Privacy Policy — Luna Lunera

The short version

No account, no ads, no analytics, no tracking. We don't sell or share your data.
Your mixes, settings, recordings and imported audio stay on your device. We never receive them.
The only thing the app sends over the internet is a check for app updates, handled by our update provider Expo.
If you email us, we use your message only to answer you.

This policy explains how the Luna Lunera mobile app (the "App") and the website studiocampoo.com/lunalunera (the "Website") handle personal data, in line with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). The German version of this policy (Datenschutzerklärung) is the original; this is a translation.

1. Who is responsible for your data

The data controller is the private individual who develops and publishes Luna Lunera under the name "Studio Campoo":

Name: Álvaro Castañeda Condado
Postal address: Georg-Hermann-Allee 127, 14469 Potsdam, Germany
Email: lunalunera@studiocampoo.com

In this policy, "we", "us" and "our" refer to this person. We have not appointed a Data Protection Officer because the law does not require one for an activity of this kind; you can write to the email address above about anything related to your data.

2. Information that stays on your device

To work, the App saves the following information in its private storage on your phone or tablet:

your saved sound mixes and the names you give them;
the mix you are currently playing and the volume of each sound;
your sleep timer duration and night lamp (Ambience) brightness;
your language choice, and whether you have already seen the introduction screens;
sounds or songs you record with the microphone, audio files you import, and the names you give them.

This information is stored only on your device. It is never uploaded to us or to anyone else: we do not run any server for the App and we have no way to see, access or recover it. Because we never receive this information, we do not process it as a controller; you keep full control over it. Storing it on your device is strictly necessary to provide the functions you use (Section 25(2) no. 2 TDDDG).

Device backups. Depending on your device settings, iOS or Android may include app data in a backup of your device (for example iCloud Backup or Google's Android backup). Those backups are created and stored by Apple or Google under your own account and their privacy terms. We have no access to them.

Deleting it. You can delete individual recordings, imported files and saved mixes inside the App. Uninstalling the App deletes everything it stored on the device.

3. App updates (Expo)

Each time the App starts with an internet connection, it checks whether a newer version of its content is available and downloads it if so. This service, called EAS Update, is provided by 650 Industries, Inc. ("Expo"), United States, which acts as our service provider (data processor, Article 28 GDPR).

To answer this request, the following technical data is necessarily sent to Expo's servers (u.expo.dev):

your device's IP address (as with any internet connection);
the platform and operating system (iOS or Android) and the App's version and update channel;
a random installation identifier created by the update component. It is not linked to your name, email, advertising ID or any other account, and it changes if you reinstall the App;
technical information about whether an update was downloaded and launched successfully.

Purpose: to deliver updates and bug fixes, and to see aggregated statistics on whether updates install correctly (for example, how many installations are running a given version). This data is not used for advertising, profiling or tracking, and we do not receive it in a form that identifies you.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in keeping the App working, secure and up to date. Update checks are an essential technical part of the App and involve minimal data. Storing the installation identifier on your device is strictly necessary for this (Section 25(2) no. 2 TDDDG).

Retention: Expo keeps this data for the period described in its policies. We do not keep any copy.

If you prefer: the App works fully offline. If the device has no internet connection, no update check takes place and the App keeps using the version already installed.

Expo's privacy policy: https://expo.dev/privacy.

4. When you contact us

If you write to lunalunera@studiocampoo.com, including through "Report a bug" in the App's Settings, we receive your email address, your message and anything you choose to include. "Report a bug" opens your own email app with a draft that already contains the App version, your device's operating system and version, and the App language, so we can reproduce the problem. You can edit or delete that information before sending.

Purpose: to answer your question or fix the problem you report.
Legal basis: Article 6(1)(b) GDPR where your enquiry concerns your use of the App; otherwise Article 6(1)(f) GDPR (our legitimate interest in answering enquiries and supporting users).
Retention: we delete the conversation once it is resolved, and in any case no later than 12 months after our last exchange, unless we need to keep it longer to meet a legal obligation or to deal with a legal claim.
Recipients: emails to our address are received by Cloudflare, Inc. (Email Routing, see section 6) and forwarded to our mailbox at Google (Gmail, provided in the EU by Google Ireland Limited, Dublin, Ireland), where they are stored. Google's privacy policy: policies.google.com/privacy.

