Effective date: 2026-05-13 · Last updated: 2026-11-03
Privacy Policy
This Privacy Policy describes how Moon Invest Inc., doing business as Luuna (“Luuna,” “we,” “us,” or “our”) collects, uses, and shares your information when you use the Luuna mobile application, the tryluuna.com website, and related services (the “Service”).
Marketing website (tryluuna.com)
If you join the Luuna alpha waitlist on tryluuna.com without yet creating an account in the app, we collect only what you submit on the signup form:
- Email address — used to email you when your TestFlight cohort opens and to send occasional updates about the alpha.
- First name — used to personalize the emails we send you.
- Referral source — your optional answer to “How did you hear about us?”, used to understand which channels bring people to Luuna.
We process this information based on your consent (the act of submitting the form). We do not sell it, share it with advertising partners, or use it to train AI models. Waitlist records are stored on our backend (see “Railway / cloud hosting” in the providers table below) for the duration of the alpha program.
To remove your email from the waitlist or request deletion of your waitlist record at any time, email info@tryluuna.com. The rest of this Privacy Policy describes what happens once you create an account and use the Luuna app.
What we collect
Information you provide
- Phone number — used to create your account and send a one-time verification code via SMS (delivered by Twilio).
- Email address — used for account recovery and important account notifications (delivered by SendGrid).
- Name — first and last name, shown in the app.
- Profile preferences — country, language, date format, notification preferences.
- Accountability partner details — if you invite someone to be your accountability partner, the name and mobile number you enter for them. We use that number only to send Accountability Partner texts, and only after your partner agrees to receive them (see “SMS / Text messaging” below). If you pick a partner from your contacts, Luuna reads your contacts on your device only to show you the list; we upload only the name and number of the partner you choose, and the rest of your address book never leaves your device.
Financial information (when you connect a bank account)
- Bank account metadata — institution name, account type, account mask (last 4 digits). Provided by Plaid.
- Transaction history — past transactions used to compute your average spending and detect activity in real time.
- Spending estimates — categories and dollar amounts you enter during onboarding.
We do not store your bank login credentials. Plaid handles that authentication.
Information collected automatically
- Device information — device model, OS version, app version, language and timezone settings. Collected via Apple’s standard APIs.
- Push notification token — Apple Push Notification service identifier, used to send shield alerts and important account messages.
- Usage analytics — events such as “paywall_viewed,” “trial_started,” “shield_toggled,” collected via PostHog. Anonymized at the device level until you log in.
- Crash reports — diagnostic information when the app crashes, collected via Sentry. Includes device state and a stack trace, never your financial data.
- Subscription state — your tier, trial status, expiration date, and product ID, managed via RevenueCat.
Information processed for AI features
- Page content for shopping detection — when you use the in-app shopping browser, page text snippets are sent to Anthropic’s API to detect “added to cart,” “checkout started,” and “order confirmed” events. Anthropic’s terms commit to not training models on your data. See Anthropic’s privacy policy.
Screen Time & app shielding
Luuna uses Apple’s Screen Time (Family Controls) framework to shield the shopping apps you choose, so it can show your budget before you buy. You pick which apps to shield, and you can turn shielding off at any time. Apple represents your app choices as private, unreadable tokens, and Luuna keeps them only on your device. They are never sent to Luuna’s servers or to anyone else.
How we use your information
We use your information to:
- Provide the Service (verify your account, sync bank data, run shield logic, manage subscriptions).
- Detect over-spending and trigger reflection prompts at the moment they matter.
- Improve the Service (analytics on which features work, which fail, where users get stuck).
- Communicate with you about your account, support requests, and material product updates.
- Comply with legal obligations and protect against fraud and abuse.
We do not sell your personal information.
