Privacy Policy

This page explains what data LunaFY collects, why we collect it, who we share it with, and how you can delete it. It applies to the LunaFY mobile app and the lunafy.app website. Health data is a special category of personal data, so we keep the list below as explicit as we can. This page is also the information notice required by Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK).

1. Data we collect

Account details: your email address, your name, how you sign in (email, Apple or Google), an irreversible hash of your password if you signed up with email, and the date you created your account. Your profile photo, if you add one.

Profile: your date of birth, sex, height, country, time zone, activity level, diet goal and pace, target weight, eating style, meal times and whether you mostly eat out.

Health information: health conditions you enter yourself, your allergens and foods you dislike.

Body measurements: your weight and chest, waist, hip, arm and leg circumference, and how they change over time.

Nutrition records: the meals you log, your meal descriptions, estimated calories and macros, your water intake and the diet plans created for you.

Meal photos: meal photos you take or choose from your gallery for analysis are stored with your meal log. The photo you take for an allergen scan is used only for that scan and is not stored.

Weekly check-in: your weigh-in result, what you struggled with, what you are craving and — only if you tick it — whether it was your period week.

Subscription and invites: your subscription status, your invite code, who invited you or whom you invited, and the gift days you earned. Your payment details never reach us; Apple handles payment.

Consent records: when you gave your health data consent and your AI permission (and when you withdrew AI permission), the version and language of the text you agreed to, and the platform (iOS/Android). We keep these records as proof of your consent.

Usage records: your sign-in times, your daily AI usage counters and the moment you first completed certain steps (first launch, sign-up, profile setup, first AI use, seeing the subscription screen, subscribing). We use these only to understand, in aggregate, how the product is used.

Notifications: if you allow notifications, your device’s push token and your notification preferences.

On Android only, and only if you allow it: your daily step count and active calories from Google Health Connect.

2. Data we do not collect

There is NO Apple Health (HealthKit) integration on iPhone; on iOS, LunaFY reads nothing from your Health app.

We do not collect your location, contacts or browsing history. We do not use your advertising identifier (IDFA) and we do not track you across other companies’ apps and websites.

The app contains no ads and no ad network SDKs. We do not use your data for advertising and we do not sell it.

The app does not ask for or collect blood test results.

3. Health data and your explicit consent

Your health conditions, allergens, body measurements, meal photos and period week information are “special category data” under GDPR and “sensitive personal data” under Turkish KVKK.

We process this data only to create your diet plan, warn you about your allergens and show your progress. The legal basis is your explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6). Your consent is NOT tied to creating an account or accepting this policy: after you sign up, before you enter any health data, it is asked on a separate screen with an unticked checkbox. That screen shows which data is processed, for what purpose and where (on servers outside Turkey). If you do not consent, your health data is not processed; however, you cannot use the app, because the diet plan and calorie target depend on this data.

You can withdraw your health data consent at any time: Profile → System Settings → Health data consent. Because we cannot provide the service without health data, withdrawing it results in the deletion of your account and all your data (see section 7). Withdrawal does not affect processing carried out on the basis of your consent before it.

Legal bases for your other personal data: your account and contact details, profile and subscription records — performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)); subscription and payment records additionally — legal obligations (Art. 6(1)(c), KVKK Art. 5(2)(ç)); abuse prevention (device hash, daily usage counters), security logs and aggregate usage statistics — legitimate interests (Art. 6(1)(f), KVKK Art. 5(2)(f)). Your data is collected electronically through the mobile app and the website, partly by automated means.

Sending your data to Google for AI analysis is a SEPARATE permission. The first time you use an AI feature, a consent screen shows which data goes where. If you do not agree, none of your data is sent to Google; the AI features will not work, and everything else keeps working.

You can withdraw AI permission at any time in Profile → System Settings → AI data permission. You can also withdraw all consents by deleting your account (see section 7). Most of these fields are optional — information you do not enter is not processed.

4. Who we share your data with

Google Gemini (Google LLC) — AI ANALYSIS, only with your permission: your meal photo and meal description; your allergen scan photo, allergens and foods you dislike; names and amounts of foods you add manually; profile information used to create your diet plan and meal feedback (age, sex, height, weight, target weight, activity level, diet goal and pace, health conditions, allergens, foods you dislike, eating style, meal times, how often you eat out); and your answers when you renew your diet (what you struggled with, what you are craving and — only if you tick it — whether it was your period week). Your name, email and account details are not sent. LunaFY uses the Gemini API as a paid service; under Google’s terms for this use, the data sent is not used to improve Google’s products and Google processes it as a data processor. Google’s API terms: ai.google.dev/gemini-api/terms

Google Firebase (Google LLC): authentication, account records and push notifications.

