Privacy Policy
Lunation is a period, fertility and pregnancy tracker. Everything you log is health data, and we treat it that way. This page says, in plain words, what the app stores, who receives it, why, and how to delete it. It was written from the app's own source code, not from a template.
The short version. Your account and your logs are stored in Google Firebase. A summary of your cycle is sent to Google's Gemini model so the app can write your daily briefing and your reminders. RevenueCat handles subscriptions. PostHog gives us product analytics that never include your health records. Apple provides sign-in, push notifications and, if you turn it on, Apple Health sync.
What we do not do. Lunation contains no advertising SDK and no attribution SDK. It does not use the advertising identifier (IDFA) and it does not show the App Tracking Transparency prompt because it does not track you across other companies' apps or websites. We do not sell your data, we do not share health data with advertisers, and we never use your health data for marketing. Apple Health data is never used for advertising and is never shared with third parties.
1. Who is responsible
Lunation is made and operated by Holdone Software SRL, Str. Sterpoaia nr. 1, Țicleni 215600, Romania ("we", "us"), a small independent team. We are the data controller for the data described here. Contact us at hello@lunation.me.
2. What we store and why
Your account
When you sign in with Apple, Google or an email address, Firebase Authentication stores your sign-in identity: an email address (or Apple's private relay address if you choose "Hide My Email"), the display name the sign-in provider gives us, and an opaque user id. We use it to keep your data attached to you across devices.
Your profile and your logs
Stored in Google Cloud Firestore, each record tied to your user id:
| Data | What it contains | Used for |
|---|---|---|
| Profile | Name, date of birth, cycle length, period length, tracking mode (cycle, trying to conceive, pregnancy), whether the fertile window is shown, time zone, language, notification preferences, date the account was created | Running the app and computing your predictions |
| Health logs | Everything you log: menstrual flow, symptoms, moods, pain, discharge, sex, tests, weight and the other categories in the app, with the date of each entry | Your calendar, cycle history, predictions and report |
| Pregnancies | Start date, due date, and the birth or end date if you record one | Week-by-week pregnancy tracking |
| Checklist | Pregnancy checklist items and whether each is done | The pregnancy checklist |
| Onboarding answers | Your answers to the setup questions: goal, how you feel about your cycle, regularity and the wellbeing questions | Personalising briefings |
| Devices | Your push notification token, platform, time zone and language | Delivering reminders at the right local time |
| Cycle analysis and briefings | Written by our server: detected cycles, computed lengths, predicted dates, and the last ten daily briefings | Showing predictions and the daily briefing |
| Notification history | Each reminder we queued and sent to you, with its text and the cycle context it was generated from | Rate-limiting reminders to two a day and not repeating ourselves |
| Subscription status | Whether you have Lunation Plus, which product, and when it renews or ends. No payment details; Apple handles payment. | Unlocking Plus features and timing a renewal heads-up |
Access rules only let a signed-in user read and write records that carry their own user id. Our server code runs with administrative access so it can compute analyses and send notifications.
Where it is stored
Our Firebase project and its Firestore database are located in the United States (Google Cloud multi-region nam5). Our server functions run in us-central1. Data is encrypted in transit (TLS) and at rest with Google-managed keys. This is not end-to-end encryption: Google, and we as the operator, can technically read stored data. That is what allows our server to write your briefings.
