Privacy Policy

Last updated: 11 November 2026 (effective with version 1.2 of the App)
Application: Lunaria
Data controller: Deniz Bedirhan Öksüz
Contact: info@lunariapp.com

This Privacy Policy explains how Lunaria ("Lunaria", "the App", "we", "our", "us") handles your information. Lunaria is an AI-assisted dream journal that records your dreams, generates symbolic interpretations, supports follow-up questions, and can optionally produce AI dream artwork. Please read this Policy to understand how we handle your information when you use the App.

We follow data minimization: we collect only what the App needs, keep most of your data on your device, and route AI requests through our own backend so that third-party providers never receive your Apple Account, device identifiers, or account credentials, only the content needed for each request (§3).

Before you use an AI feature for the first time, the App tells you what will be sent and to whom, and asks for your permission. Without your permission, nothing is sent to the AI providers. You can withdraw it at any time in Profile → Privacy & Security (§3).

The App is intended for users aged 16 or older.

Living in Türkiye? Under Turkish data-protection law (KVKK) we have additional disclosure duties, so please also read the KVKK Aydınlatma Metni (in Turkish): https://lunariapp.com/tr/kvkk/.

1. Information we collect

Stored locally on your device

The following is stored on your device (in the App's own storage: dream records in an app file, other data and settings in iOS preferences) and is not stored on our servers. Content you use AI features on is passed through our backend to AI providers (§3), and if you are signed into iCloud your dream records are additionally backed up to your own private iCloud (see below):

• Profile details: name, date of birth, and, optionally, time of birth, a profile photo, personal details (relationship status, number of siblings, number of children, pets, occupation) and an "about me" note.
• Dream records: the dream text you type or dictate and its source (typed or voice), title, creation and last-edited time, the generated interpretation, deep analysis, preview summary, extracted symbols, clarity, mood, dream type, the approach used, extra approach readings, perspective (dimension) cards with their deeper text, follow-up questions and answers, the guidance chat questions and answers, unfinished drafts, per-dream usage counters (for example, free follow-up questions used), optional AI dream image, and favorite flag.
• Weekly report (Lunaria Plus): the most recent AI weekly report you generated.
• Wallet & entitlement state: your free-interpretation counter, credit balance, processed StoreKit transaction IDs, and a cache of your latest subscription status.
• On-device diagnostic events: a lightweight in-app log of actions such as paywall views and purchase taps.

You can permanently erase this data from Profile → Delete Account. After deletion it cannot be recovered. The cached weekly report is currently not removed by account deletion; it is deleted when you remove the App.

iCloud backup

If you are signed into the App and into iCloud, the App backs up your dream records to your own private iCloud (an app-specific container under your Apple Account) so you don't lose your journal and can restore it on a new device.

• The backup lives in your iCloud storage, under your Apple Account. We, the developer, cannot read it: it is never sent to, stored on, or accessible by our backend.
• AI dream images are excluded from the backup; only your text-based dream data is included.
• The backup also holds deletion markers (the id and time of each dream you delete) so deletions carry across your devices.
• Apple keeps the backup in sync across devices signed into the same Apple Account.
• It runs for every user, with or without a subscription, while you are signed into the App and into iCloud on your device with iCloud Drive turned on. If you are not signed into iCloud or iCloud Drive is off, your data stays only on the device and is never sent to iCloud.
• When you delete your account, the App also tries to delete this backup file. This can fail, for example if your device is offline at that moment, so you can also remove it at any time from iOS Settings → [your name] → iCloud → Manage Account Storage.

Voice input (temporary)

If you dictate a dream, the App records a temporary audio file on your device and sends it over HTTPS to our backend, which forwards it to OpenAI only to obtain the transcript (§3). The audio file is deleted from your device as soon as transcription finishes, and no copy is kept on our backend.

Subscriptions and credits

Subscriptions and credit packs are processed by Apple's StoreKit. We never see your Apple Account, payment method, or billing address. The transaction identifiers and entitlement state StoreKit returns stay on your device; our backend is not told your subscription status or credit balance, only whether an interpretation uses the free quota (§4).

2. No tracking, no ads, no analytics SDKs

Lunaria contains no third-party analytics, attribution, or advertising SDKs. We do not use AppsFlyer, Firebase, or similar tools. We do not use the Advertising Identifier (IDFA), we do not show the App Tracking Transparency prompt, and we show no advertising. The diagnostic events in §1 never leave your device.

3. How AI features work

The App's AI features (interpretations, follow-up questions, voice input, the dream-writing helper, dream images and the weekly report) send the content described below through our backend to third-party AI providers. Nothing is sent to these providers unless you have given your permission in the App and use an AI feature; you can use Lunaria as a private journal with no third-party data flow. For Lunaria Plus subscribers, a dream image can also be created automatically after an interpretation (see below).

