Privacy Policy

Last updated: 13 September 2026
Application: Lunaria
Data controller: Deniz Bedirhan Öksüz
Contact: info@lunariapp.site

This Privacy Policy explains how Lunaria ("Lunaria", "the App", "we", "our", "us") handles your information. Lunaria is an AI-assisted dream journal that records your dreams, generates symbolic interpretations, supports follow-up questions, and can optionally produce AI dream artwork. Please read this Policy to understand how we handle your information when you use the App.

We follow data minimization: we collect only what the App needs, keep most of your data on your device, and route AI requests through our own backend so that third-party providers never receive your Apple Account, device identifiers, or account credentials — only the content needed for each request (§3).

The App is intended for users aged 16 or older.

Living in Türkiye? Under Turkish data-protection law (KVKK) we have additional disclosure duties — please also read the KVKK Aydınlatma Metni (in Turkish): https://lunariapp.site/kvkk.html.

1. Information we collect

Stored locally on your device

The following is stored on your device (iOS UserDefaults) and is not stored on our servers. Content you use AI features on is passed through our backend to AI providers (§3), and Lunaria Plus subscribers additionally get an iCloud backup of their dream records (see below):

• Profile details: name, date of birth, and — optionally — time of birth, a profile photo, personal details (relationship status, number of siblings, number of children, pets, occupation) and an "about me" note.
• Dream records: the dream text you type or dictate, the generated interpretation, preview summary, title, optional AI dream image, creation time, mood, dream type, clarity, symbols, follow-up Q&A, and favorite flag.
• Weekly report (Lunaria Plus): the most recent AI weekly report you generated.
• Wallet & entitlement state: your free-interpretation counter, credit balance, processed StoreKit transaction IDs, and a cache of your latest subscription status.
• On-device diagnostic events: a lightweight in-app log of actions such as paywall views and purchase taps.

You can permanently erase this data from Profile → Delete Account. After deletion it cannot be recovered. The cached weekly report is currently not removed by account deletion; it is deleted when you remove the App.

iCloud backup (Lunaria Plus only)

If you subscribe to Lunaria Plus, the App backs up your dream records to your own private iCloud (an app-specific container under your Apple Account) so you don't lose your journal and can restore it on a new device.

• The backup lives in your iCloud storage, under your Apple Account. We — the developer — cannot read it: it is never sent to, stored on, or accessible by our backend.
• AI dream images are excluded from the backup; only your text-based dream data is included.
• Apple keeps the backup in sync across devices signed into the same Apple Account.
• It runs only while you have an active Plus subscription and are signed into iCloud. Free users' data stays only on the device and is never sent to iCloud.
• When you delete your account, the App also tries to delete this backup file. This can fail — for example, if your device is offline at that moment — so you can also remove it at any time from iOS Settings → [your name] → iCloud → Manage Account Storage.

Voice input (temporary)

If you dictate a dream, the App records a temporary audio file on your device and sends it over HTTPS to our backend, which forwards it to OpenAI only to obtain the transcript (§3). The audio file is deleted from your device as soon as transcription finishes, and no copy is kept on our backend.

Subscriptions and credits

Subscriptions and credit packs are processed by Apple's StoreKit. We never see your Apple Account, payment method, or billing address. The transaction identifiers and entitlement state StoreKit returns stay on your device; our backend is not told your subscription status or credit balance — only, for an interpretation, whether it uses the free quota (§4).

2. No tracking, no ads, no analytics SDKs

Lunaria contains no third-party analytics, attribution, or advertising SDKs. We do not use AppsFlyer, Firebase, or similar tools. We do not use the Advertising Identifier (IDFA), we do not show the App Tracking Transparency prompt, and we show no advertising. The diagnostic events in §1 never leave your device.

3. How AI features work

The App's AI features — interpretations, follow-up questions, voice input, the dream-writing helper, dream images and the weekly report — send the content described below through our backend to third-party AI providers. Nothing is sent to these providers unless you use an AI feature; you can use Lunaria as a private journal with no third-party data flow. For Lunaria Plus subscribers, a dream image can also be created automatically after an interpretation (see below).

