Family baby data should stay boringly private.

Luna is a shared baby log for parents and invited caregivers, and optionally for an AI assistant they connect. This page explains what we store, why, who can see it, and how to get it out or delete it. Last updated 18 October 2026.

Who operates Luna

Luna is operated by Timmy Elenjical as an independent product ("we", "us", "Luna"), based in London, UK. Questions or requests about this policy: [email protected].

Who this is for

Luna is used by parents and guardians to track their own child's feeds, sleep and care. Luna does not create accounts for anyone under 18. A caregiver account belongs to an adult; the data entered under it describes a child who cannot consent for themselves, so we treat all of it as sensitive by default.

What we store

• Baby profile details you enter: first name, date of birth (or the expected due date, until the date of birth is added), optional gender, family name, timezone and region (UK, US or South Africa). If you set Luna up before the birth, the due date is pregnancy-related, so we treat it as sensitive, like the rest of the log.
• Tracker events you enter, or an assistant logs on your behalf: feeds, sleep, nappies, solids, common allergen records, growth measurements, supplements, routines and free-text notes.
• Caregiver account details needed for login and family sharing: email, username and a salted password hash. API tokens are stored as hashes; we never store token or password plaintext.
• Luna Plus subscription status, AI usage counts, and any notes the family asked Luna to remember.
• Optional consumable inventory (nappies, wipes, formula, vitamin D, milk) used to forecast restocking.
• If an assistant is connected: its webhook subscriptions and an audit trail of what it logged.
• Basic operational data: request and error logs, kept only as long as needed to run and secure the service.

We do not collect payment card details (Stripe handles Luna Plus checkout), precise location, photos or video, or any data directly from a child.

Our own analytics

We count a few simple things so we can tell whether Luna is actually helping families, for example whether a new family manages to log something in their first day, or whether a partner joins. We do this with our own small analytics on Luna's own servers. There's no Google Analytics, no advertising pixels and no third-party analytics scripts.

As you use the site, your browser may send a small event to /api/analytics, and a few events are recorded by our server directly. They're saved in our own database. We only accept these event names, and anything else is turned away: page_view, cta_click, account_created, partner_invite_created, partner_invite_copied, pwa_install_prompt_seen, pwa_installed, plus_interest, first_log, partner_joined and ask_paywall_seen.

Each event stores its name and the time. If you're signed in, it's also linked to your family and your caregiver account. It can carry a few short details from a fixed list: the page or button involved (its path, page, location, label, source and method, plus the web address a clicked link points to), the page that sent you (referrer), and campaign tags (ref, partner, referral, utm_source, utm_medium, utm_campaign, utm_content, utm_term, the landing page, and the most recent ref, utm_source, utm_medium and utm_campaign as last_ref, last_utm_source, last_utm_medium and last_utm_campaign). That list has no room for email addresses, passwords, your baby's details or anything you log, and we don't store your IP address with these events.

Don't count my visits

You can switch off our usage counting for this browser at any time, free and without an account. While it's off, Luna doesn't record your page views or in-app events, and doesn't save campaign or referrer details when you sign up. Your baby's log isn't affected. Luna also treats a Global Privacy Control or Do Not Track signal from your browser as this choice. If you're signed in, you can also switch it in Settings → Privacy ("Do not track my usage"). The choice is remembered with a small cookie, luna_no_analytics, on this browser only. It's the only other cookie Luna sets, and only if you use this switch.

How you found us

If you arrive through a link with campaign tags, such as ?ref=… or ?utm_source=…, your browser remembers them in its local storage under luna_acquisition, along with the first page you landed on (including its link tags), the site that sent you, and when. It keeps all the tags from the first tagged link that brought you, and from the most recent one it keeps just ref, utm_source, utm_medium and utm_campaign (saved as last_ref, last_utm_source, last_utm_medium and last_utm_campaign). When you create an account, these details are saved on your family's record and on the account_created event, so we can see which videos, posts or partners bring families to Luna. Even without tags, the sign-up form sends the page you signed up on, the site that sent you (if your browser shares it) and the time, and these are saved on your family's record too. We look at sign-up sources as totals, and any source with fewer than three sign-ups is grouped together as "other".

Cookies and browser storage

Luna itself sets one cookie, luna_session, which keeps you signed in. Scripts on the page can't read it. When you're signed in, it's also how the analytics events above are linked to your account. We don't set advertising cookies. Luna also keeps a few things in your browser's local storage: the campaign details described above, your Ask Luna chat history (see below), your setup checklist progress, whether you've dismissed the invite card, and whether you've tapped "Not yet" on the "Has your baby arrived?" question today. If you log something in the app while you're offline, that entry is kept in your browser's storage on that device until it syncs to your family's log, and anything still waiting to sync is cleared when you sign out.

Why we store it, and our legal basis

We process this data to provide the service the caregiver asked for: tracking, summaries and reminders about their own child's care. Where UK/EU data protection law applies, our basis is performance of a contract with the caregiver (providing the app) and, for AI summaries and proactive nudges, our legitimate interest in making the product useful, balanced against the sensitivity of children's data by keeping AI answers text-only, non-clinical, and under the caregiver's full export and deletion control.

