Privacy Policy

Last updated 21 August 2026

This Privacy Policy explains what personal data Lunaz collects, why we collect it, who we share it with, and the rights you have. It is written for the product as it works today: a companion chat, a manifestation list, Magic (signs and synchronicities), and calculated readings.

Lunaz is operated from Portugal. We are the controller of personal data processed through lunaz.app. The only contact for privacy, deletion, and data-protection questions is hello@lunaz.app. Please do not send extra personal data in that email beyond what we need to help you.

1. What we collect

We collect only what we need to run your account and the companion. We do not run third-party advertising, analytics, or session-replay tools on Lunaz today.

Account

If you create an account with email and password, we store your email address and a hashed password. We do not store your password in a form we can read.

If you sign in with Google, Google shows you what it will share. We receive the identifiers Google returns for Sign-In — typically your name, email address, and profile picture — and we store those on your account. Google is a separate controller for how it handles Sign-In; see Google's Privacy Policy.

Profile, birth data, and readings

If you choose to add them, we store your display name, birth date, birth time, birth place, coordinates, and timezone. We use that data to compute astrology, Human Design, numerology, and related readings. The calculated chart data is stored on your profile so we do not have to recompute it every time.

Birth date combined with time and place can be sensitive. You can use much of Lunaz without giving it. We only ask when a reading actually needs it.

Manifestation list, Magic, and chat

We store the manifestation list you write, Magic items (moments, signs, synchronicities), chat threads, and short thread memory so the companion can stay specific to you. Chat can include whatever you type — including how you feel, what you want, and how you frame the spiritual side of your life. Treat that as intimate. We do.

Spiritual frame

If you tell us how you like to talk (for example God, the Universe, or a more neutral frame), we store that choice so the companion can mirror your language.

Cookies and local storage

We use first-party session cookies so you stay signed in. Those cookies are required for the signed-in product. Appearance (light, dark, colour palette) is stored in your browser's local storage, not sent to us as a tracking profile. You can clear cookies and local storage in your browser; clearing session cookies will sign you out.

Technical data

Our hosting and auth providers may process standard request metadata such as IP address, user agent, and timestamps in order to deliver the site, keep you signed in, and protect against abuse. We do not use that for advertising.

2. Why we use it, and on what legal basis

We process personal data under the GDPR (and, where it applies, the UK GDPR). The bases we rely on:

  • Contract. Running your account, saving your list and chats, generating companion replies, and computing readings you ask for.
  • Consent. Google Sign-In; optional birth data and chart storage; your spiritual frame; and any chat that reveals special-category data (for example health, how your nervous system is doing, or religious or philosophical beliefs). You can refuse birth data and still use the companion. You can withdraw consent by deleting the relevant information or your account, or by writing to hello@lunaz.app.
  • Legitimate interests. Keeping the service secure, preventing abuse, and diagnosing faults — in ways that respect your rights.
  • Legal obligation. Keeping records we are required to keep, for example if you later buy a paid plan and tax or accounting law applies.

We do not sell, rent, or trade your personal data. We do not use your chats, list, or birth data to train our own machine-learning models. We do not have our own foundation model.

3. Who we share it with

We share personal data with the processors we need to run Lunaz, and only for that purpose. Today that is:

  • Supabase (Supabase, Inc.) — accounts, authentication, and the database that holds your profile, list, chats, Magic items, and readings.
  • Vercel (Vercel Inc.) — hosts lunaz.app and delivers the site.
  • Anthropic (Anthropic, PBC) — the Claude API that generates companion replies. We send the conversation and the profile context the companion needs (which can include your list, frame, birth data, and chart summaries). Under Anthropic's commercial API terms, that content is not used to train Anthropic's models, and Anthropic deletes API inputs and outputs on its side within about 30 days, except where it must keep them for safety or law. See Anthropic's Privacy Policy.
  • RoxyAPI (Roxy Labs) — calculates charts and related results from birth data you have given us. Roxy processes the request in memory to return the numbers; it does not write your birth data to its own database. Stored Roxy infrastructure sits in Germany, in the EU. See RoxyAPI's Privacy Policy.
  • Google (Google LLC / Google Ireland Limited) — only if you use Google Sign-In. Google handles the sign-in flow as a separate controller.

We may also disclose data if the law requires it, or to protect the rights, safety, or security of Lunaz or someone using it.

If we later add a payment provider for membership, that provider will handle card or wallet details on its own pages. We will name them here and at checkout before you pay. We do not intend to store full payment card numbers ourselves.

4. International transfers

Lunaz is operated from Portugal. Some processors are in, or can be accessed from, countries outside the European Economic Area — including the United States (Google, Anthropic, and typically Vercel and Supabase). RoxyAPI's stored infrastructure is in Germany.

When we transfer personal data out of the EEA, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with the measures our processors publish. If you want more detail for a specific transfer, write to hello@lunaz.app.

5. How long we keep it

  • Account, profile, manifestation list, Magic items, chat threads, and stored readings: for as long as your account is open, and until you delete the item or the account.
  • If you ask us to delete your account, we delete the personal data we hold within 30 days, except records we are legally required to keep (for example billing records if you have paid us).
  • Anthropic retains API inputs and outputs on its side for up to about 30 days, as described above.
  • RoxyAPI does not keep the birth data in an API request. We keep the copy on your Lunaz profile until you change or delete it.
  • Security and hosting logs are kept only as long as needed for delivery, security, and fault-finding.

6. Security

Traffic to Lunaz is encrypted in transit (HTTPS/TLS). Your data in the database is separated by account: signed-in access is limited to your own rows. Passwords are hashed. We do not put secrets, API keys, or your full profile into public logs.

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify you and, where the law requires it, the Portuguese data protection authority (CNPD).

7. Your rights

If you are in the EEA, the United Kingdom, or Switzerland, you can ask us to:

  • access the personal data we hold about you
  • correct it if it is wrong
  • delete it (including closing your account)
  • export it in a common machine-readable format
  • restrict or object to certain processing
  • withdraw consent where we rely on consent

Write to hello@lunaz.app. We will respond within 30 days. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or to your local supervisory authority.

In the product, you can already edit your manifestation list, Magic items, birth data, and chats. Account deletion that we cannot complete in the interface can always be requested by email.

8. Children

Lunaz is not for anyone under 18. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we will close it and delete the data we hold, unless the law requires us to keep a record of the request.

9. Changes

If we change this policy in a way that matters, we will update the date at the top and, where we can, email the address on your account before the change takes effect. The current version is always at lunaz.app/privacy.

10. Contact

Operator of Lunaz, established in Portugal.
Email: hello@lunaz.app