Privacy

Applies to the website lunabia.com and, in the last section, to the Lunabia app. Last updated 22 September 2026. This is a translation for convenience; the German version is the authoritative one.

In plain words, with answers to the most common questions: Our promise.

Controller

Fluxera LLC
75 E 3rd St, Ste 7
Sheridan, Wyoming 82801
United States of America
info@lunabia.com

Fluxera LLC operates the Lunabia app and website. Questions about data protection and requests for access, correction or deletion go to the address above.

The short version first

• This site sets no cookies.
• There is no analytics, no tracking pixels, no tracking and no advertising networks.
• The fonts are served from our own server. Nothing is loaded from Google when you open this page.
• There is no embedded third-party content, no maps, no videos, no social networks.
• On the website, personal data arises in exactly one place: when you sign up for the waitlist. For the app, see the section The app.

We are based in the USA

Fluxera LLC is a company based in Wyoming. Data we process is therefore also processed in the United States. Under European law the USA counts as a third country whose level of protection does not match the GDPR. In particular, authorities there may access data under certain conditions without the same legal remedies being available as in the European Union.

For the waitlist we base the transfer on your explicit consent under Art. 49(1)(a) GDPR. You give it by submitting the form, aware of this notice, and you can withdraw it at any time. If you do not want that, do not sign up: simply reading this page requires none of it.

Visiting the site

The site is delivered by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open it, Cloudflare processes technically necessary connection data, including the IP address, the time, the requested address and details of the browser. This is unavoidable for running a website: without an IP address no response can be delivered.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and working operation of the site. Cloudflare acts as a processor; transfers to third countries are covered by the standard contractual clauses. We ourselves keep no server logs and analyse none.

The waitlist

When you enter your email address, we store:

Email address

so we can write to you at launch

Time

to be able to prove the consent and delete it later

Browser language

shortened to two letters, so the message arrives in the right language

The legal basis is your consent under Art. 6(1)(a) GDPR, and for the transfer to the USA additionally Art. 49(1)(a) GDPR. You can withdraw it at any time, informally, to info@lunabia.com. We write to you at most twice: a short confirmation right after you sign up and a message at launch, and after that only if you explicitly want us to. On days with a great many sign-ups, some of them get no confirmation; they are on the list all the same. We do not pass on your address and we do not sell it.

These emails are sent through Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), with servers in Ireland. Resend receives your address and the text of the email for this purpose and acts as a processor; the transfer is covered by the standard contractual clauses. The sender addresses hello@lunabia.com and noreply@lunabia.com do not accept replies.

Deletion takes place at the latest six months after the app launches, or immediately if you withdraw consent.

Protection against bulk sign-ups

So that the form cannot be filled automatically, we additionally store a hash of your IP address together with a counter. It is computed with a secret key that exists only on the server; without that key, the address cannot be recovered from the value. For an IPv6 address only its leading part is used, the network of your connection. The IP address itself is not stored. The entry is valid for one hour and is deleted automatically at most ten minutes later. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is protection against abuse.

Where the data is kept

In a Cloudflare database (D1) located in Western Europe. It is separate from the app's data: anyone who signs up here has no account with us and no link to content stored in the app. Only Fluxera LLC has access to this database, from the USA.

Fonts

The fonts Playfair Display, Outfit and Nunito Sans are licensed under the SIL Open Font License and are served from our own server. There is no connection to Google Fonts, and no IP address is sent to Google.

Your rights

At any time you have the right to:

• access to the data stored about you (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal email to info@lunabia.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority, usually the one of the state you live in.

The app

Everything above applies to the website. This section applies to the Lunabia app. It works with different data, and with more sensitive data.

Which data

• Health data and data concerning sex life within the meaning of Art. 9 GDPR: cycle, bleeding, symptoms, mood, test results, details about sex, pregnancy with weight, kicks and contractions.
• Details about your child: name, date of birth, growth, feeding, nappies, sleep, milestones, plus photos and videos.
• Your name or nickname and your age group, both optional, for the greeting and so that content fits your stage of life. Both stay on the device and do not go to the server.
• Account data, only if you create an account: your email address, and with Google sign-in also the identifier of your Google account.

Only what you enter yourself is processed. The app reads nothing from other apps, not from Apple Health or Google Fit, and not your location.

What for, and on what basis

To show you your entries, to calculate estimates from them (such as your next period or the due date) and, if you have an account, to keep them the same across your devices. For nothing else: no advertising, no profiling, no selling, no training of AI models.

The legal basis for health data and data concerning sex life is your explicit consent under Art. 9(2)(a) GDPR. The app asks for it on first launch in a step of its own, before sign-in and before anything is stored or transmitted. Without it the app stays closed. For the account, the basis is the contract of use (Art. 6(1)(b) GDPR). For your child's data you consent as the person with parental responsibility.

Withdrawal

You can withdraw consent at any time, in the app under More, Profile, at the very bottom. It takes one tap, just like giving it. After that the app processes nothing further and no longer syncs with the server. What happened until then remains lawful. Your entries on the device stay there until you delete them or remove the app. What is on the server you delete in the same place with "Delete account", completely and immediately.

Where the data is kept

Without an account, only on your device. None of it reaches us then. With an account, also at Cloudflare: entries in a database (D1), photos and videos in file storage (R2) within the EU jurisdiction. Transmission is encrypted. Only Fluxera LLC has access, from the USA, see "We are based in the USA" above. We also base this transfer on your explicit consent (Art. 49(1)(a) GDPR), which the consent step in the app covers.

Your Cosmos

For "Your Cosmos" you enter your date of birth, your time of birth (if you know it) and your place of birth, in the app and, to try it out, on this website. The place search and the calculation run on our own server at Cloudflare (api.lunabia.com). Your search text goes to no map service, neither Google nor OpenStreetMap, but to a list of places on our server. Date, time and the coordinates of the place are processed only for the calculation and discarded afterwards: we do not store them and keep no logs with this content. In the app the result stays on your device and is not synced with your account; on the website it stays in the open window.

The legal basis is Art. 6(1)(b) GDPR: you request the calculation, and it cannot be done without these details. It is not health data. The list of places comes from GeoNames (geonames.org, licence CC BY 4.0).

Trusted people

For "Waters broke" and the card for fertile days you can save up to three people with name and phone number. These details stay on your device: they do not go to our server and are not synced. A tap opens WhatsApp or your SMS app with the prepared text; you send it there yourself, and that service's terms apply to sending it. Lunabia reads neither your address book nor your location. You can delete any person at any time in the app under More, Trusted people.

Who else is involved

• Cloudflare as technical provider for servers, database and file storage.
• Resend sends the email with the sign-in code and sees your email address for that, nothing else.
• Google, only if you sign in with Google. Google learns that you sign in to Lunabia, but nothing of what you enter.
• Expo delivers updates of the app. This involves a technical request, without any content from the app.
• People you invite yourself: with family sharing, invited people see the moments of the child you share. Cycle and pregnancy are never shared.

What does not exist

No third-party tracking SDKs. The app contains no Meta pixel, no Facebook SDK, no Google Analytics, no Firebase, no advertising network and no service that reports crashes or usage to third parties. Notifications do not come from a server: there is only the reminder you set yourself, and it lives with your device's operating system.

How long

Until you delete. Individual entries at any time in the app, the whole account with everything on the server under More, Profile. Sign-in codes expire after 15 minutes.