How we share your information
We share information with the following categories of service providers, each under contractual obligations to protect it:
| Provider | Purpose | Data shared |
|---|---|---|
| Plaid | Bank account linking, transaction data | Bank credentials (encrypted in transit, never stored by us), transaction history |
| Twilio | Text message delivery: one-time verification codes and Accountability Partner texts | Phone number, message content |
| SendGrid | Email delivery | Email address, message content |
| RevenueCat | Subscription management | User ID, subscription state, IAP receipts |
| Apple | App distribution, in-app purchases, push notifications | Apple ID (for IAP), device push token |
| Anthropic | AI page analysis for shopping detection | Page text snippets (no PII) |
| PostHog | Product analytics | Event data, anonymized user ID |
| Sentry | Crash reporting and error tracking | Device state, stack traces, anonymized user ID |
| Railway / cloud hosting | Backend hosting | All data flowing through our backend |
We may also share information when required by law (subpoena, court order), to protect our rights or the rights of others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).
SMS / Text messaging
Verification codes (Luuna account holders)
When you create an account or sign in, we text a one-time verification code to the mobile number you provide. We send it only when you request it. Message and data rates may apply.
Accountability Partner texts
A Luuna user can invite a friend or family member to be their accountability partner. Partners opt in themselves: the user sends an invite from their own phone, and the partner opts in only by texting YES (or START) to (617) 356-0544 from their own phone. Luuna sends no text to a partner before that. See how Accountability Partner texts work.
- What we send: a confirmation when the partner joins; a text when the person they support nears or goes over their weekly shopping budget; a request to approve or decline a purchase, which the partner can answer by replying; and a text when the person they support turns off a store lock or Luuna’s Screen Time access for 10 minutes or more, or disconnects their bank connection (for partners who joined after these texts were added). These texts say only what was turned off (for example the store’s name), never amounts or purchase details.
- Message frequency varies. Message and data rates may apply.
- Opt out: reply STOP to any Luuna text to stop all Accountability Partner texts. Reply START to rejoin. Reply HELP for help, or email support@tryluuna.com.
- Carriers are not liable for delayed or undelivered messages.
We do not share mobile numbers
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Mobile numbers are used only to deliver the messages described above, through our text-message provider (Twilio).
Data retention
- Account data — kept while your account is active. Deleted within 30 days of account deletion request.
- Bank transaction data — kept while your bank account is connected. When you unlink a bank, Luuna disconnects it from Plaid and deletes its bank transactions and account details right away (or within 30 days if Plaid is temporarily unavailable). Purchase totals already counted in your budget (store, amount and date) are kept without any bank details, so your weekly spend and savings stay accurate.
- Analytics events — retained for up to 24 months for aggregate analysis.
- Crash reports — retained for up to 90 days.
To request account deletion, email support@tryluuna.com with the subject “Account Deletion Request.” You can also unlink bank accounts at any time in the app.
Your rights
Depending on where you live, you may have rights to:
- Access — request a copy of the data we hold about you.
- Correct — ask us to fix inaccurate data.
- Delete — ask us to delete your data.
- Portability — receive your data in a portable format.
- Object — object to certain processing activities.
To exercise these rights, email support@tryluuna.com. We will respond within 30 days.
California residents (CCPA / CPRA)
California residents have additional rights under the California Consumer Privacy Act. We do not sell or share personal information for cross-context behavioral advertising. To exercise CCPA rights, see Your rights above.
European residents (GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation. Our legal basis for processing is your consent (when you create an account) and contract performance (delivering the Service). To exercise GDPR rights, see Your rights above. You may also lodge a complaint with your local data protection authority.
Children’s privacy
The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at support@tryluuna.com and we will delete it.
Security
We use industry-standard technical and organizational measures to protect your information, including encryption in transit (HTTPS), encryption at rest, and access controls on our backend. No security measure is perfect, and we cannot guarantee the absolute security of your data.
International data transfers
We are headquartered in the United States. Your information may be transferred to and processed in the United States and other countries where our service providers operate. We rely on Standard Contractual Clauses or equivalent legal mechanisms where required.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by email. The “Last updated” date at the top reflects the most recent revision.
Contact
Questions or requests about this Privacy Policy? Contact us at support@tryluuna.com.
© 2026 Moon Invest Inc. All rights reserved.