Privacy Policy

This policy explains how the Luna Lunera mobile app (the "App") and the website studioebro.com/lunalunera (the "Website") handle personal data, in line with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). The German version of this policy (Datenschutzerklärung) is the original; this is a translation.

1. Who is responsible for your data

The data controller is the private individual who develops and publishes Luna Lunera under the name "Studio Ebro":

Name

Álvaro Castañeda Condado

Postal address

Georg-Hermann-Allee 127, 14469 Potsdam, Germany

Email

lunalunera@studioebro.com

In this policy, "we", "us" and "our" refer to this person. We have not appointed a Data Protection Officer because the law does not require one for an activity of this kind; you can write to the email address above about anything related to your data.

2. Information that stays on your device

To work, the App saves the following information in its private storage on your phone or tablet:

• your saved sound mixes and the names you give them;
• the mix you are currently playing and the volume of each sound;
• your sleep timer duration and night lamp (Ambience) brightness;
• your language choice, and whether you have already seen the introduction screens;
• sounds or songs you record with the microphone, audio files you import, and the names you give them.

This information is stored only on your device. It is never uploaded to us or to anyone else: we do not run any server for the App and we have no way to see, access or recover it. Because we never receive this information, we do not process it as a controller; you keep full control over it. Storing it on your device is strictly necessary to provide the functions you use (Section 25(2) no. 2 TDDDG).

Device backups. Depending on your device settings, iOS or Android may include app data in a backup of your device (for example iCloud Backup or Google's Android backup). Those backups are created and stored by Apple or Google under your own account and their privacy terms. We have no access to them.

Deleting it. You can delete individual recordings, imported files and saved mixes inside the App. Uninstalling the App deletes everything it stored on the device.

3. App updates (Expo)

Each time the App starts with an internet connection, it checks whether a newer version of its content is available and downloads it if so. This service, called EAS Update, is provided by 650 Industries, Inc. ("Expo"), United States, which acts as our service provider (data processor, Article 28 GDPR).

To answer this request, the following technical data is necessarily sent to Expo's servers (u.expo.dev):

• your device's IP address (as with any internet connection);
• the platform and operating system (iOS or Android) and the App's version and update channel;
• a random installation identifier created by the update component. It is not linked to your name, email, advertising ID or any other account, and it changes if you reinstall the App;
• technical information about whether an update was downloaded and launched successfully, including the IDs of updates that failed and, once, the text of the last error that stopped the App from starting (up to 1,024 characters).

Purpose: to deliver updates and bug fixes, and to see aggregated statistics on whether updates install correctly (for example, how many installations are running a given version). This data is not used for advertising, profiling or tracking, and we do not receive it in a form that identifies you.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in keeping the App working, secure and up to date. Update checks are an essential technical part of the App and involve minimal data. Storing the installation identifier on your device is strictly necessary for this (Section 25(2) no. 2 TDDDG).

Retention: Expo keeps this data for the period described in its policies; the text of a launch error is only in raw request logs, which Expo deletes after three days. We do not keep any copy.

If you prefer: the App works fully offline. If the device has no internet connection, no update check takes place and the App keeps using the version already installed.

Expo's privacy policy: https://expo.dev/privacy.

4. Usage and performance data, crash reports (Expo Observe), only with your consent

On first launch, the App asks whether it may send performance data and crash reports. Only if you choose "Allow", or later turn on "Share performance data" under "Privacy" in Settings, does it send this data to the "Expo Observe" service of 650 Industries, Inc. ("Expo"), USA, which here too acts as our data processor (Article 28 GDPR). Without your consent, none of it is sent.

With your consent, the following data is sent over an encrypted connection (HTTPS):

• the same random installation ID as in section 3, and a session ID created at each launch;
• device model, operating system and its version, the device language, and the App's name, version and build, update channel and version, and the versions of the libraries it uses;
• load times: App start, when each screen appears and becomes usable, and how long update downloads take; plus, at start, the device's battery, temperature and network state and a summary of the App's network requests;
• the names of the App screens you open (for example "Sounds" or "Settings"), with their load times;
• usage events: which built-in sounds and songs you play (alone or in a mix), when a mix is created or the 5-sound limit is reached, when the sleep timer starts, ends or is cancelled, long listening sessions and loading errors. For your own recordings and imported files only "own file" is sent, never their name;
• error and crash reports: type and text of the error, technical trace (stack trace) and the reason for the crash;
• your device's IP address, from which Expo derives the country.

Your mixes, recordings, imported files or their names, your precise location, your advertising ID and any information about you or your baby are never sent.

Purpose: to detect and fix errors, crashes and slow screens, and to understand which sounds and features are used so we can improve the App. The data is not used for advertising, profiling or tracking, and it is not combined with data from other apps.

Legal basis: your consent (Article 6(1)(a) GDPR; for storing and reading information on your device, Section 25(1) TDDDG). Consent is voluntary: if you decline, you can use the App without any limitation.

