Privacy policy

Effective 19 October 2026 · App version 1.0

Lunita is developed by Julian Sainz Martinez (Jelluna), the data controller for the limited processing described here. Lunita has no account, no advertising, no analytics or crash-reporting SDK and no tracking. We do not sell or share personal data, and we never use your data for advertising.

Stored on your device

Lunita stores what you enter so the app can work: your babies' names, birth and due dates, optional sex, and the rhythm preferences you set; entries you log (sleep, wake-ups, night wakings, nursing, bottles, solids, pumping, diapers, medicines, temperatures, symptoms, vaccines, doctor visits, growth measurements, activities, milestones and notes); saved medicines and foods; your caregiver name; private parent check-ins (mood, hours slept and notes); Sleep School progress; and settings. This information is kept in a database on your phone. It may be included in your device backups according to your iPhone or Android backup settings.

Some of this information relates to your child's health. It is used only to show your timeline, predictions, insights, reminders and exports inside the app.

Family sharing (optional, end-to-end encrypted)

If you turn on family sharing in Settings, Lunita creates a random family key on your phone. Every record is encrypted on your phone with XChaCha20-Poly1305 using that key before it is sent to our sync service. The key is shared with the people you invite only through the invite link, QR code or 20-character code, which you choose how to send. Our server only receives the code's one-way hash and an encrypted copy of the key, so it cannot read the family key.

Our sync service runs on Cloudflare Workers and Cloudflare D1. For each family it stores: a random family identifier and the date of its last sync; random device identifiers and one-way hashes of device tokens; for each record an opaque identifier, the time it was last changed and the encrypted contents; and pending invites (a code hash, an encrypted key and an expiry date). We cannot see your babies' names, entries, notes or caregiver names. Cloudflare processes technical request data, such as IP addresses, to deliver and protect the service under Cloudflare's privacy policy; we do not keep request logs. The sync database is stored by Cloudflare in Western Europe. Cloudflare processes this data on our behalf under its data processing terms, which include the safeguards required when its network handles request data in other countries.

Parent check-ins are never shared, even with your family. When a caregiver leaves the family, their device stops syncing. When the last caregiver leaves, all of that family's data is deleted from the sync service. Families with no sync activity for 12 months are deleted automatically, and invites are removed a day after they expire.

Legal basis

Data that stays on your phone is never processed by us. For the sync service, we process data to provide family sharing, the feature you ask for when you turn it on (performance of a contract under the UK GDPR, Article 6(1)(b)). Because synced entries can relate to your child's health, they are synced only with your explicit consent, which you give by turning on family sharing and can withdraw at any time by leaving the family (Article 9(2)(a)). We answer support emails based on our legitimate interest in helping you (Article 6(1)(f)). The same principles apply under the Swiss Federal Act on Data Protection.

Purchases

Subscriptions, free trials and the lifetime purchase are handled by Apple (App Store) or Google (Google Play). Lunita uses StoreKit or Google Play Billing on your device to check whether Lunita Plus is active and whether you're eligible for a trial. We never receive your payment details. If you share Lunita Plus with your family, the encrypted family record carries a note that Plus is active so your partner's device can unlock it.

Reminders

Nap, bedtime, feeding, medicine and free-trial reminders are local notifications scheduled on your phone. They are not sent through a server.

Camera

With your permission, Lunita uses the camera only to scan a family invite QR code. No photos or video are stored or sent.

Exports and backups

PDF reports, CSV spreadsheets and backup files are created on your phone only when you ask, and shared through your phone's share sheet to the destination you choose.

Children

Lunita is designed for parents and caregivers. It does not collect information directly from children. Information about your baby is entered by you and handled as described above.

Your control and rights

You can edit or delete any entry or baby in the app. Settings → Export and backup → Delete all data removes everything Lunita stored on your phone. Leaving the family (Settings → Family sharing) stops syncing, and data is deleted from the sync service when the last caregiver leaves. Depending on where you live (for example under the UK GDPR, the Swiss Federal Act on Data Protection or the GDPR), you may have rights to access, correct, delete or port your data, to object to processing and to withdraw consent. Because we can't read your synced data, most requests are handled directly in the app; for anything else, email us. You can also complain to your local data protection authority.

This website and support

This website is hosted on Cloudflare and has no analytics, advertising scripts, forms or tracking cookies. Cloudflare processes technical request data, such as IP addresses, to deliver and protect the site.

If you email [email protected], we receive your email address and message and use them only to reply. Email is hosted by Apple iCloud Mail. Messages are kept only as long as needed to handle your request.

Changes

If this policy changes, we'll update this page and the effective date. Material changes will also be mentioned in the app's release notes.

Contact

Julian Sainz Martinez (Jelluna) · [email protected]