Privacy policy

Lunaria helps you track your cycle and your intimate health: highly personal information that we handle with the utmost care. This policy explains what data we collect, why, who can access it and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

Who we are

The controller of your data is the publisher of Lunaria:

• Publisher: [To be completed: name or company name]
• Address: [To be completed: postal address]
• Email: contact@lunariacycle.com

Data we collect

We only collect what the service needs. The information requested at sign-up is required; everything else is optional.

Account

• Email sign-up: your first name, email address and password, stored only as a hash (scrypt), never in plain text.
• Sign in with Google: Google sends us your name, email address, profile picture and Google account identifier, but never your password.
• Security and preferences: if you enable two-factor authentication, its secret key and your backup codes; your language.

Health data

This is the information you choose to log: period and cycle dates, flow, symptoms, moods, cervical mucus, sexual activity, basal body temperature, weight, sleep, water intake, ovulation and pregnancy tests, contraception, pill intake, notes, custom tags, goal (tracking your cycle, trying to conceive, avoiding pregnancy, pregnancy, perimenopause) and pregnancy dates. This is special-category data under Article 9 GDPR.

Technical and reminder data

• the IP address and browser type attached to your sign-in sessions, to secure your account and show your active sessions;
• request counters linked to IP addresses, to block abuse such as repeated sign-in attempts;
• your reminder settings and time zone, to notify you at the right time, and, if you enable push notifications, the subscription address provided by your browser;
• the history of reminders sent, reduced to an opaque technical key (which does not reveal the type of reminder) and the date sent, to avoid duplicates;
• the content of your messages, if you write to us.

Ad-free subscription and optional video

• if you take out the optional “Ad-free” subscription: the customer and subscription identifiers assigned by our payment provider Stripe, the plan you chose, the status and dates of the subscription, the date of your acceptance of the terms of sale and of your request for immediate access, as well as a record of the emails relating to the subscription (confirmation, cancellation, renewal notice). Your bank details are entered directly with Stripe: we never have access to them;
• if you choose to watch a video ad after logging an entry: the date until which banners are hidden.

Purposes and legal bases

• Providing the service (account, tracking, predictions, export, verification, password reset and security emails): performance of the contract formed by our terms of use (Article 6(1)(b) GDPR).
• Processing your health data: your explicit consent (Article 9(2)(a) GDPR), collected in the app through a checkbox when you set up your account. You can withdraw it at any time by deleting your data in Settings, without affecting processing already carried out.
• Sending the reminders you turned on: performance of the contract and, for their health-related content, your explicit consent.
• Securing the service and preventing fraud and abuse: our legitimate interest (Article 6(1)(f) GDPR).
• Funding the service through advertising: our legitimate interest; advertising cookies are only used with your consent where the law requires it (Article 82 of the French Data Protection Act and Article 6(1)(a) GDPR).
• Managing the Ad-free subscription (payment, invoices, confirmation, cancellation and renewal notice emails, proof of your consent): performance of the contract formed by our terms of sale (Article 6(1)(b) GDPR) and compliance with our legal obligations, in particular under accounting and consumer law (Article 6(1)(c) GDPR).
• Answering your requests: our legitimate interest and, for requests to exercise your rights, our legal obligations (Article 6(1)(c) GDPR).

Our commitments on your health data

Who receives your data

• The publisher, only to the extent necessary to operate and secure the service.
• Our hosting provider, OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which stores the database.
• Our email provider, which receives your email address and the content of service and reminder emails. These emails never contain health data: a reminder email only tells you that a reminder is waiting for you in the app.
• Your browser’s push service (Google, Mozilla, Apple or Microsoft), if you enable notifications: it only routes them, as their content is end-to-end encrypted to your browser by the Web Push protocol. The “Discreet notifications” option also keeps any mention of your cycle off your screen.
• Our payment provider, Stripe Payments Europe, Ltd. (Ireland), if you take out the Ad-free subscription: it receives your name, email address and account identifier, and processes your payment data. It acts as a processor for managing the subscription and as an independent controller for its own obligations (in particular fraud prevention and anti-money laundering). It never receives your health data.
• Google, as an independent controller, for Sign in with Google, for displaying ads and, if you choose to watch one, video ads (Google Ad Manager). We never pass your health data to Google.
• Administrative or judicial authorities, only where the law requires it.

Our hosting and email providers act as processors, only on our instructions and with security and confidentiality safeguards. We do not sell your personal data.

International transfers

Google may process some data outside the European Economic Area (EEA), in particular in the United States, when you use Sign in with Google or when ads are displayed. The same applies to Stripe for payment processing. These transfers are covered by the EU–US Data Privacy Framework, in which Google and Stripe participate, and/or by the European Commission’s standard contractual clauses. Any other transfer would be subject to equivalent safeguards.