To OpenAI — to produce interpretations, follow-up answers, transcripts, summaries, keywords, titles and weekly reports:

• your dream text, the interpretation approach you chose and, for some interpretation cards, the moods you selected;
• for the astrology approach, your sun sign (calculated on your device from your date of birth); for some approaches and cards, the moon phase of the night the dream was recorded;
• for the real-life and guidance cards and for follow-up questions, the personal details and "about me" note you added;
• for the main interpretation and for follow-up questions, a short digest of up to four of your previous interpreted dreams (their main symbols and the opening words of their interpretations);
• your follow-up questions, the earlier messages in that conversation and the main interpretation they refer to;
• dream drafts you ask the writing helper to tidy up, and the dream text and interpretation used to create a summary, keywords and a title;
• dictated audio, for transcription;
• for the weekly report (Lunaria Plus), that week's number of dreams, mood shares, recurring symbols and dream titles.

To Google (Gemini API) — an image prompt containing the dream's text, title, symbols and mood, to create a dream image. This happens when you request an image and, for Lunaria Plus subscribers, automatically after an interpretation while a daily image allowance is available.

Before forwarding interpretation and follow-up requests, our backend automatically checks the text for phrases that may indicate a real-life crisis, such as self-harm. If the check matches, the AI is instructed to prioritize your wellbeing and, where appropriate, to open with a brief, caring note that encourages you to seek support. This check makes no decision about you.

Your name, the identifier Apple provides for your account, your email address, device identifiers and IP address are not included in requests to OpenAI or Google. See https://openai.com/policies/privacy-policy, https://openai.com/policies/api-data-usage-policies, and https://ai.google.dev/gemini-api/terms. Under OpenAI's published API policy, API content is retained for a limited period for abuse monitoring and is not used to train their models; refer to each provider for current details.

4. Our backend and what it stores

Our backend exists so that third-party API keys never live on your device. It:

• receives your AI request over HTTPS, forwards it to the appropriate provider, and returns the response;
• does not store your dreams, interpretations, follow-up questions, or generated images;
• when you sign in, receives the identity token Apple issues — which may contain your email address or an Apple private relay address — verifies it, and keeps only the user identifier Apple provides; your email address is not stored;
• keeps a minimal account record linked to that identifier: a session version number; when the record was created and last updated; the time of your last free interpretation; counters for image generations and weekly reports within time windows; the IDs and times of processed free-interpretation requests; and, for each dream you ask follow-up questions about, that dream's random ID and the number of questions. It does not store your name, email address, subscription status, or credit balance;
• applies per-user and per-IP rate limiting to prevent abuse, using counters held only in server memory;
• writes operational logs containing the request method, path, response code and duration and, for interpretation requests, the interpretation card, mode and lens used, the IDs of the dream-symbol categories our knowledge base detected, and whether the crisis check (§3) matched. These logs do not contain your dream text or your account identifier, and are retained for 90 days.

When you delete your account via Profile → Delete Account, the usage data in this record is deleted (the time of your last free interpretation, the counters, the processed request IDs and the follow-up question counts). We keep only the identifier Apple provides, the session version number and the record's timestamps, so that sign-in sessions issued before the deletion cannot be used again. If your device is offline when you delete your account, the deletion may not reach our server; in that case, email info@lunariapp.site.

5. Who we share information with

We share information only as needed to run the App, with providers required to protect it:

• Apple — Sign in with Apple, App Store payments and subscriptions, iCloud backup. https://www.apple.com/legal/privacy/
• OpenAI — dream interpretation, follow-up answers, transcription, summaries, weekly reports. https://openai.com/policies/privacy-policy
• Google — AI image generation (Gemini API). https://ai.google.dev/gemini-api/terms
• Our hosting provider — the service provider that hosts our backend server.

We do not sell your personal information, we do not share dream content with advertisers, and we use no data brokers. We may disclose information if required by law or to protect our rights, and in connection with a business transfer.

6. International data transfers

OpenAI and Google are based in the United States and may process the content of your AI requests there or in other countries where they operate. Our backend server may also be located outside your country of residence. We do not treat your use of the App as consent to these transfers. If you are in the EU/EEA, Switzerland or the UK, section 14.5 describes the safeguards that apply. If you live in Türkiye, see the KVKK Aydınlatma Metni (https://lunariapp.site/kvkk.html) for the KVKK Article 9 cross-border transfer disclosure.