3. Who receives data, and what
| Recipient | What they receive | Why |
|---|---|---|
| Google Firebase (Authentication, Firestore, Crashlytics, Remote Config) | Your account, profile and logs as listed above. Crashlytics receives crash reports with device model, OS and app version and a Crashlytics installation id, not your user id. Remote Config receives an installation id and app, platform, language and country metadata to read one configuration value. | Storage, sign-in, stability, configuration |
| Google Gemini (through our own server) | For cycle analysis: the dates and flow types of your period logs from the last 180 days and your stored cycle lengths. For reminder text: your cycle day, phase, days to your period, tracking mode, language and up to five symptom names from the last three days. For the daily briefing: your age bracket (never your exact age or name), tracking mode, onboarding answers, cycle numbers and predicted dates, and a summary of your last 90 days of logs grouped by phase. The reply is stored in your account. The app never talks to Gemini directly. | Writing the briefing, reminders and cycle analysis |
| Apple (Sign in with Apple, Push Notifications, App Store, HealthKit) | Sign in with Apple returns your name and email to us; Apple learns that you signed in. Push notifications pass through Apple's service in readable form, like any iOS notification. Purchases are made with Apple; we receive a receipt, not your card. HealthKit data stays on your device (see section 5). | Sign-in, reminders, payments, Health sync |
| Google Sign-In | If you choose it: Google authenticates you and tells us your name and email. | Sign-in |
| RevenueCat | Your user id, your App Store receipts and transactions, and the device and app attributes its SDK collects by default. No email, name, birth date or health data. | Knowing whether you are subscribed; the in-app subscription management screen |
| PostHog (EU cloud, data stored in the European Union) | Product analytics events such as "onboarding completed" or "paywall viewed", with category names, counts and on/off flags; whether you are a subscriber; your tracking mode; app version, OS version, device model, language and screen size. PostHog is configured to discard the IP address of the request rather than store it. Never flow, symptom, mood or test values, never cycle, period or birth dates, never notes, email or name. Session recording is off. | Understanding whether the app works and what to improve |
None of these companies is permitted to use your data for their own advertising. We have no advertising partners and no data brokers.
4. Notifications
Reminders are generated on our server from your cycle data and sent to your device through Apple. We send at most two a day, never between 23:00 and 07:00 your local time, and each category can be switched off in Settings. If you end a pregnancy in the app, notifications pause for two weeks automatically. Reminder and briefing texts are written by an AI model and are labelled as such in the app. They are general wellness information, not medical advice.
5. Apple Health
Apple Health sync is optional and off until you turn it on in Settings. When it is on, Lunation reads and writes two Health types: menstrual flow and body weight. Entries you log in Lunation are written to Apple Health, and flow or weight that appear in Apple Health are imported into your Lunation logs and stored with your other logs as described above. Health data is read on your device. We never use Apple Health data for advertising or marketing, never sell it, and never share it with third parties other than storing the imported entries in your own account as described here.
6. The doctor report
The PDF report is generated on your device and handed to the iOS share sheet. Lunation does not upload it anywhere. Where it goes next is up to the app you share it with.
7. Legal basis
If you are in the European Economic Area, the United Kingdom or Switzerland: we process your health data on the basis of your explicit consent, which you give when you create an account and start logging, and which you can withdraw at any time by deleting your account. Account, device and subscription data are processed to perform our contract with you. Crash reports and product analytics are processed on the basis of our legitimate interest in keeping the app working, limited to data that cannot identify your health. We do not make decisions with legal effects about you by automated means.
8. How long we keep data
For as long as you have an account. When you delete your account, your data is deleted as described in section 9. Crash reports are retained by Crashlytics for 90 days. Analytics events are retained in PostHog for as long as the project exists and are not linked back to health records.
9. Your rights and how to delete everything
Delete your account in the app under Settings > Account > Delete Account. This removes your health logs, pregnancies, checklist, devices, onboarding answers and profile, then deletes your sign-in account. Our server then removes the records the app cannot reach itself: cycle analyses, briefings and their history, notification history and any queued reminders. Deletion is permanent; we keep no backup copy you can restore from.
Deleting the account does not remove entries already written to your Apple Health app; they remain yours in Health. It also does not remove crash reports already sent or analytics events that were never tied to your health records.
You can also ask us to access, correct, export or delete your data, or to restrict or object to processing, by writing to hello@lunation.me. We answer within 30 days. If you are in the EEA or UK you can complain to your data protection authority.
10. Children
Lunation is intended for people aged 16 and over and is rated 12+ on the App Store for medical and health references. We do not knowingly collect data from children under 13; if you believe a child has created an account, contact us and we will delete it.
11. Security
Data travels over TLS and is encrypted at rest. Access is restricted by per-user security rules and by role. No system is perfectly secure; if we learn of a breach that affects you we will tell you and, where required, the authorities.
12. Changes
When this policy changes in a way that matters, we update the date at the top and, for significant changes, tell you in the app. Earlier versions were provided through a third-party policy generator; this version replaces them.
13. Contact
hello@lunation.me
Holdone Software SRL
Str. Sterpoaia nr. 1, Țicleni 215600, Romania