Google Cloud Run (Google LLC, Frankfurt, Germany): the app’s server.

MongoDB Atlas (MongoDB Inc., Google Cloud Western Europe): the database where your data is stored.

Apple: in-app purchases (Apple takes the payment) and “Sign in with Apple”. Google: authentication if you use “Sign in with Google”.

RevenueCat (RevenueCat, Inc., USA): to verify your subscription with Apple and manage it. RevenueCat receives only your account’s random identifier and your purchase records — not your name, email or health data.

INTERNATIONAL TRANSFERS: These providers’ servers are outside Turkey. Your health data is stored and processed on Google Cloud (Frankfurt, Germany) and MongoDB Atlas (Western Europe); this transfer is covered by your health data consent. Transfers to Google for AI analysis (which may include the USA) rely on your separate AI permission. Your account details (email, name) are transferred to Google Firebase for authentication and your subscription records to RevenueCat (USA). Providers process your data only to provide the service, on our behalf and under their data processing agreements.

We do not share your data with any other third party, and we do not hand it to anyone unless we are legally required to.

The lunafy.app website uses Google Analytics (Firebase) for visit statistics. The mobile app contains no analytics or advertising SDK.

5. How we use your data

To create a personal diet plan and calorie/macro target for you.

To estimate nutrition values by analysing your meal photos and descriptions (if you allowed AI).

To warn you about foods that conflict with your allergens and dislikes.

For your progress reports and weekly check-in.

To send reminder notifications, if you chose to receive them.

To manage your subscription, your free trial and gift days earned through invites.

To keep the service running, prevent abuse (e.g. the daily AI usage limit) and understand, in aggregate, how the product is used.

6. How long we keep your data

Your data is kept for as long as your account is open; there is no automatic deletion period. Your meal photos are also kept until you delete your account.

When you delete your account, your profile, meals, meal photos, measurements, allergens, water log, diet plans, weekly check-ins, invite and gift-day records, health data consent and AI permission records and sign-in records are permanently deleted.

LunaFY does not store anything on Google’s side. Google may keep the data for a limited period to detect abuse; this processing is governed by Google’s API terms.

Server logs contain no health data; they are only for debugging and are rotated quickly.

7. Deleting your data and your rights

You can delete your account and all your data from inside the app: Profile → System Settings → Delete Account. Deletion starts as soon as you confirm and cannot be undone. Deleting your account does not cancel your App Store subscription; cancel it in iPhone Settings → your Apple ID → Subscriptions.

To prevent abuse, we store an irreversible hash of an identifier your device’s operating system provides (identifierForVendor on iOS, ANDROID_ID on Android). The raw value is NEVER stored or logged; it cannot leak to other apps and it is not an advertising identifier. Its only purpose is to stop the free trial from being restarted by repeatedly creating new accounts on the same device. In practice: a second account on the same device does not get a fresh trial, it gets what is left of the first account’s trial.

After deletion, a single record remains: an irreversible hash of your account ID (one-way, mixed with a secret key) and the date your free trial started. It contains NO name, email or health data and cannot be traced back to you. Its only purpose is to stop someone from deleting their account and returning with the same identity to restart the free trial. In practice: if you delete your account and come back with the same account, your trial does not restart, it continues where it left off.

Under GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive a copy of it in a portable format and withdraw your consent. Under Turkish KVKK (Art. 11) you have the right to learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Turkey or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under KVKK Art. 7; request that corrections and deletions be notified to those third parties; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

HOW TO APPLY: write to support@lunafy.app from the email address registered to your account. We respond free of charge within 30 days at the latest. You also have the right to lodge a complaint with your data protection authority — in Turkey, the Personal Data Protection Board (KVK Kurulu).

8. Security

All communication between the app and the server is encrypted with TLS. Your password is never stored in plain text; only an irreversible hash is kept. Database access is restricted and data is hosted on servers inside the European Union.

9. Notifications

You can decline push notifications; refusing them does not affect the app’s core features. You can change your preferences under Profile → System Settings.

10. Age limit

LunaFY is a weight management app that involves calorie restriction and is designed only for people aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn of such an account, we delete the data.

11. Changes

If we update this policy, we change the “last updated” date on this page. If the types of data we collect or the parties we share with change, we will also notify you in the app. If the types of data sent to AI change, we will ask for your permission again in the app.

12. Data controller and contact

Data controller under KVKK and GDPR: Ömer Yılmaz (developer and publisher of the LunaFY app). Contact and data protection requests: support@lunafy.app