How long we keep your data

• Account and health data: for as long as your account exists. You can delete your cycle data or your account at any time in Settings: erasure from our database is immediate and permanent, and any backups kept by our hosting provider are overwritten within 30 days at most.
• Sign-in sessions (IP address, browser): up to 30 days, renewed while you use the app. Expired sessions are deleted automatically, together with their IP address and browser information; you can also end a session at any time.
• Temporary verification tokens (for example for password resets): deleted automatically as soon as they expire.
• Anti-abuse counters (linked to IP addresses): deleted 24 hours after the last request concerned.
• Reminder history: 30 days.
• Push notification subscriptions: until you turn them off on the device concerned or delete your account.
• Ad-free subscription: its details, for as long as your account exists. Invoices and payment records, as well as the proof of your acceptance of the terms of sale recorded with the subscription, are kept by Stripe and, where applicable, by us for ten years under our accounting obligations (Article L. 123-22 of the French Commercial Code), including after your account is deleted.
• Optional video: the end date of the banner-free break, until your account is deleted.
• Messages: for as long as needed to handle your request.

These automatic deletions run every hour.

Security

In addition to encrypting your health data (AES-256-GCM) and all communications (HTTPS), we protect your account with passwords stored as hashes (scrypt), mandatory email verification, rate-limited sign-in attempts, sessions that expire after 30 days of inactivity and security notices by email. When you choose a password, we check that it does not appear in a known data breach using the Have I Been Pwned service: only the first 5 characters of a SHA-1 hash of the password leave our server, with no personal data, and the check is skipped if the service is unreachable. You can enable two-factor authentication and a 4-digit lock code, and sign out of your other sessions remotely. In the event of a data breach, we will notify the CNIL as required by the GDPR and inform you without undue delay if it poses a high risk to you.

Your rights

You have the right of access, rectification, erasure, restriction and portability of your data, the right to object to processing based on our legitimate interest, the right to withdraw your consent at any time and the right to set instructions regarding what happens to your data after your death (Article 85 of the French Data Protection Act).

Most of these rights can be exercised directly in Settings: edit your information, export all your data (JSON or CSV), delete your cycle data or delete your account. You can also write to us at contact@lunariacycle.com: we will reply within one month, which may be extended by two months for complex requests, and may ask you to prove your identity if we have reasonable doubts.

You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France), or, if you live in another EU country, with the data protection authority of that country.

Minors

Lunaria is intended for people aged 15 or over, the age from which French law allows you to consent to the processing of your data yourself. Below that age, consent must be given jointly by the minor and the holder(s) of parental authority. An account created in breach of this rule may be deleted.

Cookies and local storage

We use no analytics cookies. The following cookies and local storage (localStorage) items are required for the service or remember your preferences; they are exempt from consent (Article 82 of the French Data Protection Act):

• Sign-in session (“lunaria.session_token”, “lunaria.session_data”): keeps you securely signed in; up to 30 days after your last activity.
• Two-factor authentication (“lunaria.two_factor”, “lunaria.trust_device”), only if you use it: completes sign-in (10 minutes) and remembers a trusted device (30 days).
• Last sign-in method (“better-auth.last_used_login_method”): suggests the method you used last time (email or Google); 30 days.
• Language (“NEXT_LOCALE”): remembers the language you chose; 1 year.
• Local storage: your theme preference, the color you chose for the interface, the state of the lock screen and the date of the last video offer after logging an entry (so that it is only offered once a day), kept on your device until you change them or clear your browser data.

Google ads

Ads are provided by Google AdSense. Their script loads on the public pages of the site (home, guide, tools, legal pages) and, where applicable, on app pages that include ad banners, but never on the sign-in, sign-up or account setup pages. We never pass your health data to advertising technology: it never appears in page addresses or titles, or in ad parameters. By default, ads are non-personalized: they are not chosen based on your browsing history, but on contextual information such as your approximate location. Google may nevertheless use cookies to limit how often an ad is shown, produce aggregated statistics and fight fraud, and receives technical data such as your IP address when ads load.

After you log an entry, the app may offer you the chance to watch a short video ad to hide banners for 24 hours. This is entirely optional: the video is only loaded, by Google Ad Manager, if you ask for it, and the ad is non-personalized. As with banners, Google then receives technical data such as your IP address and may use cookies to limit how often an ad is shown, produce aggregated statistics and fight fraud, in line with the choice you made in the consent message. Your health data is never passed to Google. Ad-free subscribers see neither banners nor video offers.

In the European Economic Area, the United Kingdom and Switzerland, Google’s consent management message (an IAB TCF certified platform) asks for your consent to these cookies. Refusing does not affect your access to the service, and you can change your choice at any time with the “Cookie settings” link at the bottom of the page. Google acts as an independent controller for its advertising cookies: see the Google Privacy Policy (policies.google.com).

You can also block or delete cookies in your browser settings; without the session cookies, however, you will not be able to sign in.

Changes to this policy

We may update this policy to reflect changes to the service or to the law; the date of the latest update is shown at the top of this page. If we make a significant change, we will let you know in advance by email or by any other appropriate means.

Contact us

For any question about this policy or your data: contact@lunariacycle.com, or by post to [To be completed: name or company name], [To be completed: postal address].