Withdrawing consent: you can withdraw your consent at any time, with effect for the future, by turning off "Share performance data" in the App's Settings. The App then stops sending this data, and anything not yet sent is discarded. This does not affect the lawfulness of processing before you withdrew.

Retention: Expo keeps this data for 90 days and then deletes it in monthly batches, so within about 120 days at most. After that, Expo keeps only per-app totals for billing. We only see the data in aggregate in Expo's dashboard and keep no copy.

Expo's privacy policy: https://expo.dev/privacy.

5. When you contact us

If you write to lunalunera@studioebro.com, including through "Report a bug" in the App's Settings, we receive your email address, your message and anything you choose to include. "Report a bug" opens your own email app with a draft that already contains the App version, your device's operating system and version, and the App language, so we can reproduce the problem. You can edit or delete that information before sending.

• Purpose: to answer your question or fix the problem you report.
• Legal basis: Article 6(1)(b) GDPR where your enquiry concerns your use of the App; otherwise Article 6(1)(f) GDPR (our legitimate interest in answering enquiries and supporting users).
• Retention: we delete the conversation once it is resolved, and in any case no later than 12 months after our last exchange, unless we need to keep it longer to meet a legal obligation or to deal with a legal claim.
• Recipients: emails to our address are received by Cloudflare, Inc. (Email Routing, see section 7) and forwarded to our mailbox at Google (Gmail, provided in the EU by Google Ireland Limited, Dublin, Ireland), where they are stored. Google's privacy policy: policies.google.com/privacy.

6. App Store and Google Play

You download the App from Apple's App Store or Google Play. Apple and Google process data about your account, downloads and device under their own privacy policies, as independent controllers. They may give us anonymous, aggregated statistics (such as the number of downloads per country) and, if you have agreed to share them in your device settings, crash reports that do not identify you. We use these only to understand how the App performs and to fix bugs (legitimate interest, Article 6(1)(f) GDPR).

Apple's privacy policy: apple.com/legal/privacy · Google's privacy policy: policies.google.com/privacy.

7. This Website

The Website does not use cookies, analytics, advertising or tracking scripts, and it does not load fonts or other content from third parties. It is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages), which also routes emails sent to our address (Cloudflare Email Routing). When you open a page, Cloudflare necessarily processes your IP address, the date and time, the page requested and your browser type, to deliver the page and to protect the Website against attacks. Cloudflare acts as our data processor under its data processing addendum and keeps this data only for a short period. Legal basis: legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

8. What we don't do

• No account or sign-up, and we never ask for your name, email or phone number inside the App.
• No advertising SDKs and no tracking across other apps or websites; performance measurement only with your consent (section 4).
• No access to your advertising identifier, location, contacts, camera or photo library.
• No sale or rental of data, no profiling and no automated decision-making (Article 22 GDPR).

9. Device permissions

10. Transfers outside the EU

Expo and Cloudflare are based in the United States, and Google may also process data there, so some of the data described above may be processed outside the European Economic Area. These transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR) where the provider is certified under it, and otherwise on the Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). You can ask us for more information about these safeguards using the contact details above.

11. Security

The App keeps your information in its private storage area, which other apps cannot read under the normal security model of iOS and Android. Requests to Expo and connections to the Website are encrypted in transit (HTTPS). Since we hold almost no data about you, there is very little that could be exposed on our side. Protecting your device with a passcode helps keep your recordings and settings private.

12. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict processing (Article 18);
• receive data you gave us in a portable format (Article 20);
• withdraw any consent you have given, without affecting earlier processing (Article 7(3)).

To exercise these rights, email lunalunera@studioebro.com. We will reply within one month. We may ask for additional information if we need to confirm your identity. In practice, we only hold the emails you send us. Data stored inside the App is already under your control (see section 2), and for the update and performance data processed by Expo we will help you as far as we are able to. The easiest way to withdraw your consent under section 4 is directly in the App's Settings.

Right to lodge a complaint (Article 77 GDPR): if you believe we have not handled your data correctly, you can complain to any data protection supervisory authority, in particular the one in the EU country where you live or work. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de. We would appreciate the chance to resolve it with you first.

13. Children

Luna Lunera is made for parents and caregivers. It is not directed at children, and children are not expected to use it themselves. Apart from the technical data in sections 3 and 4, the App does not collect personal data from anyone, including children. Recordings you make, which may include your baby's sounds, stay on your device. If you believe a child under 16 has sent us personal data by email, please contact us and we will delete it.

14. Changes to this policy

If the way the App or Website handles data changes, we will update this policy before the change takes effect and change the "Last updated" date above. If the change is significant, for example if the App starts sending any new kind of data, we will also announce it in the App or on this Website.

15. Contact

For questions about this policy or your data: lunalunera@studioebro.com, or by post to Álvaro Castañeda Condado, Georg-Hermann-Allee 127, 14469 Potsdam, Germany.