Your permission comes first. Before you use an AI feature for the first time, the App shows a screen that explains what is sent (the content listed below) and who receives it (our backend, which forwards it to OpenAI and, for dream images, to Google if we switch to it as the fallback provider), and asks for your permission. You can agree or choose not now. Until you agree, nothing is sent to the AI providers, including the automatic dream image for Lunaria Plus subscribers, and your journal keeps working as before. You can withdraw your permission at any time in Profile → Privacy & Security; from then on nothing is sent to the AI providers until you give your permission again.

To OpenAI, to produce interpretations, follow-up answers, transcripts, summaries, keywords, titles and weekly reports:

• your dream text, the interpretation approach you chose and, for some interpretation cards, the moods you selected;
• for the astrology approach, your sun sign (calculated on your device from your date of birth); for some approaches and cards, the moon phase of the night the dream was recorded;
• for the real-life and guidance cards and for follow-up questions, the personal details and "about me" note you added;
• for the main interpretation and for follow-up questions, a short digest of up to four of your previous interpreted dreams (their main symbols and the opening words of their interpretations);
• your follow-up questions, the earlier messages in that conversation and the main interpretation they refer to;
• dream drafts you ask the writing helper to tidy up, and the dream text and interpretation used to create a summary, keywords and a title;
• dictated audio, for transcription;
• for the weekly report (Lunaria Plus), that week's number of dreams, mood shares, recurring symbols and dream titles.

For dream images, to OpenAI, or to Google (Gemini API) as a fallback: an image prompt containing the dream's text, title, symbols and mood, to create a dream image. The prompt is sent to OpenAI. Google (Gemini API) is configured as a fallback provider; if we switch to it, for example during an OpenAI outage, the same prompt is sent to Google instead of OpenAI. This happens when you request an image and, for Lunaria Plus subscribers, automatically after an interpretation while a daily image allowance is available.

Before forwarding interpretation and follow-up requests, our backend automatically checks the text for phrases that may indicate a real-life crisis, such as self-harm. If the check matches, the AI is instructed to prioritize your wellbeing and, where appropriate, to open with a brief, caring note that encourages you to seek support. This check makes no decision about you.

Your name, the identifier Apple provides for your account, your email address, device identifiers and IP address are not included in requests to OpenAI or Google. See https://openai.com/policies/privacy-policy, https://openai.com/policies/api-data-usage-policies, and https://ai.google.dev/gemini-api/terms. Under OpenAI's published API policy, API content is retained for a limited period for abuse monitoring and is not used to train their models; refer to each provider for current details.

4. Our backend and what it stores

Our backend exists so that third-party API keys never live on your device. It:

• receives your AI request over HTTPS, forwards it to the appropriate provider, and returns the response;
• does not store your dreams, interpretations, follow-up questions, or generated images;
• when you sign in, receives the identity token Apple issues (which may contain your email address or an Apple private relay address), verifies it, and keeps only the user identifier Apple provides; your email address is not stored;
• keeps a minimal account record linked to that identifier: a session version number; when the record was created and last updated; the time of your last free interpretation; counters for image generations and weekly reports within time windows; the IDs and times of processed free-interpretation requests; and, for each dream you ask follow-up questions about, that dream's random ID and the number of questions. It does not store your name, email address, subscription status, or credit balance;
• applies per-user and per-IP rate limiting to prevent abuse, using counters held only in server memory;
• writes operational logs containing the request method, path, response code and duration and, for interpretation requests, the interpretation card, mode and lens used, the IDs of the dream-symbol categories our knowledge base detected, and whether the crisis check (§3) matched. These logs do not contain your dream text or your account identifier, and are retained for 90 days.

When you delete your account via Profile → Delete Account, the usage data in this record is deleted (the time of your last free interpretation, the counters, the processed request IDs and the follow-up question counts). We keep only the identifier Apple provides, the session version number and the record's timestamps, so that sign-in sessions issued before the deletion cannot be used again. If your device is offline when you delete your account, the deletion may not reach our server; in that case, email info@lunariapp.com.

5. Who we share information with

We share information only as needed to run the App, with providers required to protect it. We share personal data with OpenAI and Google only under their API terms and data processing terms, and with our hosting provider only under its service and data processing terms. These terms require them to protect the data to a standard at least equal to the one described in this Policy. Content reaches OpenAI or Google only after you have given your permission in the App (§3).

• Apple: Sign in with Apple, App Store payments and subscriptions, iCloud backup. https://www.apple.com/legal/privacy/
• OpenAI: dream interpretation, follow-up answers, transcription, summaries, weekly reports, dream images. https://openai.com/policies/privacy-policy
• Google: fallback provider for AI image generation (Gemini API), used instead of OpenAI only if we switch to it. https://ai.google.dev/gemini-api/terms
• Our hosting provider: the service provider that hosts our backend server.

