Privacy Policy

At Luna, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and share information about you when you use our tarot reading and lunar calendar services.

Luna does not have a server-side account database. Your account information (name, email, birth date), reading history, oracle questions, journal entries, and settings are stored only in your device's browser local storage (localStorage) and IndexedDB, and are not uploaded to our servers. This means: (1) You can view, export, or delete this data at any time in your browser settings or in this app's "Settings -> Data Management"; (2) Clearing browser data will permanently delete all your reading history; (3) We cannot restore your data on the server side. The only exception is when you actively use the share function, the reading content will be encoded into the share link (see the "Share Links" section below).

We collect information you provide directly to us, including:

• •Profile information (name, email, birth date)
• •Tarot reading history and saved readings
• •Journal entries and personal reflections
• •Usage data and interaction patterns
• •Device information and browser type

We process the following categories of personal data: (1) Identity data: name, email address. (2) Personal characteristics: date of birth, gender, zodiac sign. (3) Service usage data: tarot readings, journal entries, favorites. (4) Technical data: browser type, device information, IP address. (5) Consent records: cookie preferences, age verification. The legal basis for processing includes: consent (Art. 6(1)(a) GDPR), contract performance (Art. 6(1)(b) GDPR), and legitimate interests (Art. 6(1)(f) GDPR).

We use the information we collect to:

• •Provide, maintain, and improve our services
• •Personalize your tarot readings and recommendations
• •Send you technical notices and support messages
• •Analyze usage patterns and trends
• •Detect and prevent fraud and abuse

We do not sell your personal information. We may share your information only in the following circumstances:

• •With service providers who assist in operating our platform
• •When required by law or legal process
• •With your consent or at your direction

We use Google AdSense to display advertisements. Google and its partners may use cookies and similar technologies to collect information about your online activities across different sites to provide relevant advertisements. You can control your ad preferences through our Cookie Settings or by visiting Google Ads Settings. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the Internet. You may opt out of personalized advertising by visiting www.google.com/settings/ads.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Passwords are hashed using PBKDF2 with 100,000 iterations. Sensitive data is encrypted at rest using AES-GCM via the Web Crypto API.

Depending on your location, you may have the following rights:

• •Access and receive a copy of your data
• •Rectify inaccurate or incomplete data
• •Delete your personal data
• •Restrict or object to processing
• •Data portability
• •Withdraw consent at any time

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data in accordance with the General Data Protection Regulation (GDPR). Our lawful basis for processing includes your consent and our legitimate interests in providing and improving our services. You have the right to lodge a complaint with a supervisory authority in your jurisdiction.

Pursuant to Article 27 of the GDPR, Luna has appointed an EU representative for data protection matters. You can contact our EU representative at: [email protected]. This does not affect your right to lodge a complaint with a supervisory authority.

Your data may be transferred to and processed in countries outside the EEA. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions.

If you are a California resident, you have the right to opt out of the sale of your personal information. We do not sell personal information. You also have the right to request disclosure of the categories and specific pieces of personal information we have collected about you. To exercise these rights, contact us at [email protected].

Luna is a serverless application, and all user data is stored in your browser: (1) localStorage: account information, reading history, oracle records, user settings, age verification flags. (2) IndexedDB: reading records, journal entries, favorites. (3) Service Worker cache: static assets (images, fonts, application code) to support offline use. When you install Luna as a Progressive Web App (PWA), this data remains on your device. You can export or clear all data through this app's "Settings -> Data Management", or by uninstalling the PWA / clearing browser site data.

When you actively use the share function, your reading content (including question text, drawn cards, positions, and answers) is encoded into the URL parameters of the share link. Anyone who obtains this link can decode and view the complete content. This link may be retained by social platform crawlers, chat server logs, or browser history. Once shared, deleting the reading on your device will not affect the already shared link. Please share readings containing sensitive questions with caution.

Since Luna does not store your personal data on servers, data retention is entirely under your control: (1) Account information, reading history, journal entries, and favorites are retained until you actively delete them, delete your account, or clear browser data. (2) Cookie consent records are retained for 2 years from the date of consent, to comply with applicable legal requirements. (3) Age verification flags are retained until you clear browser data. (4) Our servers only record anonymous access logs (without personally identifiable information) for security and debugging, retained for 90 days. To delete local data in advance, please use "Settings -> Data Management".

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page with an updated effective date and, where required, by obtaining your renewed consent.

For data protection inquiries, you may also contact our Data Protection Officer at: [email protected].

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at: