Privacy Policy

How the Lunara service processes and uses information.

Lunara Inc. (the "Operator"), which operates Lunara (the "Service"), explains below the information processed by the Service and how it is used.

1. Information we process

Some features are available without an account. Login, synchronization, community features, and AI conversation history use an account and server storage.

The device's current location is used only when you press the map's 'My location' button, or when you select 'Continue' in the visit-verification notice and grant location permission. During visit verification, the current location coordinates and accuracy are sent to a Cloudflare Worker over HTTPS and used transiently only to judge the distance to the destination and the accuracy; the coordinates themselves are not stored in the Worker, the Supabase database or app storage. Places, addresses and coordinates you enter in an itinerary may, however, be sent to external services to provide weather, search and route features.

Photos and videos are uploaded only when you select them yourself. Images are re-encoded before upload, and upload stops if this fails. The server implements image and video moderation and removal of MP4 location metadata. Locations displayed within the video itself are outside this removal scope (code checked 2026-09-14). These paths are deployed on the production server, together with the private-media reference setting (deployment checked 2026-09-22).

2. Purposes of processing

1. Creating accounts, login, maintaining sessions, and checking age and consent status
2. Providing travel planning, packing lists, search, weather, transportation and AI recommendations
3. Providing community features including profiles, posts, comments, meetups, DMs, saves and follows
4. Receiving reports, preventing abuse, reviewing content and protecting users
5. Managing usage limits and service stability, and diagnosing errors
6. Product usage analytics only with the user's separate permission
7. Connecting external booking and map links, and measuring clicks, affiliate results and conversions for booking links that use the tracking redirector
8. Verifying purchase and subscription status, granting and restoring entitlements, reflecting refunds and cancellations, and handling payment inquiries

3. Public information and access

• Usernames, display names, profile images, bios, public posts, comments, photos, videos, likes, follows and meetup participation may be visible to other users.
• Access policies restrict DM text and read status to participants in that conversation.
• Travel preferences, birth year, consent status, AI conversations and personalization information are restricted to the user and servers with the permissions required to provide the Service.
• Reports are restricted to the reporter and authorized operations personnel. After account deletion, they may be retained for safety measures and dispute handling with the reporter's identifier removed.

4. Retention and use periods

Where retention is otherwise required by law, a security-incident investigation, or dispute handling, information may be retained separately to the extent and for the period necessary for that purpose.

5. External services and overseas processing

The providers below process information while providing the Service, and personal information is transferred overseas to foreign providers among them. Under Article 28-8 of Korea's Personal Information Protection Act, we disclose the transferred information, countries, timing and methods, recipients' purposes and retention periods, and recipient contact details below. The values in the table were recorded after checking the actual account settings and contracts as of 2026-09-22.

5-1. Overseas transfers

Where a provider's privacy-policy link appears in the contact column, contact methods can be found in that document. Information passed to booking partners is passed only when the user selects a booking link; if no link is selected, nothing is passed.

5-2. Domestic processing

The following are domestic providers; personal information is not transferred overseas to them.

You may decline the relevant overseas transfer by not using optional features such as AI, place search, flights and weather, while continuing to use other features such as manually creating itineraries. Where external processing is inherent to a feature, such as login, server synchronization or community, declining that processing means we cannot provide that feature. Overseas-transfer refusal inquiries: support@travellunara.com

5-3. Payment-related disclosure (English translation)

The Korean disclosure above is the legally operative version. This English translation is provided for convenience. If the two versions differ, the Korean disclosure controls to the extent permitted by applicable law.

