Lunaya Privacy Policy
Last updated: 31 October 2026
Lunaya is a Vietnamese lunar calendar app for phones, tablets and Apple Watch. This page states what the app collects, what it does not, and how you control your data.
Personal data stays on your device when signed out
The daily sheet, day details, events, tasks, reminders, reference tools, family tree and acquaintances are processed on your device. When signed out, the events, tasks, plan templates, notes, prayers, family tree and acquaintances you enter are not sent to our server, except when you tap an AI button (see AI features). Signing in is optional, to back up and sync this data across devices. Other network requests are described below.
Widgets, Live Activities and the Apple Watch app get what they display (such as event and task titles) straight from the app on your device; the watch receives it from the paired iPhone, not through our server.
A backup file you export is encrypted with a password you choose and stays where you save it; besides the data in the table below, it also holds your appearance and calendar settings (theme, text size, background, date and time format…) and the holidays you pinned for countdown. The app does not send the file or the password to our server.
If you turn on Sort by usage at the bottom of Look up, how often you open each tool is counted on this device; it is not synced and not sent to our server.
What is collected when you sign in
If you choose to sign in with Google or Apple, the following is stored on our server:
| Data | Why |
|---|---|
| Email address, display name, profile picture URL | To recognise your account across devices |
| Firebase account identifier | Authentication and access control for synced data |
| Events you create — title, notes, location, time (solar or lunar), repeat rule, reminder time, category, linked family member, items to prepare and whether they are done; for each item to prepare: how many days before, assignee, linked prayer | Backup and sync |
| Tasks you create — title, notes, due date (solar or lunar), repeat rule, reminder time, category, whether done | Backup and sync |
| Plan templates you create — template name, order; for each item in a template: name, how many days before, linked prayer; built-in templates you have hidden | Backup and sync |
| People you name on an event (each occurrence of a repeating event) — name, and a link to the family-tree member or acquaintance if you picked them from there | Backup and sync |
| Notes you write on individual days | Backup and sync |
| Prayers you type in yourself — title, text, linked occasion (1st or 15th of the lunar month, death anniversaries or a holiday) | Backup and sync |
| Custom event categories — name and colour | Backup and sync |
| Your date of birth, time of birth and gender entered under Settings → Account | Backup and sync |
| Family trees — tree names; for each person: name, birth name, nickname, gender, date and time of birth, whether deceased, date and time of death, place of residence, notes, more details (hometown, occupation, hobbies, personality and items you name yourself), funeral items (details, date, burial place and items you name yourself); family relationships; the person marked as you in each tree | Backup and sync |
| Acquaintances you enter for age compatibility — name, date of birth, time of birth if known, gender | Backup and sync |
Firebase Authentication manages account information; synced content is held in Google Cloud Firestore and transmitted over an encrypted connection (HTTPS). No other user can read your synced content — the server's security rules are bound to your user ID. While end-to-end encryption is off, the developer, as the service operator, has technical access to this data and uses it only to handle your own support or account-deletion requests.
Age compatibility is worked out on your device. The most recent group you compared stays on your device and is not synced. Results leave the device only when you tap share, and the shared text gives names and stem-and-branch years, not other people's dates of birth.
Your profile picture is never copied to our server: the app keeps only the link Google provides and fetches the image straight from there to show it on the Account screen. Signing in with Apple gives no picture at all — Apple does not provide one — so the app shows the first letter of your name instead.
End-to-end encryption
When Settings → Account → End-to-end encryption shows On, the synced data in the table above (all but the first two rows, which are account details) is encrypted on your device (AES-256-GCM) before it is sent; data synced earlier is re-encrypted. Neither the developer nor Google can read the encrypted part. Until that line exists and shows On, your synced data is not end-to-end encrypted.
- The key stays on your devices. The server holds only a copy wrapped with your 32-character recovery code; the code is shown on your device for you to keep and the app never sends it to the server. Your other Apple devices receive the key through iCloud Keychain if you have it on; other devices need the recovery code.
- Not encrypted: each item's identifier, modification time and size, the number of items, and the key identifier. Identifiers of day notes and of the people named on an event may contain the date they belong to.
- If you lose the recovery code and no device can open your data any more, nobody, including us, can decrypt the data on the server. Data on your devices remains; Reset encryption replaces the server copy with the data on the device you are using.
- The recovery code is shown once as soon as encryption is turned on. After that, before showing the code again, creating a new one or resetting encryption, the app asks you to unlock with Face ID, Touch ID, fingerprint or your device passcode (if your device has a lock set). The operating system performs the check; the app receives only a pass or fail result, never biometric data.
Location — only when you tap the button
The event editor has a "Use current location" button that fills in the Location field for you. Tapping it asks for your location once, then immediately turns it into a place name (for example "District 1, Ho Chi Minh City") which you can edit. The app stores no coordinates, does no tracking, and never reads location in the background.
To turn coordinates into an address, the app uses the operating system's geocoding service. This service may send coordinates over the network to find a place name, even when you are not signed in to Lunaya.
That text is part of the event, so it leaves your device only if you are signed in (events are synced while you are signed in). If you never tap the button, the app never asks for location.
The travel and geomancy compasses use the magnetometer, not location — both work even if you deny the permission.
In-app purchases
The Support the developer section in Settings lets you make a one-time purchase. The transaction is handled entirely by the App Store or Google Play; Lunaya never sees or stores payment details, and no server of ours records your purchase history.
Supporting unlocks nothing — every feature is free for everyone.
Network connections without signing in
On launch the app fetches a static configuration file at https://vanvolabs.com/lunaya/config to learn whether the running build is too old. The call only downloads — it sends none of your information, no identifier and no cookie. As with any web request the host (Cloudflare) sees an IP address and a user agent at the infrastructure level; we do not read, store or analyse those logs.