5. App Store and Google Play

You download the App from Apple's App Store or Google Play. Apple and Google process data about your account, downloads and device under their own privacy policies, as independent controllers. They may give us anonymous, aggregated statistics (such as the number of downloads per country) and, if you have agreed to share them in your device settings, crash reports that do not identify you. We use these only to understand how the App performs and to fix bugs (legitimate interest, Article 6(1)(f) GDPR).

Apple's privacy policy: apple.com/legal/privacy · Google's privacy policy: policies.google.com/privacy.

6. This Website

The Website does not use cookies, analytics, advertising or tracking scripts, and it does not load fonts or other content from third parties. It is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages), which also routes emails sent to our address (Cloudflare Email Routing). When you open a page, Cloudflare necessarily processes your IP address, the date and time, the page requested and your browser type, to deliver the page and to protect the Website against attacks. Cloudflare acts as our data processor under its data processing addendum and keeps this data only for a short period. Legal basis: legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

7. What we don't do

No account or sign-up, and we never ask for your name, email or phone number inside the App.
No analytics or advertising SDKs, and no tracking across other apps or websites.
No access to your advertising identifier, location, contacts, camera or photo library.
No sale or rental of data, no profiling and no automated decision-making (Article 22 GDPR).

8. Device permissions

Permission	Why the App uses it
Microphone	Only when you tap record, to capture your own sound or song (for example your voice singing a lullaby), up to 2 minutes. The recording is saved only on your device and is never uploaded. You can refuse or withdraw this permission at any time in your device settings; everything else keeps working.
Background audio (iOS) / foreground service for media playback (Android)	To keep your sounds playing while the screen is locked or you use another app, and to show playback controls on the lock screen or in a notification.
Audio settings (Android)	To manage audio playback and output on your device.
Internet	Only to check for and download App updates (section 3), and to open links you tap, such as the store page or your email app.
Files	No storage permission is requested. When you import audio, the system file picker opens and the App receives only the file you choose, which it copies into its private storage.
Screen brightness	No permission is requested. While the Ambience night lamp screen is open, the App adjusts the brightness of its own window and keeps the screen on; it restores the previous brightness when you leave that screen.

9. Transfers outside the EU

Expo and Cloudflare are based in the United States, and Google may also process data there, so some of the data described above may be processed outside the European Economic Area. These transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR) where the provider is certified under it, and otherwise on the Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). You can ask us for more information about these safeguards using the contact details above.

10. Security

The App keeps your information in its private storage area, which other apps cannot read under the normal security model of iOS and Android. Update requests to Expo and connections to the Website are encrypted in transit (HTTPS). Since we hold almost no data about you, there is very little that could be exposed on our side. Protecting your device with a passcode helps keep your recordings and settings private.

11. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Article 15);
have inaccurate data corrected (Article 16);
have your data erased (Article 17);
restrict processing (Article 18);
receive data you gave us in a portable format (Article 20);
withdraw any consent you have given, without affecting earlier processing (Article 7(3)).

Right to object (Article 21 GDPR): where we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To exercise these rights, email lunalunera@studiocampoo.com. We will reply within one month. We may ask for additional information if we need to confirm your identity. In practice, we only hold the emails you send us. Data stored inside the App is already under your control (see section 2), and for the update data processed by Expo we will help you as far as we are able to.

Right to lodge a complaint (Article 77 GDPR): if you believe we have not handled your data correctly, you can complain to any data protection supervisory authority, in particular the one in the EU country where you live or work. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de. We would appreciate the chance to resolve it with you first.

12. Children

Luna Lunera is made for parents and caregivers. It is not directed at children, and children are not expected to use it themselves. The App does not collect personal data from anyone, including children. Recordings you make, which may include your baby's sounds, stay on your device. If you believe a child under 16 has sent us personal data by email, please contact us and we will delete it.

13. Changes to this policy

If the way the App or Website handles data changes, we will update this policy before the change takes effect and change the "Last updated" date above. If the change is significant, for example if the App starts sending any new kind of data, we will also announce it in the App or on this Website.

14. Contact

For questions about this policy or your data: lunalunera@studiocampoo.com, or by post to Álvaro Castañeda Condado, Georg-Hermann-Allee 127, 14469 Potsdam, Germany.