Privacy Policy
Last updated: March 2026
Effective and last updated: 17 October 2026.
This notice explains how Luna's Circle handles personal information on lunascircle.com and in connected service features. Contact [email protected] for privacy questions or requests.
1. Information we handle
- Account and security data: email address, optional display name, password hash, sessions, verification and reset status, and security events. Current public signup and newsletter forms do not ask for a birth date or zodiac sign. If an older account still contains a legacy preference, it can be reviewed or removed from Account settings.
- Content you choose to provide: prompts, questions, randomized card results, generated responses, journal entries, saved notes, feedback, and support messages, depending on the feature.
- Purchase records: product, order, subscription, fulfillment, refund, and Stripe customer, checkout, or payment references. Stripe processes payment-card details; Luna's Circle does not receive or store the full card number.
- Newsletter records: email address, optional name, coarse signup source, confirmation time, and unsubscribe status. A request remains pending until its confirmation link is used; it receives no marketing newsletter while pending.
- Device and operational data: IP address, user-agent and request information, cookie or browser-storage choices, rate-limit signals, and diagnostic or security logs.
- Optional analytics: page and interaction measurements load only after an explicit Accept All choice and remain disabled for Essential Only or an enabled Global Privacy Control signal.
2. Why we use it and our legal bases
Where data-protection law requires a legal basis, we use:
- Contract: to create and secure an account, provide a requested feature, process and fulfill a purchase, manage a subscription, and respond about an order.
- Consent: for optional analytics and confirmed marketing email. You can change cookie choices in the footer and unsubscribe from any newsletter. Withdrawing consent does not change the lawfulness of earlier processing.
- Legitimate interests: to prevent abuse and fraud, diagnose failures, secure the service, maintain reliability, and understand aggregate operations, when those interests are not overridden by your rights.
- Legal obligation: to keep records or respond to valid requests when the law requires it.
We do not use service content to make solely automated decisions that produce legal or similarly significant effects about you.
3. AI processing
When you ask for an AI-assisted feature, such as a reading on this site or in the Luna's Circle app, your question, the cards drawn and the context needed for that request are sent to an AI-model provider that writes the response. We send it to Anthropic (Claude) first. If that is unavailable, the request can go to one of these backup providers instead: Google (Gemini), Groq, OpenRouter (which passes it to the host of the selected model), OpenAI or DeepSeek. Some requests are answered by a model on servers we run, in which case no AI provider receives them. We do not send your name, email address or payment details with the request.
Each provider handles requests under its own terms. Some may keep or review requests, and some process data outside your country; DeepSeek, for example, processes data in China. Do not include anything sensitive, or anything about other people, that your question does not need. AI output can be wrong.
If you are signed in, the question and response can be saved to your account history. If you are not signed in, the question and response are still kept on our servers, with no account attached, to run the free allowance, check quality and prevent abuse. In the app, nothing is sent until you agree on the reading screen.
The Luna's Circle app
The app for iPhone and Android, and the web version at lunascircle.com/app, talks only to lunascircle.com. It contains no advertising or analytics software and does not track you across other apps or websites. Your journal entries, readings you have drawn, cached reference pages and your agreement to AI processing are kept only on your device. We never receive app journal entries, so we cannot recover them. If you sign in, a session token is kept in your phone's secure storage (iOS Keychain or Android Keystore), or on the web only in memory until you close the page. My Circle → Clear data on this device removes everything the app stored. You can delete your account in the app (My Circle → Delete account), on your Account page, or as described at lunascircle.com/delete-account.
4. Providers and disclosures
We disclose limited information to providers that operate the service on our behalf or when legally required. Provider categories currently include hosting and storage; AI-model providers (Anthropic, and as backups Google, Groq, OpenRouter, OpenAI and DeepSeek; see section 3); Stripe for payment and billing; Brevo or configured email delivery services; and Google Analytics and Brevo measurement only after analytics consent. If you choose to interact with a connected Telegram feature, Telegram also processes that interaction under its own terms.