If the network is down or the server does not answer, the app carries on normally — no waiting screen and no error.
Another connection happens only when you tap for it: choosing Open in app on a theme on our website makes the app ask for confirmation and then download that theme file. It only downloads too, and sends none of your information. No tap, no call.
When you open the Calendar sources screen, the app periodically test-downloads the suggested holiday calendars from calendars.icloud.com (Apple) and calendar.google.com (Google) so that it lists only calendars that download correctly. These calls also only download and send none of your information; as with any download, the server sees your IP address.
Calendars from URLs you choose
When you add or refresh a calendar URL source, the app connects directly to that address to download the calendar. The source provider, and any server it redirects to, see your IP address and the requested URL, including any access token contained in it. Use trusted sources and do not share private calendar URLs.
The source address and downloaded calendar are stored on your device, not synced to Firestore. Imported reminders are processed locally. Removing a source in the app does not delete the calendar at its provider or events you created yourself.
Event sharing
When you share an event as a link or a calendar file (.ics), the event content (title, time, location, notes, checklist, reminder) is carried inside the link or file and travels through the messaging app you choose. The app does not upload the event to our servers. The content is only text-encoded (base64), not encrypted: anyone who has the link or file can read it, just like a text message. A calendar file you open with Lunaya is read only on your device; the copy the operating system hands to the app is deleted after reading.
The content sits after the # of the https://lunaya.vanvolabs.com/e#… link; browsers do not send that part to the server. Opening the page is a web request like any other: Cloudflare sees an IP address and a user agent; we do not read, store or analyse those logs.
So that the link can open the app directly, the operating system (iOS, Android) downloads the verification files of the lunaya.vanvolabs.com domain (apple-app-site-association, assetlinks.json). These requests are made by the operating system and carry nothing about your events.
AI features — only when you tap
When you tap an AI button (More suggestions or Analyze in a Quick notes entry, Suggest messages when making a card, Fill in when adding an event from a sentence, Suggest preparation tasks), only the text of the item you have open is sent through our server (Cloudflare) to OpenAI to make suggestions. Link all in Quick notes sends the notebook's entries with their dates (newest first, length-limited), after you confirm how many will be sent. Analyze results are kept only on this device: not synced, not in backups, and deleted with the entry. Each request carries a random device ID and your account ID (if signed in), used only to limit requests per day; our server counts requests per IP address as a one-way hash, deleted within 2 days. The first time, the app asks whether you agree to send it. Our server does not store what you send; OpenAI may keep data sent to its API for up to 30 days for abuse monitoring, under its own policy. AI content you report with Report content is kept with the device ID for us to review: at most the 1,000 most recent reports, deleted after 30 days without a new report. Nothing is sent unless you tap an AI button. Each AI request carries a Firebase App Check token (Google Play Integrity on Android, Apple App Attest on iOS) so our server knows it comes from the genuine Lunaya app; the token holds none of your content and is not used for tracking.
What Lunaya does NOT collect
- Device contacts: the app does not read your device's contacts. Family tree information and relationships are entered by you and synced when signed in, as described above.
- Photos from your device's library, files, messages, browsing history.
- Advertising ID. The app has no advertising and does not declare the
AD_IDpermission. - Health or financial information.
- Your personal calendar. The app never transmits any event from your calendars, and stores nothing outside your device. Two switches, both off by default, are yours to turn on: "Sync to system Calendar" writes into a separate calendar the app creates (on iPhone, that calendar may live in your iCloud or another calendar account on the device, and the system syncs it like any other calendar); "Calendars on this device" reads the calendars you pick so their events appear on the lunar calendar page — view only, not editable, and never leaves the device.
The app uses no behavioural analytics and does not sell personal data. Google provides sign-in and storage services, Apple provides sign-in, and calendar URL providers and the suggested-calendar servers (Apple, Google) receive download requests as described above; OpenAI receives the text you send when you tap an AI button.
Permissions, and what each is for
| Permission | Used for |
|---|---|
| Notifications | Delivering reminders you set |
| Exact alarms | Firing reminders on time; without it reminders still work, a few minutes off |
| Read/write calendar | When you enable "Sync to system Calendar" or "Calendars on this device" |
| Run at startup | Restoring your reminders after you restart the phone |
| Location (approximate) | Only when you tap "Use current location" in the event editor |
| Add to Photos (iOS) | When you choose Save Image from the share sheet; the app never reads your photo library |
| Face ID, biometrics | Unlocking before the recovery code is shown again, a new code is created or end-to-end encryption is reset |
Some technical permissions (network, billing) are declared by bundled libraries (Firebase, Google Sign-In, Google Play Billing).
Deleting your data
- In the app: Settings → Account → Delete account and server data. This removes your server-side data and your account. Update the app to the latest version first: older versions do not know about data types added after them. Data on your device is untouched — it is your data, on your device.
- If you have uninstalled the app: follow the instructions at vanvolabs.com/lunaya/account-deletion-en.
- Deleting a single item (an event, a person in a family tree, a family-tree detail line…): the item is marked as deleted on the server so your other devices delete it too; its old content stays on the server until you delete your account. Day notes, prayers, acquaintances, plan templates, named people and the timing of an item to prepare (days ahead, assignee, prayer) are the exception: deleting one deletes its content on the server. Deleting a task deletes its title and notes there.
Requests are handled within 30 days.
After deletion the server keeps only a marker — the account ID and the time deletion was requested — so other devices cannot write data back. Google Firebase takes up to 180 days to purge its technical backups and keeps sign-in IP logs for a few weeks.
Children
Lunaya is not directed at children under 13 and does not knowingly collect children's data.
Changes
If this policy changes, the date at the top changes with it. Significant changes will be announced in the app.
Contact
Email: [email protected]