• Lunara processes the store, product ID, transaction and original transaction IDs, event type and ID, purchase and subscription status, purchase, expiration and refund timestamps, entitlement tier, one-time entitlement grant, use and revocation records, and the user ID that links a transaction to the account. The user ID is stored in the payment ledger and, for App Store purchases, is also placed in the purchase request sent to the store. These items are processed by the App Store and Google Play, Cloudflare Workers, and Supabase. Raw notification data received from the stores is stored with the payment ledger through the Worker and is deleted within seven days once the minimum fields needed to confirm payment status have been copied. Lunara does not directly collect or store card numbers or other store payment-method information.
• Apple Inc. and Google LLC receive the store transaction and original transaction identifiers, the product ID, and purchase and subscription status in the United States through HTTPS when a purchase, restore, or subscription-status check occurs; Apple additionally receives the user ID that Lunara places in the purchase request. They use the data to verify the store receipt and the purchase and subscription status. The stores do not publish a retention period for the purchase records they hold; Lunara's own copies follow Section 4 — raw notification data for seven days, and statutory contract, payment, refund and service-supply records for five years. Their retention periods and contact details are stated in the overseas-transfer table above.
• Deleting a Lunara account does not cancel a subscription purchased on the App Store or Google Play. The store holds the subscription contract and the payment method, so the subscription fee continues to be charged unless it is cancelled separately in the store account settings. Please cancel the subscription in the store before deleting the account.
• Lunara retains contract, withdrawal, payment, refund, and service-supply records for five years under Article 6 of the Enforcement Decree of Korea's Act on the Consumer Protection in Electronic Commerce. Before activating paid services, Lunara will configure and verify that these statutory records are separated from account data, remain after account deletion for the statutory period, and are then destroyed.

5-4. 決済関連の通知（日本語訳）

法的効力を有する開示は上記の韓国語版です。この日本語訳は便宜のために提供します。両者に相違がある場合、適用法令で認められる範囲で韓国語版が優先されます。

• Lunaraは、ストア、商品ID、取引ID・原取引ID、イベントID・種類、購入・購読状態、購入・満了・返金時刻、利用権限の等級、単品利用権の付与・使用・回収記録、および取引をアカウントに結び付ける利用者IDを処理します。利用者IDは決済台帳に保存し、App Storeでの購入時は購入リクエストに含めてストアにも送信します。これらの項目はApp Store・Google Play、Cloudflare Workers、Supabaseで処理します。ストアから受領した受信データの原本はWorkerを経て決済台帳とともに保存され、決済状態の確認に必要な最小項目へ移した後、7日以内に削除します。カード番号その他のストア決済手段情報をLunaraが直接収集・保存することはありません。
• Apple Inc.およびGoogle LLCは、購入・復元・購読状態の確認時に、ストアの取引識別子・原取引識別子、商品IDおよび購入・購読状態をHTTPSで米国に移転して受領します。Appleは加えて、Lunaraが購入リクエストに含める利用者IDを受領します。ストアの領収情報と購入・購読状態の確認に利用します。ストアが保有する購入記録の保有期間は、公開ポリシーに明示されていません。Lunara側の控えの保有基準は4項と同じで、受信データの原本は7日、契約・決済・返金・サービス提供の法定記録は5年です。保有期間および連絡先は、上記の国外移転の表に記載しています。
• Lunaraのアカウントを削除しても、App Store・Google Playで申し込んだ購読は自動的に解約されません。購読契約の当事者と決済手段はストアが管理するため、ストアのアカウント設定で別途解約しないかぎり購読料が請求され続けます。アカウントを削除する前に、ストアで購読を解約してください。
• Lunaraは、韓国「電子商取引等における消費者保護に関する法律施行令」第6条により、契約・申込みの撤回・決済・返金・サービス提供の記録を5年間保有します。有料サービスを有効化する前に、法定記録をアカウントデータから分離し、アカウント削除後も法定期間中は保有した後に破棄する構成を実装・検証します。

6. Optional analytics and automatic collection

• We have not implemented advertising-identifier-based ad tracking or data sharing for sale.
• The PostHog product analytics SDK is included in the code but is not currently initialized on app startup. Even with an API key, the SDK is blocked from running or sending events without the user's explicit opt-in.
• Optional analytics will be enabled in the future only after disclosing the events collected, purposes and retention periods, and implementing separate consent and withdrawal features.
• Booking-link and affiliate measurement is separate from PostHog product usage analytics. Link registration and click and conversion measurement occur when the user selects a booking link using the tracking redirector; affiliate parameters may be added to some links. Ordinary map links do not pass through that redirector.
• Sentry error diagnostics may activate at app startup in builds with a DSN configured. This is separate from optional analytics and processes the error-diagnostic information in Section 1.
• There are two kinds of app notifications. Packing-list and departure reminders are local notifications scheduled on the device. New DM alerts are remote push notifications; for these, a signed-in user's device push token is linked to the account and stored on the Operator's server. Delivery to that token stops when the user logs out or switches accounts.
• Remote push notifications do not contain message content. The lock screen shows only a generic phrase such as “You have a new message” and the number of unread conversations; the content can be read after opening the app and signing in.
• Notifications can be turned off per conversation, and the server does not create push notifications for a muted conversation (the conversation and its unread indicator remain in the app).