We do not sell personal information for money. Some privacy laws define targeted advertising or certain analytics disclosures as a “sale” or “sharing.” Optional analytics is disabled without Accept All, and an enabled Global Privacy Control signal is honored as Essential Only. You can reopen Cookie settings in the footer at any time.
TikTok advertising measurement
With your advertising consent through Accept All, selected public pages and neutral conversion confirmation pages load TikTok Pixel (ID DAJ1HOBC77UC8FLK3VKG). TikTok receives technical browser and network information, cookies, page visits and completed registration, checkout-start and verified purchase events, including purchase amount and currency. This helps measure and improve advertising and may be used by TikTok for ad personalization under its own privacy policy. We do not enable automatic advanced matching or enhanced page-content postback, and do not send email addresses, phone numbers, private readings, journals or chat through this integration. TikTok Pixel is excluded from private tool and account pages.
Choosing Essential Only disables this integration. Prior analytics permission alone does not enable it. Global Privacy Control overrides advertising consent. You can withdraw through Cookie settings in the footer; withdrawal prevents future measurement and does not recall data already received by TikTok. TikTok may process data outside your country. See TikTok's Privacy Policy.
5. Retention
| Data | Retention approach |
|---|---|
| Account, sessions, and account content | Kept while needed to provide the account or until you delete the content or account, subject to limited security, dispute, and legal exceptions. Expired sessions and reset records are removed through lifecycle controls. |
| Pending newsletter request | No marketing is sent. An unconfirmed request becomes eligible for deletion after 7 days and is removed during routine newsletter lifecycle cleanup. |
| Confirmed newsletter and suppression status | Kept until unsubscribe; a limited suppression record may remain as needed to honor the opt-out. |
| Purchase and payment references | Kept as needed for fulfillment, accounting, tax, fraud prevention, disputes, and legal obligations. Stripe keeps its own records under its policy. |
| Operational and security logs | Kept only as long as reasonably needed for security, debugging, reliability, and legal requirements; the period depends on the event and risk. |
| Optional analytics | Controlled by the configured provider settings and your consent. Choosing Essential Only stops future optional collection on this site; provider-held records follow provider controls. |
| Reading questions and responses from visitors who are not signed in | Kept with no account attached, for the free allowance, quality checks and abuse prevention. The question and response text is deleted after 90 days; the date, card type and usage count are kept for reporting. |
| Database backups | Made for disaster recovery and not edited afterwards, so data from a deleted account can remain in a backup until that backup is removed. |
| De-identified or aggregate information | May be retained when it no longer reasonably identifies a person. |
6. Your choices and rights
Depending on where you live, you may have rights to know or access personal information; correct it; delete it; receive a portable copy; restrict or object to processing; withdraw consent; and opt out of certain sale, sharing, targeted advertising, or profiling. We do not discriminate against you for using a privacy right.
Account controls provide access to saved data and account deletion where available. You can also email [email protected]. Describe the request and the account email, but never send a password or full payment-card number. We may need to verify the request and may retain information when an exception applies. You may complain to the data-protection or consumer-privacy regulator where you live.
7. International processing
Luna's Circle and its providers may process information in the United States and other countries. Where applicable law requires a transfer safeguard, we rely on the provider's recognized contractual or legal transfer mechanism.
8. Security
Safeguards include HTTPS, Secure and HttpOnly session cookies on HTTPS, same-origin and anti-forgery controls for authenticated changes, rate limiting, access controls, and versioned PBKDF2-SHA256 password hashing. No online service can promise absolute security. Contact [email protected] if you suspect account misuse.
9. Children
The service is not directed to children, and purchases require age 18 or older. If you believe a child provided personal information, contact the privacy address so the report can be reviewed and appropriate deletion steps taken.
10. Changes and contact
Material changes will be posted here with an updated date, and additional notice or consent will be provided when required. Privacy questions and rights requests: [email protected]. General support: [email protected].