create an account with email and password, we store your email address and a hashed password. We do not store your password in a form we can read.

If you sign in with Google, Google shows you what it will share. We receive the identifiers Google returns for Sign-In — typically your name, email address, and profile picture — and we store those on your account. Google is a separate controller for how it handles Sign-In; see Google's Privacy Policy.

Profile, birth data, and readings

If you choose to add them, we store your display name, birth date, birth time, birth place, coordinates, and timezone. We use that data to compute astrology, Human Design, numerology, and related readings. The calculated chart data is stored on your profile so we do not have to recompute it every time.

Birth date combined with time and place can be sensitive. You can use much of Lunaz without giving it. We only ask when a reading actually needs it.

Manifestation list, Magic, and chat

We store the manifestation list you write, Magic items (moments, signs, synchronicities), chat threads, and short thread memory so the companion can stay specific to you. Chat can include whatever you type — including how you feel, what you want, and how you frame the spiritual side of your life. Treat that as intimate. We do.

Spiritual frame

If you tell us how you like to talk (for example God, the Universe, or a more neutral frame), we store that choice so the companion can mirror your language.

Cookies and local storage

We use first-party session cookies so you stay signed in. Those cookies are required for the signed-in product. Appearance (light, dark, colour palette) is stored in your browser's local storage, not sent to us as a tracking profile. You can clear cookies and local storage in your browser; clearing session cookies will sign you out.

The Meta Pixel also sets cookies and similar identifiers on your browser so Meta can measure visits and advertising conversions. Those cookies are set by Meta, not by Lunaz, and only after you agree to advertising cookies on the site. You can use Lunaz without agreeing. You can withdraw this choice by writing to hello@lunaz.app. Blocking those cookies in your browser will not stop you using the product; it will only limit ad measurement. We keep a server-side record of this choice so later payment events can respect a withdrawal. Consent expires after one year. Where you consent, we also save campaign tags (UTM parameters) for 30 days in your browser and with your new account to understand which ads brought signups. Campaign tags can also appear in public URLs measured by the Pixel. We do not send your private app content to Meta.

Technical data

Our hosting and auth providers may process standard request metadata such as IP address, user agent, and timestamps in order to deliver the site, keep you signed in, and protect against abuse. We do not use hosting logs for advertising. The Meta Pixel separately sends comparable technical data (for example page URL, IP address, and browser details) to Meta for ads measurement.

2. Why we use it, and on what legal basis

We process personal data under the GDPR (and, where it applies, the UK GDPR). The bases we rely on:

  • Contract. Running your account, saving your list and chats, generating companion replies, and computing readings you ask for.
  • Consent. Google Sign-In; optional birth data and chart storage; your spiritual frame; and any chat that reveals special-category data (for example health, how your nervous system is doing, or religious or philosophical beliefs). You can refuse birth data and still use the companion. You can withdraw consent by deleting the relevant information or your account, or by writing to hello@lunaz.app.
  • Legitimate interests. Keeping the service secure, preventing abuse, and diagnosing faults — in ways that respect your rights.
  • Legal obligation. Keeping records we are required to keep, for example if you later buy a paid plan and tax or accounting law applies.

We do not sell, rent, or trade your personal data. We do not use your chats, list, or birth data to train our own machine-learning models. We do not have our own foundation model.

3. Who we share it with

We share personal data with the processors we need to run Lunaz, and only for that purpose. Today that is:

