Privacy Policy

Luna is operated by the Luna team (“Lunaspacehub”). For anything about your data — access, correction, deletion, export, or marketing opt-out — email privacy@lunaspacehub.com or use the controls in Settings → My Space. We answer privacy requests within 30 days (usually much faster).

If you create an account: your email address, first and last name, and a one-time verification code (deleted minutes after use). Never a password — we don’t have one to leak.

If you use a reading tool: the birth date, time, and place you type in, your question or chosen cards, and the reading produced from them. This exists so your reading can be shown again in My Space and your Library.

If you unlock a blueprint as a guest: your email address and which tool you used. Marketing emails are only ever sent if you ticked the optional box — unticked by default.

Everyday signals: mood check-ins you tap, which pages you open (aggregate, anonymous funnel events), and your IP address used transiently for rate limiting and abuse prevention. We do not build advertising profiles and do not sell or share your data with advertisers — ever.

• To provide the service you asked for (contract): signing in, generating your readings, keeping your Library.
• With your consent: optional marketing (“gentle reflections”) emails — opt-in only, withdraw any time via the unsubscribe link or Settings.
• Legitimate interest: keeping the site safe and available — rate limiting, abuse prevention, security logging.
• Legal obligation: records we must keep for accounting when payments are live.

Our application runs on Cloudflare (edge network, global), our database is PostgreSQL hosted by Supabase in AWS Tokyo (ap-northeast-1), files you download live in Cloudflare R2 object storage, and transactional email is delivered by Resend. Because these providers operate globally, your data may be processed outside your country; we only use providers that offer equivalent-protection safeguards (such as EU Standard Contractual Clauses where applicable).

• Verification codes: minutes (they expire and are deleted).
• Account profile & readings: until you delete your account.
• Guest blueprint leads: until you unsubscribe or ask us to erase them.
• Mood check-ins & mirror progress: until you delete your account.
• Security/rate-limit records: up to 30 days.

Deleting your account (Settings → Danger zone, confirmed by email code) erases your profile, readings, check-ins, library, and any email address held for you in our mailing list.

Luna sets only essential cookies: a session cookie that keeps you signed in, and a signed anonymous-identity cookie that lets guests keep their readings before creating an account. We run no advertising, analytics, or tracking cookies — no third-party pixels, none.

On your own device we store small preferences in local storage (never sent elsewhere): your anonymous id, unlocked blueprints, a dismissed-recommendations note, and a 24-hour card lock so you can’t re-draw the same reading on impulse.

Some readings (Ask Luna, healing reports) are composed with a large-language model from your birth data and question. Prompts are isolated so your input cannot alter system behaviour, providers are contracted no-training processors, and your reading is stored only in your own history. Readings are for self-reflection — they are not medical, psychological, legal, or financial advice, and never a prediction of your future.

Wherever you are, you can ask us to:

• Access — get a copy of your data (Settings → Export my data).
• Rectify — fix your name, email, or birth details.
• Erase — delete your account and everything tied to it.
• Portability — receive your data in a machine-readable file.
• Restrict or object — pause processing we base on legitimate interest.
• Withdraw consent — one click unsubscribes marketing, without touching your account.

To exercise any right: use Settings where available, or email privacy@lunaspacehub.com. If you are in the EU/EEA you may also lodge a complaint with your supervisory authority; in Thailand, with the PDPC.

Luna is intended for adults. We do not knowingly collect data from anyone under 18; if you believe a minor created an account, email us and we will erase it.

All traffic is TLS-encrypted. Credentials in our database are encrypted at rest (AES-256-GCM), sessions are signed JWTs with httpOnly cookies, administrative surfaces are role-gated, and our application runs in sandboxed edge isolates without a traditional server OS to attack. No system is perfect — if something ever goes wrong we will tell affected users promptly and clearly.

If we change this policy materially, we will announce it on the site and update the version and date at the top. Continued use after the effective date means the updated policy applies.

Privacy questions, requests, or complaints: privacy@lunaspacehub.com. Related pages: Terms of Use.