We do not sell your personal information, we do not share dream content with advertisers, and we use no data brokers. We may disclose information if required by law or to protect our rights, and in connection with a business transfer.

6. International data transfers

OpenAI is based in the United States, as is Google when it is used as the fallback image provider; they may process the content of your AI requests there or in other countries where they operate. Our backend server may also be located outside your country of residence. We do not treat your use of the App as consent to these transfers: content is sent to the AI providers only after you have given your permission in the App (§3). If you are in the EU/EEA, Switzerland or the UK, section 14.5 describes the safeguards that apply. If you live in Türkiye, see the KVKK Aydınlatma Metni (https://lunariapp.com/tr/kvkk/) for the KVKK Article 9 cross-border transfer disclosure.

7. Retention and deletion

You can delete individual dream records or your entire account at any time from within the App, or email info@lunariapp.com to request deletion.

8. Your rights and choices

You can:

• Review the data the App holds; most of it is local, visible in the Profile screen and your dream history under My Dreams.
• Correct your profile from the Profile screen.
• Delete the App's data on your device and the usage data in your server account record via Profile → Delete Account (see §1 and §4). This does not cancel an active Apple subscription, which you manage in iOS Settings → [your name] → Subscriptions.
• Remove your iCloud backup: deleting your account also tries to delete it (see §1), and you can remove it yourself in iOS Settings → [your name] → iCloud → Manage Account Storage.
• Withdraw your permission for AI processing at any time by turning it off in Profile → Privacy & Security. From then on, the App sends nothing to the AI providers (§3), and you can keep using the App as a private journal with no third-party data flow. For questions about your consent or about content already sent, email info@lunariapp.com.
• Contact info@lunariapp.com for access, correction, or deletion requests.

If you live in Türkiye, your KVKK Article 11 rights are listed in the KVKK Aydınlatma Metni (https://lunariapp.com/tr/kvkk/).

If you are in the EU/EEA, Switzerland or the UK, see section 14.7 for your GDPR rights.

9. Security

All backend communication uses HTTPS. On-device data is protected by iOS's app sandbox and device encryption (when a device passcode is set). We do not store passwords, payment data, or biometric data.

10. Children

The App is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has used the App, contact us and we will act accordingly.

11. AI-generated content disclaimer

Dream interpretations, follow-up answers, and dream images are produced by third-party AI models. They are reflective, symbolic, and entertainment-oriented, not medical, psychological, legal, financial, or spiritual advice. Do not act on AI output for decisions affecting your health, safety, finances, or legal situation without consulting a qualified professional.

12. Changes

We may update this Policy. The "Last updated" date reflects the latest revision. The current version is always available in the App and at https://lunariapp.com/privacy/.

13. Contact

• Data controller: Deniz Bedirhan Öksüz
• Email: info@lunariapp.com

If you live in Türkiye, see also the KVKK Aydınlatma Metni (https://lunariapp.com/tr/kvkk/) and your rights under KVKK Article 11.

14. Information for users in the EU/EEA, Switzerland and the UK (GDPR)

This section applies if you are located in the European Union or the European Economic Area (EU/EEA), Switzerland or the United Kingdom. It supplements sections 1 to 13 with the information required by the EU General Data Protection Regulation (GDPR) and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection (FADP). Where this section differs from another section of this Policy, this section applies to you.

14.1 Controller

The controller responsible for processing your personal data is Deniz Bedirhan Öksüz, email info@lunariapp.com. You can use this address for any data-protection question and to exercise your rights.

14.2 Purposes and legal bases

Data stored only on your device, or in your own private iCloud, is not accessible to us (§1). For the processing we carry out or initiate, we rely on the following legal bases:

• Providing the App and your account: Sign in with Apple, the minimal server-side account record (§4), the free-quota timing and usage limits, and the iCloud backup (§1). Legal basis: Art. 6(1)(b) GDPR (performance of our contract with you under the Terms of Service).
• Subscriptions and credit purchases: processed by Apple through StoreKit; transaction identifiers and entitlement state stay on your device, and our backend is told only whether an interpretation uses the free quota (§1, §4). Legal basis: Art. 6(1)(b) GDPR.
• AI features: sending the content described in §3 (including your dream text, dictated audio, the personal details and "about me" note you added, digests of your previous dreams, your follow-up questions and image prompts) through our backend to OpenAI (and, for dream images, to Google if it is used as the fallback provider) to produce interpretations, follow-up answers, transcripts, summaries, keywords, titles, weekly reports and dream images, including automatic dream images for Lunaria Plus subscribers, and the automatic crisis check described in §3. Dreams and personal notes can reveal special categories of personal data, for example information about your health, sex life or sexual orientation, or religious or philosophical beliefs. Legal basis: your consent under Art. 6(1)(a) GDPR and your explicit consent under Art. 9(2)(a) GDPR, which you give in the App before you use an AI feature for the first time (§3).
• Security and abuse prevention: per-user and per-IP rate limiting, the usage limits stored in your account record, the identifier, session version and timestamps kept after account deletion so that earlier sign-in sessions stay invalid, and the operational logs described in §4, retained for 90 days. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is keeping the service secure and available and preventing misuse of our backend, the free quota and the AI features.
• Legal obligations and legal claims: disclosures we are required by law to make (§5): Art. 6(1)(c) GDPR. Disclosures to protect our rights or in connection with a business transfer (§5): Art. 6(1)(f) GDPR; our legitimate interest is establishing, exercising or defending legal claims and carrying out such a transfer.

