Privacy Policy

Last updated: June 2026  ·  Effective date: June 2026

Lunara ("we", "our", or "us") operates the Lunara: AI Fortune Teller mobile application (the "App"). This Privacy Policy explains what personal data we collect, why we collect it, how it is used, and your rights regarding that data. By using the App you agree to the practices described here.

1. Data Controller

The data controller for the App is Enes Faruk Şakin, reachable at [email protected]. Users in Turkey may additionally contact us regarding rights under the KVKK (Kişisel Verilerin Korunması Kanunu) at the same address.

2. Information We Collect

We collect only what is necessary to operate and improve the App:

• Account information — email address and display name you provide at registration, or the name and verified email returned by Apple Sign-In or Google Sign-In if you choose those methods. We never see your Apple or Google password.
• Authentication tokens — a session token stored on your device to keep you signed in. Tokens expire after 30 days of inactivity.
• Content you create — fortune readings, tarot sessions, dream interpretations, and time-signal searches you generate inside the App. This content is stored on our servers so you can access your history.
• Photos you upload — palm or face photos you choose to submit for reading analysis. These are stored on BunnyCDN and linked to your account.
• Purchase and billing data — records of coin purchases and subscription activations including Apple/Google transaction identifiers, amounts, and currency. We do not store credit-card numbers or full payment details; those remain with Apple or Google.
• Device and locale data — platform (iOS/Android), locale, time zone, and preferred currency. Used to localise prices, content language, and push-notification timing.
• Usage logs — which features you use, error reports, and anonymised performance data to help us diagnose bugs and improve the service.
• Push-notification preferences — whether you have granted notification permission and your scheduled notification times.

3. How We Use Your Information

• Provide, operate, and maintain the App and its features.
• Process in-app purchases, validate receipts with Apple/Google, and manage your coin balance and premium status.
• Personalise content language, currency display, and notification timing based on your locale and time zone.
• Send push notifications you have explicitly enabled (daily reminders, streak rewards, cooldown resets).
• Detect and prevent fraudulent purchases or abuse of the service.
• Respond to your support requests.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for profiling or automated decision-making that produces legal or similarly significant effects.

4. Third-Party Services

We share data only with the service providers necessary to run the App:

• Apple App Store / Google Play — handle payment processing. Their privacy policies govern the data they collect during checkout.
• RevenueCat — validates purchase receipts and tracks subscription status. RevenueCat receives your App user ID and purchase transaction data. See revenuecat.com/privacy.
• OpenAI — powers AI-generated fortune, tarot, and dream content. The text prompts and image descriptions we send to OpenAI do not include your name or email. Under our API agreement, OpenAI does not use API inputs to train its models.
• Google Sign-In / Apple Sign-In — optional sign-in providers. We receive only your verified email and display name; no other profile data.
• Google AdMob — delivers optional rewarded video ads. AdMob may collect your device advertising identifier (IDFA/GAID) subject to your device-level tracking consent. See policies.google.com/privacy.
• BunnyCDN — stores and serves photos you upload. Images are stored in EU-based data centres.
• Resend — sends transactional emails (password reset). Your email address is transmitted to Resend solely to deliver that email.

5. Data Retention

We retain your account and content data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it longer (e.g., financial records for 10 years in Turkey).

To request account deletion, email [email protected] with the subject "Delete my account".

6. Data Security

We protect your data using TLS encryption in transit, bcrypt-hashed passwords, encrypted email storage, and access-controlled infrastructure. However, no system is completely secure; we cannot guarantee absolute security.

7. International Data Transfers

Our servers are located in the European Union. Data processed by OpenAI and RevenueCat may be transferred to the United States. Where required, we rely on standard contractual clauses or the service provider's own adequacy mechanisms.

8. Children

The App is not directed to children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request erasure of your data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Objection / Restriction — object to or restrict certain processing activities.
• KVKK rights (Turkey) — Turkish residents have additional rights under Law No. 6698, including the right to learn whether personal data is processed, to request correction or deletion, and to lodge a complaint with the KVKK authority.
• CCPA rights (California) — California residents may request disclosure of personal data we collect and sold (we do not sell personal data) and may opt out of any future sale.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Legal Basis for Processing (GDPR — EU/EEA Users)

If you are located in the European Union or European Economic Area, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — processing your account data, content, and purchases is necessary to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR) — fraud prevention, security, and service improvement, where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a) GDPR) — push notifications and optional ad personalisation. You may withdraw consent at any time in device settings.
• Legal obligation (Art. 6(1)(c) GDPR) — retaining financial records as required by law.

EU/EEA users have the right to lodge a complaint with their local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.

11. Entertainment Disclaimer

All readings, interpretations, and AI-generated content in Lunara are provided for entertainment purposes only. They do not constitute and should not be relied upon as professional, medical, psychological, financial, or legal advice.

12. Changes to This Policy

We may update this policy from time to time. The updated version will be posted at this URL with a revised "Last updated" date. We encourage you to review it periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests:
Email: [email protected]