Children's data: UK Children's Code and COPPA

Luna is designed to be used by parents and guardians about their own child, not by children themselves. We do not knowingly collect personal information directly from a child, and we do not offer accounts to anyone who tells us they are under 18. We design and operate Luna with the UK Age Appropriate Design Code in mind: minimum data, no marketing profiling of children's data, and no public-by-default sharing of a child's information. In the United States, COPPA governs direct collection from children under 13; Luna does not collect information directly from children of any age, and we apply COPPA-equivalent care voluntarily.

Who can see a family log

Only signed-in users in the same family, and any assistant a family member has connected with a token, can see that family's log. Anyone who joins through an invite link may see and add to the family's tracker data, so only share invite links with people you trust. Tokens can be scoped read-only and revoked at any time.

AI summaries and connected assistants

Luna Plus uses your family's logged tracker data to produce routine summaries and prompts. When an assistant such as Meta Muse or Claude is connected, that assistant reads and writes your family's log through Luna's connector under the token you created; what it does with the data on its side is governed by that assistant's own privacy terms. Neither Luna Plus nor the connector should be used for symptoms, diagnosis, medication, allergy assessment, emergencies or treatment decisions.

Local chat history

The Ask Luna widget can keep recent chat turns in your browser's local storage so the panel feels continuous. Someone using the same browser profile may be able to see recent chat history. Use the clear link in the Ask Luna panel to remove it from that device.

How long we keep data

We keep a family's data for as long as the account is active. We do not have an automatic silent-deletion schedule; if an account is inactive for an extended period we may reach out before any deletion. Data is deleted immediately and permanently when a family admin requests it (see Deletion, below).

Analytics events and how-you-found-us details are kept while the account exists too. When a family is deleted, the family record goes, and with it the how-you-found-us details saved on it. Past analytics events are kept, but the link to the family and its caregiver accounts is removed (see Deletion, below). Events from visitors who aren't signed in aren't linked to any account. We haven't set an automatic deletion period for analytics events yet; if we do, we'll say so here. You can ask us to delete your data at any time at [email protected].

Export

A family admin can export the full contents of the family's data at any time as a JSON file from Settings in the app (or GET /api/vega/export), or by emailing [email protected]. The export excludes password and token hashes.

Deletion

How to delete your account and data. In the app, open Settings (the ⚙ button), choose “Delete our family and all data”, then type your family name (or DELETE) and your password to confirm. Only the family admin can delete the family; other caregivers can choose “Leave this family” to remove their own login. You can also ask us to delete it for you: email [email protected] from the account’s registered address.

A family admin can permanently delete the family's account at any time via DELETE /api/vega/family (which requires typing the family's name to confirm), or by emailing [email protected] from the account's registered address. Deletion removes the family record, including the baby's profile and every logged event, weekly plans and pattern snapshots, saved recipes, notes Luna was asked to remember, how-you-found-us details, Luna Plus status, and connector settings such as webhook subscriptions and the audit history. It also removes every caregiver account in the family (the admin and any invited members, with their email addresses and password hashes), all API tokens and all invites. It cannot be undone.

In Luna's database, the only thing kept is past analytics events (see Our own analytics, above). Their link to the family and its caregiver accounts is cleared, so they no longer point to your family or anyone in it.

Who we share data with

We do not sell personal data and we do not share it for advertising. There are no ad trackers or third-party advertising cookies on Luna. We use a small number of service providers ("sub-processors") to run Luna:

• Cloudflare: sits in front of getmyluna.app as our content delivery network and security proxy. Every visit passes through Cloudflare on its way to our servers, so it handles technical details such as your IP address in order to deliver and protect the site. On pages that show an email address, Cloudflare also adds a small script of its own, served from getmyluna.app, that hides the address from spam bots.
• Railway: application hosting and the database the app runs on.
• Anthropic: powers Luna Plus summaries and the connector's ask_luna tool. Only the text of the question and the logged data needed to answer it is sent; we do not send images.
• Stripe: handles Luna Plus checkout. Stripe collects payment details directly; Luna sees only the subscription status.

Luna's own pages load their fonts, images and scripts from getmyluna.app itself. The one exception is the developer documentation at /docs and /redoc, which load their viewer code from jsDelivr, so jsDelivr sees your IP address and browser details when you open those two pages. We don't use it for analytics or advertising.

We may also disclose data if required by law, or to protect the safety of a child, a caregiver, or the service.

Security

Passwords and tokens are stored hashed, never in plaintext. Traffic is encrypted in transit (TLS). Each family's data is isolated behind a single tenant-scoped storage layer so one family cannot read another's; connector access is scoped (read/write) and rate-limited, writes made through the connector are logged to an audit trail, and tool outputs never include secrets.

International transfers

Our hosting, network and AI sub-processors may process data outside the country a family is based in, including the United States. Where this involves transferring personal data out of the UK or EEA, we rely on our providers' standard contractual safeguards. We do not currently offer a data-residency choice.

Your choices

Caregivers can export or delete their family's data at any time, use Luna without Luna Plus or any connected assistant, revoke any API token, and unsubscribe any webhook they registered.

Medical boundary

Luna is not a medical device and does not provide medical advice. For symptoms, medication, allergy or treatment decisions, contact a qualified clinician or local urgent-care route. See Safety.

Changes to this policy

We will update the date at the top of this page when this policy changes, and note material changes on the connector page changelog where they affect how the connector is used.

Contact

Questions, export or deletion requests: [email protected]. Luna is not affiliated with the NHS or any health service.