7. Retention and deletion

You can delete individual dream records or your entire account at any time from within the App, or email info@lunariapp.site to request deletion.

8. Your rights and choices

You can:

• Review the data the App holds — most of it is local, visible in the Profile screen and your dream history under My Dreams.
• Correct your profile from the Profile screen.
• Delete the App's data on your device and the usage data in your server account record via Profile → Delete Account (see §1 and §4; this does not cancel an active Apple subscription — manage that in iOS Settings → [your name] → Subscriptions).
• Remove your Lunaria Plus iCloud backup — deleting your account also tries to delete it (see §1), and you can remove it yourself in iOS Settings → [your name] → iCloud → Manage Account Storage.
• Withdraw your consent to AI processing at any time by emailing info@lunariapp.site. The App sends content to AI providers only when you use an AI feature (§3), so you can keep using it as a private journal with no third-party data flow.
• Contact info@lunariapp.site for access, correction, or deletion requests.

If you live in Türkiye, your KVKK Article 11 rights are listed in the KVKK Aydınlatma Metni (https://lunariapp.site/kvkk.html).

If you are in the EU/EEA, Switzerland or the UK, see section 14.7 for your GDPR rights.

9. Security

All backend communication uses HTTPS. On-device data is protected by iOS's app sandbox and device encryption (when a device passcode is set). We do not store passwords, payment data, or biometric data.

10. Children

The App is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has used the App, contact us and we will act accordingly.

11. AI-generated content disclaimer

Dream interpretations, follow-up answers, and dream images are produced by third-party AI models. They are reflective, symbolic, and entertainment-oriented — not medical, psychological, legal, financial, or spiritual advice. Do not act on AI output for decisions affecting your health, safety, finances, or legal situation without consulting a qualified professional.

12. Changes

We may update this Policy. The "Last updated" date reflects the latest revision. The current version is always available in the App and at https://lunariapp.site/privacy.html.

13. Contact

• Data controller: Deniz Bedirhan Öksüz
• Email: info@lunariapp.site

If you live in Türkiye, see also the KVKK Aydınlatma Metni (https://lunariapp.site/kvkk.html) and your rights under KVKK Article 11.

14. Information for users in the EU/EEA, Switzerland and the UK (GDPR)

This section applies if you are located in the European Union or the European Economic Area (EU/EEA), Switzerland or the United Kingdom. It supplements sections 1–13 with the information required by the EU General Data Protection Regulation (GDPR) and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection (FADP). Where this section differs from another section of this Policy, this section applies to you.

14.1 Controller

The controller responsible for processing your personal data is Deniz Bedirhan Öksüz, email info@lunariapp.site. You can use this address for any data-protection question and to exercise your rights.

14.2 Purposes and legal bases

Data stored only on your device, or in your own private iCloud (Lunaria Plus), is not accessible to us (§1). For the processing we carry out or initiate, we rely on the following legal bases:

• Providing the App and your account — Sign in with Apple, the minimal server-side account record (§4), the free-quota timing and usage limits, and the Lunaria Plus iCloud backup (§1). Legal basis: Art. 6(1)(b) GDPR (performance of our contract with you under the Terms of Service).
• Subscriptions and credit purchases — processed by Apple through StoreKit; transaction identifiers and entitlement state stay on your device, and our backend is told only whether an interpretation uses the free quota (§1, §4). Legal basis: Art. 6(1)(b) GDPR.
• AI features — sending the content described in §3 (including your dream text, dictated audio, the personal details and "about me" note you added, digests of your previous dreams, your follow-up questions and image prompts) through our backend to OpenAI and Google to produce interpretations, follow-up answers, transcripts, summaries, keywords, titles, weekly reports and dream images, including automatic dream images for Lunaria Plus subscribers, and the automatic crisis check described in §3. Dreams and personal notes can reveal special categories of personal data, for example information about your health, sex life or sexual orientation, or religious or philosophical beliefs. Legal basis: your consent under Art. 6(1)(a) GDPR and your explicit consent under Art. 9(2)(a) GDPR.
• Security and abuse prevention — per-user and per-IP rate limiting, the usage limits stored in your account record, the identifier, session version and timestamps kept after account deletion so that earlier sign-in sessions stay invalid, and the operational logs described in §4, retained for 90 days. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is keeping the service secure and available and preventing misuse of our backend, the free quota and the AI features.
• Legal obligations and legal claims — disclosures we are required by law to make (§5): Art. 6(1)(c) GDPR. Disclosures to protect our rights or in connection with a business transfer (§5): Art. 6(1)(f) GDPR; our legitimate interest is establishing, exercising or defending legal claims and carrying out such a transfer.