  • Supabase (Supabase, Inc.) — accounts, authentication, and the database that holds your profile, list, chats, Magic items, and readings.
  • Vercel (Vercel Inc.) — hosts lunaz.app and delivers the site.
  • Anthropic (Anthropic, PBC) — the Claude API that can generate companion replies. We send the conversation and the profile context the companion needs (which can include your list, frame, birth data, and chart summaries). Under Anthropic's commercial API terms, that content is not used to train Anthropic's models, and Anthropic deletes API inputs and outputs on its side within about 30 days, except where it must keep them for safety or law. See Anthropic's Privacy Policy.
  • OpenAI (OpenAI, L.L.C.) — the GPT API that can generate companion replies when we route chat through OpenAI. We send the same conversation and profile context as above. Under OpenAI's API terms, that content is not used to train OpenAI's models by default, and OpenAI retains API inputs and outputs on its side for up to about 30 days for abuse monitoring, except where it must keep them for safety or law. See OpenAI's Privacy Policy.
  • RoxyAPI (Roxy Labs) — calculates charts and related results from birth data you have given us. Roxy processes the request in memory to return the numbers; it does not write your birth data to its own database. Stored Roxy infrastructure sits in Germany, in the EU. See RoxyAPI's Privacy Policy.
  • Google (Google LLC / Google Ireland Limited) — only if you use Google Sign-In. Google handles the sign-in flow as a separate controller.
  • Meta (Meta Platforms Ireland Limited / Meta Platforms, Inc.) — the Meta Pixel on lunaz.app, only if you have agreed to advertising cookies. Meta then receives the page you are on, technical data such as IP address and browser details, and conversion events (CompleteRegistration for a newly confirmed free account and Subscribe for a confirmed paid membership), and the consented server-side CompleteRegistration and Purchase events described above. We do not send your chat, reading or manifestation-list content, birth details or payment-card information to Meta. See Meta's Privacy Policy.
  • Stripe (Stripe Payments Europe, Limited / Stripe, Inc.) — membership and credit checkout. Stripe handles card or wallet details on its own pages. We store the Stripe customer id, subscription status, and credit balances needed to run billing. We do not store full payment card numbers. See Stripe's Privacy Policy.

We may also disclose data if the law requires it, or to protect the rights, safety, or security of Lunaz or someone using it.

4. International transfers

Lunaz is operated from Portugal. Some processors are in, or can be accessed from, countries outside the European Economic Area — including the United States (Google, Anthropic, OpenAI, Meta, Stripe, and typically Vercel and Supabase). RoxyAPI's stored infrastructure is in Germany.

When we transfer personal data out of the EEA, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with the measures our processors publish. If you want more detail for a specific transfer, write to hello@lunaz.app.

5. How long we keep it

  • Account, profile, manifestation list, Magic items, chat threads, and stored readings: for as long as your account is open, and until you delete the item or the account.
  • If you ask us to delete your account, we delete the personal data we hold within 30 days, except records we are legally required to keep (for example billing records if you have paid us).
  • Anthropic and OpenAI each retain API inputs and outputs on their side for up to about 30 days, as described above.
  • RoxyAPI does not keep the birth data in an API request. We keep the copy on your Lunaz profile until you change or delete it.
  • Security and hosting logs are kept only as long as needed for delivery, security, and fault-finding.
  • Meta retains Pixel event data on its side according to Meta's own rules. We do not control that copy.

6. Security

Traffic to Lunaz is encrypted in transit (HTTPS/TLS). Your data in the database is separated by account: signed-in access is limited to your own rows. Passwords are hashed. We do not put secrets, API keys, or your full profile into public logs.

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify you and, where the law requires it, the Portuguese data protection authority (CNPD).

7. Your rights

If you are in the EEA, the United Kingdom, or Switzerland, you can ask us to:

  • access the personal data we hold about you
  • correct it if it is wrong
  • delete it (including closing your account)
  • export it in a common machine-readable format
  • restrict or object to certain processing
  • withdraw consent where we rely on consent

In Settings → Your data you can export a machine-readable copy of your account and close the account from the product. Those requests are logged. You can also write to hello@lunaz.app. We will respond within 30 days. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or to your local supervisory authority.

In the product, you can already edit your manifestation list, Magic items, birth data, and chats, and you can export or delete the account under Settings → Your data. Anything we cannot complete in the interface can always be requested by email.

8. Children

Lunaz is not for anyone under 18. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we will close it and delete the data we hold, unless the law requires us to keep a record of the request.

9. Changes

If we change this policy in a way that matters, we will update the date at the top and, where we can, email the address on your account before the change takes effect. The current version is always at lunaz.app/privacy.

10. Contact

Operator of Lunaz, established in Portugal.
Email: hello@lunaz.app