7. Destruction procedures and account deletion

You may request account deletion in the app's settings. After server deletion succeeds, account-associated state on the device is also reset.

• Deleting a Supabase account is designed to cascade-delete its associated profiles, preferences, posts, comments, reactions, meetups, DMs, AI records and usage ledger.
• Report records may remain with the reporter's identifier removed.
• Deleting a Lunara account does not cancel a subscription purchased on the App Store or Google Play. The store holds the subscription contract and the payment method, so the subscription fee continues to be charged unless it is cancelled separately in the store account settings. Please cancel the subscription in the store before deleting the account.
• Public R2 media deletion uses a deletion queue separate from database deletion. Code deletes R2 objects, purges caches, marks completion and retries failures, and a five-minute scheduled job is registered (code checked 2026-09-14). That migration, Worker, retry job and cache purge setting are deployed on the production server (deployment checked 2026-09-22).
• Operational backups and external processors' copies may be deleted later under each service's deletion and backup policies.

8. Your rights and inquiries

You may request access to, correction or deletion of your information, suspension of processing, or withdrawal of consent. Each right may be exercised as follows.

• Contact: support@travellunara.com (Privacy Officer: Section 11)
• Requests may be made by you, your legal representative, or an authorized agent. A representative or agent making a request must provide documentation confirming their authority.
• Account ownership verification may be required to protect the requester's rights.
• Upon receipt of a request, we will take the necessary action within 10 days and notify you of the outcome. If applicable law requires us to defer or refuse action, we will also explain the reasons and how to raise an objection.

The relationship between AI personalization and suspension of processing is as follows.

• Aurora personalization (AI features) is how the Service provides tailored itineraries and recommendations by default, and consent for it is obtained at sign-up separately from consent for cross-border transfer. You can turn personalization off at any time on the Aurora personalization screen in app settings, and while it is off Aurora gives only general recommendations without your preferences. Turning it off is implemented to update the device setting only after the server processing-stop request succeeds. The server implements disabling personalization and deleting AI source events, feedback, learned preferences, relevant history and memory. To delete all existing conversation history, use account deletion or contact support@travellunara.com (code checked 2026-09-14). The off and on-again round trip was verified on a real device on 2026-09-22.
• Even after processing is suspended, other information you have entered directly, such as trips and posts, continues to be processed. To delete all server information associated with your account, use the account deletion feature in the app settings.
• Requests not resolved in the app and inquiries about report handling: support@travellunara.com

9. Security measures

• We use HTTPS (TLS) for network communications.
• Supabase Row Level Security and server authentication restrict access to non-public information.
• Authentication sessions and sensitive on-device items preferentially use supported device secure storage. (Authentication-session secure-storage wiring and separate sensitive-field storage and retry implementation: src/lib/supabaseClient.ts, src/store/index.ts; code checked 2026-09-14)
• Filters reduce known identifiers in error logs and AI inputs, but cannot guarantee removal of personal information from every free-text input. Users should not include unnecessary personal information in AI questions, posts or DMs.

10. Children's personal information

The Service checks birth years to prevent users under 14 from creating accounts. The minimum registration age in the code is 15. Because only the birth year, rather than the full date of birth, is checked, users near the age threshold may be restricted conservatively. The store content rating does not conflict with this statement or with the sign-up consent wording (checked 2026-09-22).

11. Privacy officer

Privacy violation reports and advice: Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without an area code), Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)

12. Changes to this policy

Changes and their effective date will be announced in the app or on the official website at least 7 days before they take effect. Changes that materially affect or disadvantage users' rights will be announced at least 30 days in advance, with individual notice by email or similar means where necessary.

Supplementary provisions

• Notice date: 2026-09-23
• Effective date: 2026-09-23