14.3 Withdrawing your consent

You can withdraw your consent to AI processing at any time, with effect for the future (Art. 7(3) GDPR), by emailing info@lunariapp.site. The App sends content to AI providers only when you use an AI feature — including, for Lunaria Plus subscribers, the automatic dream image after an interpretation (§3) — so after withdrawing you can keep using Lunaria as a private journal with no third-party data flow (§8). Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before the withdrawal. Content already sent to OpenAI or Google before you withdrew is retained according to each provider's published API policy (§3, §7).

14.4 Recipients

Personal data is received by the providers listed in §5 — Apple (Sign in with Apple, App Store payments and subscriptions, iCloud backup), OpenAI (interpretation, follow-up answers, transcription, summaries, weekly reports) and Google (AI image generation via the Gemini API) — and by the service provider that hosts our backend server. We disclose information to other recipients, such as authorities, only in the cases described in §5.

14.5 Transfers to third countries

OpenAI and Google are based in the United States, and our backend server may be located outside the EU/EEA, Switzerland and the UK (§6). Transfers of your personal data to recipients outside these regions are based on the following safeguards:

• Where a recipient is certified under the EU-U.S. Data Privacy Framework (and, for transfers from the UK or Switzerland, the UK Extension to it or the Swiss-U.S. Data Privacy Framework), the transfer to that recipient is based on the corresponding adequacy decision (Art. 45 GDPR, or the corresponding UK or Swiss adequacy decision). You can check a company's current certification at https://www.dataprivacyframework.gov/list.
• Where a recipient is not certified, or a transfer is not covered by its certification, the transfer is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR), supplemented where required by the corresponding UK or Swiss transfer instruments.

Sign in with Apple, App Store purchases and the iCloud backup are services Apple provides to you under its own privacy policy (§5). You can request information about these safeguards, including a copy of them, at info@lunariapp.site.

14.6 Retention

We keep personal data only for as long as the purposes above require. The retention period for each category is listed in §7 — in particular, the usage data in the server-side account record is kept until you delete your account; the identifier Apple provides, the session version and the record's timestamps are kept after deletion so that earlier sign-in sessions stay invalid (§4); and backend operational logs are retained for 90 days.

14.7 Your rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR) — you can correct your profile yourself on the Profile screen.
• Erasure (Art. 17 GDPR) — you can delete the data on your device and the usage data in your server account record via Profile → Delete Account (§4), or ask us by email to delete your data.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — to receive the personal data you have provided to us, which we process by automated means on the basis of your consent or our contract with you, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Object to processing based on legitimate interests (Art. 21 GDPR) — see 14.8.
• Withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) — see 14.3.
• Lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU/EEA member state of your habitual residence, your place of work or the place of the alleged infringement. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC); in the United Kingdom, the Information Commissioner's Office (ICO).

To exercise your rights, email info@lunariapp.site. Because most of your data is stored only on your device (§1), you can also view, correct and delete it directly in the App. We respond without undue delay and in any event within one month of receiving your request; where necessary, this period can be extended by two further months (Art. 12(3) GDPR).

14.8 Your right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR, including the security and abuse-prevention processing described in 14.2. We will then stop that processing unless we can demonstrate compelling legitimate grounds for it that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally by email to info@lunariapp.site.

14.9 Is providing your data required?

You are not legally obliged to provide personal data. To use the App you need to sign in with Apple, because your account and the free-usage quota depend on it (§4). Your dream text, dictated audio and the other content described in §3 are needed only if you use AI features. Using them is voluntary; you can keep a dream journal in Lunaria without sending anything to AI providers (§8).

14.10 No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI interpretations, follow-up answers and dream images are reflective content (§11), not decisions about you. The automatic crisis check (§3) only changes the instructions given to the AI for that response.