14.3 Withdrawing your consent

You can withdraw your consent to AI processing at any time, with effect for the future (Art. 7(3) GDPR), by turning it off in Profile → Privacy & Security. From then on, the App sends nothing to the AI providers, including the automatic dream image for Lunaria Plus subscribers (§3), and you can keep using Lunaria as a private journal with no third-party data flow (§8). Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before the withdrawal. Content already sent to OpenAI or Google before you withdrew is retained according to each provider's published API policy (§3, §7). For questions about your consent or about content already sent, email info@lunariapp.com.

14.4 Recipients

Personal data is received by the providers listed in §5, namely Apple (Sign in with Apple, App Store payments and subscriptions, iCloud backup), OpenAI (interpretation, follow-up answers, transcription, summaries, weekly reports, dream images) and Google (fallback provider for dream images via the Gemini API), and by the service provider that hosts our backend server. We disclose information to other recipients, such as authorities, only in the cases described in §5.

14.5 Transfers to third countries

OpenAI and Google are based in the United States, and our backend server may be located outside the EU/EEA, Switzerland and the UK (§6). Transfers of your personal data to recipients outside these regions are based on the following safeguards:

• Where a recipient is certified under the EU-U.S. Data Privacy Framework (and, for transfers from the UK or Switzerland, the UK Extension to it or the Swiss-U.S. Data Privacy Framework), the transfer to that recipient is based on the corresponding adequacy decision (Art. 45 GDPR, or the corresponding UK or Swiss adequacy decision). You can check a company's current certification at https://www.dataprivacyframework.gov/list.
• Where a recipient is not certified, or a transfer is not covered by its certification, the transfer is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR), supplemented where required by the corresponding UK or Swiss transfer instruments.

Sign in with Apple, App Store purchases and the iCloud backup are services Apple provides to you under its own privacy policy (§5). You can request information about these safeguards, including a copy of them, at info@lunariapp.com.

14.6 Retention

We keep personal data only for as long as the purposes above require. The retention period for each category is listed in §7. In particular, the usage data in the server-side account record is kept until you delete your account; the identifier Apple provides, the session version and the record's timestamps are kept after deletion so that earlier sign-in sessions stay invalid (§4); and backend operational logs are retained for 90 days.

14.7 Your rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR): you can correct your profile yourself on the Profile screen.
• Erasure (Art. 17 GDPR): you can delete the data on your device and the usage data in your server account record via Profile → Delete Account (§4), or ask us by email to delete your data.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): to receive the personal data you have provided to us, which we process by automated means on the basis of your consent or our contract with you, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Object to processing based on legitimate interests (Art. 21 GDPR): see 14.8.
• Withdraw your consent at any time with effect for the future (Art. 7(3) GDPR): see 14.3.
• Lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU/EEA member state of your habitual residence, your place of work or the place of the alleged infringement. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC); in the United Kingdom, the Information Commissioner's Office (ICO).

To exercise your rights, email info@lunariapp.com. Because most of your data is stored only on your device (§1), you can also view, correct and delete it directly in the App. We respond without undue delay and in any event within one month of receiving your request; where necessary, this period can be extended by two further months (Art. 12(3) GDPR).

14.8 Your right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR, including the security and abuse-prevention processing described in 14.2. We will then stop that processing unless we can demonstrate compelling legitimate grounds for it that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally by email to info@lunariapp.com.

14.9 Is providing your data required?

You are not legally obliged to provide personal data. To use the App you need to sign in with Apple, because your account and the free-usage quota depend on it (§4). Your dream text, dictated audio and the other content described in §3 are needed only if you use AI features. Using them is voluntary and needs your permission in the App (§3); you can keep a dream journal in Lunaria without sending anything to AI providers (§8).

14.10 No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI interpretations, follow-up answers and dream images are reflective content (§11), not decisions about you. The automatic crisis check (§3) only changes the instructions given to the AI for that response.