Privacy policy

This policy explains which personal data we process when you use Lunamemo, why, and what rights you have under the General Data Protection Regulation (GDPR).

1. Controller

Robin Foss, trading as “Robin Foss Software”, Horremer Straße 7, 41470 Neuss, Germany. Email: robinfoss.contact@gmail.com. We have not appointed a data protection officer, because the law does not require one.

2. What we process

Visiting the website. Our hosting provider receives your IP address, the date and time, the requested address, the status of the response, and your browser type when you load a page or call the Service. We use this to deliver the website and to keep it secure and stable (Art. 6(1)(f) GDPR). The logs are kept for a short time and then deleted automatically. We do not use analytics, advertising or tracking tools. To limit abuse, our server counts requests per IP address in working memory only; these counters are not stored and disappear within minutes.

Signing in with Google. When you continue with Google, Google and its service Firebase Authentication process your sign-in. We receive a user ID, your email address and your name. We store these to recognise your account (Art. 6(1)(b) GDPR). Firebase also processes technical data such as your IP address and browser details to secure the sign-in; it keeps this data for a limited time. Google processes data about your use of your Google account as a separate controller under its own privacy policy.

Your memories. We store the notes that you or the assistants you connected save in your account: the text, a category, an importance value, timestamps and the name of the assistant that saved it. We store and provide them to you and to the assistants you connected, which is the purpose of the Service (Art. 6(1)(b) GDPR). We do not read your memories, analyse them, or use them for advertising, profiling or to train AI models.

Connections to assistants. When you connect an assistant, we store a technical record: the assistant’s name, the time of connection and a hashed token that keeps the connection active. Access tokens are short-lived. This is necessary to provide the Service and to protect your account (Art. 6(1)(b) and (f) GDPR).

Contacting us. If you write to us, we process your message and your email address to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when the matter is closed, unless a statutory retention obligation applies.

3. Sensitive information

The Service is not designed for special categories of personal data (for example health data or political opinions) or for secrets such as passwords or payment details, and we ask you not to store them. We block obvious secrets automatically. If you or an assistant nevertheless save such information, this happens on your own initiative and we process it only to provide the Service to you (Art. 9(2)(a) GDPR).

4. Cookies and local storage

We do not set cookies. When you sign in, the Firebase software stores a session in your browser’s storage (IndexedDB or local storage) so that you stay signed in. This is technically necessary to provide the function you asked for and therefore does not require consent (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). You can remove it by signing out or clearing your browser data.

5. Recipients and processors

• Google Cloud EMEA Limited, Ireland, and Google LLC, USA, for Firebase Authentication (sign-in) and Cloud Firestore (database). Your memories are stored in the EU (Google Cloud region “eur3”). Firebase Authentication runs only in the USA.
• Vercel Inc., USA, for hosting the website and running the Service.
• The assistants you connect, for example OpenAI (ChatGPT) and Anthropic (Claude). When you connect an assistant, it can read, add and delete your memories, and what it reads becomes part of your conversation with it. From that point the provider processes the data under its own terms and privacy policy, as an independent controller. This takes place at your instruction. You can disconnect an assistant at any time in the dashboard.

We do not sell your data and do not pass it on to anyone else, except where we are legally obliged to.

6. Transfers to third countries

Some of the providers named above process data in the USA. Google LLC and Vercel Inc. are certified under the EU–U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision. In addition, the providers rely on the EU Standard Contractual Clauses.

7. Storage periods

• Account and memories: until you delete them or your account.
• Connection records: until you disconnect or delete your account; a connection expires 60 days after it was last used, and expired records are deleted by a daily cleanup.
• Authorisation codes: valid for 5 minutes and deleted when used or by the daily cleanup.
• Server logs at the hosting provider: a short period, then automatic deletion.
• After you delete your account, we remove memories, connection records and account data from our database without delay. We also request deletion of the Firebase Authentication sign-in record immediately. If that separate provider request fails temporarily, it is queued and retried automatically by the daily cleanup. Copies in provider backups are overwritten within the providers’ regular cycles, at the latest after 180 days.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) with regard to your data. Where we process data on the basis of consent, you can withdraw it at any time with effect for the future.

Most of these rights you can exercise yourself in the dashboard: edit or delete single memories, export everything as a file, disconnect assistants, and delete your account together with all data. For anything else, email us at robinfoss.contact@gmail.com.

Right to object (Art. 21): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany (www.ldi.nrw.de).

9. Obligation to provide data and automated decisions

Providing your Google account data is necessary to use the Service; without it we cannot offer it. We do not make decisions based solely on automated processing that have legal effects on you.

10. Security

All connections are encrypted. Access to your memories requires a valid, signed token tied to your account and to this Service; connection tokens are stored only as hashes and are rotated on every use. The database cannot be accessed directly from the internet.

11. Age

The Service is not intended for persons under 16.

12. Changes

We update this policy when the Service or the legal situation changes. The current version is always available on this page.