Eluna — Privacy Policy and Terms of Use

The short version

Eluna has no accounts and no servers. There is no sign-up, no profile, and no database of ours anywhere with your name on it. What you write down in an Eluna app — your cycle, your books, your watch history — is stored in a database on your own phone, and we cannot read it, because there is nowhere for us to read it from.

That is not the whole story, and the rest of this page is the rest of the story. An app that has to tell you when the next episode airs must ask somebody. An app that shows an ad must talk to the ad network. Every one of those requests goes directly from your phone to that service — never through a server of ours — and every one of them is listed below, with how to stop it where stopping it is possible.

The apps differ, and this policy does not pretend otherwise: what leaves the device is spelled out per app, and the annex at the end is the summary.

The apps this covers

Apps released later are covered by this policy from the day they ship, and the annex is updated with them.

What we never do

• No account. No sign-up, no sign-in, no user id of ours, no profile of you.
• No analytics. None of these apps contains an analytics SDK. We do not measure what you tap, read, watch, or log.
• No crash reporting. No Sentry, no Crashlytics. A crash is written to a log on your device and stays there.
• No data brokers. We do not sell, rent or share your data. There is no mechanism by which we could.
• No personalized advertising. Where ads appear, they are always requested as non-personalized: they are not chosen using a profile of you or of what you have done in the app.
• No profiling of the contents. No Eluna app sends what you wrote anywhere for analysis. Not your symptoms, not your notes, not your diary.

What stays on your device

Everything you enter. Concretely, per app:

• Eluna Cycle — period and cycle dates, basal temperature, symptoms (including intimate ones), moods, medications, notes, and your app PIN. Stored in a local SQLite database; the more sensitive fields (notes, intensities, temperature, sexual activity, exact times) are encrypted with a key held in the device keystore.
• Eluna Reader — the book files you import, their covers, your reading position, highlights, notes, bookmarks, reading statistics, looked-up words, and a full-text index of your books. All local.
• Eluna Screen — what you track, what you have watched and when, your diary entries, ratings, notes, goals, collections, and any photos you attach to a diary entry.

Uninstalling an app deletes all of it. That is the flip side of local-first, and it is stated again under Your responsibility below.

What leaves your device

Each item below is a direct call from your phone to that service, so that service sees your IP address. None of it passes through a server of ours.

1. Advertising — Eluna Cycle, Eluna Reader, Eluna Screen

The free apps are funded by a single banner. Never an interstitial, never a rewarded video.

It does not appear at all:

• during the first two weeks after you install the app;
• ever again, once you buy the one-time “remove ads” purchase.

When it does appear, it is served by Google AdMob, which receives your IP address, your device model and OS, and — in the apps that have not removed the permission — your device's advertising identifier. Ads are requested as non-personalized: they are never chosen from a profile of you or of what you have done in the app. AdMob still uses the identifier for frequency capping and fraud prevention, and that is why consent matters where the law requires it.

In the EEA, the UK and Switzerland, every Eluna app asks first. Google's consent form is shown before the advertising SDK is started, and if you decline it is never started at all — no ad request, no identifier, no ad. You can change your answer at any time from the app's settings, under Ad privacy. Outside those regions no form is required and none is shown.

Google's handling of this data is described at policies.google.com/technologies/partner-sites.

Legal basis: consent (Art. 6(1)(a)) where required; otherwise our legitimate interest in funding a free app (Art. 6(1)(f)).

2. Purchases — all apps with a “remove ads” option

Handled entirely by Google Play Billing or the Apple App Store. They tell the app whether the purchase exists; we never see your payment details, your card, or your name. No third-party purchase-validation service is used — no RevenueCat, no receipt server of ours.

3. Catalogues and reference data — Eluna Screen, Eluna Reader

Eluna Screen queries the public catalogues it needs to know anything about a show at all: TMDB, TVmaze, Kitsu, Shikimori and Simkl. They receive the request (a search term, a show id) and your IP address. This cannot be switched off — without it the app knows nothing about any title.

Optionally, and on by default, an English synopsis can be sent to translated.net (MyMemory) to be translated into your language. The text is public — it came from the catalogues above — but translated.net sees your IP address alongside it. Turning Translate descriptions off stops this completely, and the app then simply shows you the original English text; there is no on-device translator.

Eluna Reader talks to a catalogue only when you open one: the OPDS catalogues (Project Gutenberg, ManyBooks, or any you add yourself) receive your searches and, if the catalogue requires a login, the credentials you gave it. Two lookup features are off by default and, when you switch them on and use them, send the text you selected in your book:

• the dictionary lookup sends the selected word to en.wiktionary.org;
• the translation sends the selected passage (up to 500 characters) to MyMemory.

These are the only channels in any Eluna app through which the content of your own file leaves the device, they are opt-in, and they are per-tap.

OCR language models are downloaded from GitHub when you enable a language; the OCR itself runs on the device.

4. App updates — Eluna Cycle

Eluna Cycle checks for a code update from Expo's update service (u.expo.dev) on each launch. That request carries the platform, the app's runtime version and your IP address. It carries none of your data. The same app downloads its knowledge-base language packs from GitHub on demand, which tells GitHub your IP and which language you asked for.

5. Cloud backup — Eluna Screen, Eluna Reader

Both offer an end-to-end encrypted backup: the library is packaged and encrypted on your phone with a key derived from a password only you know, and the sealed file is placed in your own Google Drive (in the app's hidden appDataFolder, from which the app can see none of your other files) or, on iOS, your own iCloud container.

Google and Apple hold the file. They cannot read it. Neither can we — the key never leaves your device and is stored nowhere, including by us. That also means we cannot recover it for you, which is why the app shows a one-time recovery code when you turn the feature on.

Signing in to Google hands the app your name, email address and profile photo — that is how Google sign-in works, and Google says so in its own consent dialog. Of these the app uses only the email address, and only to show you which account the backup went to. It stays on the device. iCloud needs no sign-in at all and gives the app no account details.

Eluna Reader additionally supports WebDAV and KOSync servers that you choose and configure. Those are your servers; what the app sends them (reading progress, statistics, a backup archive) goes to you, not to us.

6. Support emails — Eluna Cycle, Eluna Reader, Eluna Screen

If you write to support from inside an app, the app can attach diagnostic information. It is shown to you, in the draft, before you send it, and you send it yourself from your own mail app.

In Eluna Cycle that diagnostic bundle is not neutral: with the consent toggle on, it can include your cycle history and the last 30 days of logged symptoms, which are health data of the most sensitive kind. The toggle is off by default and you can send the email without it. Read the draft before you send it — this is the one place where health data can leave your phone, and it leaves it because you pressed send.

Health data — Eluna Cycle

Everything Eluna Cycle records about your body is a special category of personal data under Art. 9 GDPR. We treat it accordingly:

• It is stored only on your device. It is not uploaded, not synced, not analysed by us, and not shared with anyone.
• Predictions and insights are computed on the device. There is no AI service, no remote model, and no server involved.
• The only path by which it can leave the phone is the support email described above, and the backup file you export yourself.
• Legal basis: your explicit consent (Art. 9(2)(a)), given by entering the data and, for the support email, by ticking the box.

Eluna Cycle is not a medical device. Its predictions cannot be used as contraception and do not replace a doctor. It is a diary with arithmetic on top.

Backups you make yourself

You can export your data. Where the file goes is your decision — the app hands it to your system's share sheet and does not know what you pick.

What is and is not encrypted, plainly:

That last row is a fact, not a feature, and it is here because a backup you believe is encrypted and is not is worse than one you know is not.

Children

No Eluna app is directed to children under 13 (under 16 in the EEA), and we do not knowingly collect data from them. Ads are non-personalized for everyone regardless of age. If you believe a child has provided personal data through an Eluna app, write to us and we will help you delete it — though in nearly every case the data is on the device and deleting the app deletes it.

Your rights

Because there is no account and no server, most of these are things you can do yourself, immediately, without asking us:

• Access and portability — export your data from the app's settings.
• Erasure — uninstall the app. If you enabled cloud backup, delete the vault as well (in the app: Cloud sync → Delete the cloud copy).
• Withdraw consent — turn off the feature that asked for it: ads consent (EEA users, in Settings), translation, cloud backup, or the support-email diagnostics.
• Object, or complain — write to support@eluna-apps.com, or to your national data-protection authority.

We hold no personal data about you on any server. We cannot look you up, and a request to us to delete “your data” has nothing on our side to act on. That is a property of the design, not an evasion of the question.

Retention: we retain nothing, because we receive nothing. Data lives on your device until you delete it. If you emailed support, that email sits in our mailbox until we delete it; we delete support correspondence within 12 months.

Changes

If this policy changes materially, the effective date at the top changes with it, and the in-app privacy screen links here — so the version you are reading is the current one.

Terms of Use

License. Downloading an Eluna app grants you a personal, non-exclusive, non-transferable licence to use it. You may not resell it, or redistribute a modified build of it.

The apps change. Features, interfaces, forecasting and reading engines are improved over time. We do not promise that any particular feature will exist forever, and we do not promise the apps are free of defects.

Your data is your responsibility. These apps are local-first: your data lives on your device and nowhere else unless you say otherwise. If you delete an app without exporting your data, or you lose the device, the data is gone, and we cannot recover it — we never had it. Where an app offers a backup, use it. Where a backup is protected by a password only you know, a forgotten password cannot be reset by anyone, including us; that is what the one-time recovery code is for, and it is worth writing down.

Health disclaimer (Eluna Cycle). Not a medical device. Not contraception. Not a diagnosis. Not a substitute for a doctor. Decisions you make on the basis of what the app shows you are yours.

Automated insights. Any insight, summary, forecast or suggestion an Eluna app produces is informational. It is computed by arithmetic on the device, it can be wrong, and it is not advice.

Content you bring. Eluna Reader opens books you supply. Whether you have the right to a given file is between you and whoever holds its copyright; Eluna hosts no books and provides no library of copyrighted works.

Liability. To the extent the law allows, we are not liable for data loss caused by device failure, OS updates, uninstalling an app, or a lost password. Nothing here limits liability that cannot be limited by law, and nothing here affects your statutory rights as a consumer.

Purchases and refunds are handled by Google Play or the Apple App Store under their terms; refund requests go to them, not to us.

Annex — what each app actually does