Privacy policy
Luna is built so that what happens at your child’s bedside stays on your own devices. This page says exactly what that means, and it is honest about the few things that do leave them.
What never leaves your devices
Your child’s name, bedtime schedules, nap sessions, nightlight colour and brightness, screen framing and every app setting are stored on the two phones themselves, in the operating system’s own app storage. None of it is sent to us and none of it is stored in the cloud.
The parent device and the clock talk to each other directly over your own Wi-Fi. They find each other with local network discovery, confirm the first pairing with a code shown on the clock’s screen, and encrypt every message afterwards. Cryptographic keys are generated on the device and held in the iOS Keychain or the Android Keystore. No server sits between them and no account is created.
One thing to be aware of, because it is the exception to the paragraph above: so the parent phone can find it, the clock announces itself on your Wi-Fi using your child’s first name. Any device on the same network can see that name. Nothing else is announced with it, and it does not leave the network.
Listening to the room
Listen lets you hear your child’s room from your own phone, see it if you ask for video, and answer them. The clock’s microphone opens when you tap Listen in on your phone and closes when you tap Stop. A small mark on the clock’s screen shows the whole time it is open, and shows the camera too whenever you have asked for video. Your own phone’s microphone is on only while you hold the talk button.
Putting your phone away does not end the session. The clock keeps listening for you and sends your phone a notification when it hears something, until you tap Stop. A session left running does end on its own: in the morning for a session started at night, and after an hour away or at nightfall for one started during the day.
The sound and the video travel directly between your two paired devices over your own Wi-Fi, encrypted, and nowhere else. Your phone plays the sound as it arrives and neither device writes it down, so there is nothing to replay afterwards and nothing about the room for us to receive.
What does leave your devices
There are five exceptions, and none of them carries audio or your child’s name.
Crash and usage reports
Luna uses Firebase Crashlytics and Firebase Analytics to find out when the app breaks and which screens people use. These send an app instance identifier, device model, operating system version, language, coarse region and crash stack traces to Google. They do not send your child’s name, the sleep schedule, the nap, or anything else you type into Luna.
Luna carries no advertising. It does not collect an advertising identifier on either platform, the advertising permissions are stripped from the Android build, and nothing Luna sends is used to build an advertising profile or combined with data from other companies.
Wake-up sounds
Alarm tones and wake-up music are downloaded from our media server the first time you play them, and cached on the device afterwards. The request tells the server which file was asked for and, as with any web request, your IP address. One alarm tone is built into the app and needs no connection at all.
Support purchases
Luna is free. If you choose to make an optional support purchase, the payment itself is handled entirely by Apple or Google. We never see your payment details. Once the store confirms it, the app records the purchase so we can verify it and add your first name to the supporters list inside the app. There is still no account: the purchase is keyed to a random identifier generated on your own device and kept in its secure storage. What we store is the first name you enter, the product bought, the amount, the platform and the date.
The supporters list
The list of supporter first names is public inside the app. If you would rather not appear on it, do not enter a name when you make the purchase.
Noise alerts
If you are listening and your phone is not on the app, the clock can still tell you when it hears something. To do that it sends a message through Firebase Cloud Messaging, Google’s notification service, to your phone. The message says that a noise was heard, which clock heard it and when, and that is all it carries. To make this work your phone gives the clock a notification token, which the clock keeps in its secure storage and passes to our relay along with the alert. Alerts are capped at thirty per clock per night.
This website
The pages of luna-clock.web.app are measured with Google Analytics, so we can see which pages people read and which sites send them here. The measurement runs without cookies: nothing is stored in your browser, and what reaches Google is the page you opened, the site that linked to it, your browser language and, as with any web request, your IP address, which Google uses to work out a country.
The case configurator runs entirely in your browser. The measurements you type and the files it exports stay on your own computer.
Permissions the app asks for
- Local network. To find and talk to the paired device. Luna does not scan your network for anything else.
- Notifications and alarms. On the clock, to ring at the time you set, even when the screen is off. On your phone, for the noise alerts described above.
- Microphone. On the clock, to let you hear the room while you are listening. On your phone, to answer your child while you hold the talk button. What it hears goes to your paired device and nowhere else.
- Camera. On the clock, and only while you have asked to see the room during a call. What it sees goes to your paired phone and nowhere else.
- Home screen / launcher (Android only). Optional. If you turn it on during setup, the clock device starts into Luna on boot so your child cannot wander into other apps.
Children
Luna is used by children, but it is set up and controlled by a parent. It asks for nothing from the child: no account, no email address, no photo. The only thing about the child that Luna holds is the first name a parent types in so the clock can say good morning by name. It is stored on the device and never sent to us, though as described above the clock does announce that name on your own Wi-Fi so the parent phone can find it. The room’s sound and video, while a parent is listening, go to that parent’s phone and nowhere else.
Deleting your data
Resetting a device from the app’s settings erases everything Luna stored on it, including the pairing keys, and the notification tokens Listen holds. Uninstalling the app does the same. For the supporters list, ask us and we will remove your name.
Your rights
Under the GDPR you can ask for access to, correction of, or deletion of any personal data we hold, and you can object to processing or ask for it to be restricted. In practice the only personal data we hold is what a support purchase creates, since everything else stays on your devices.
The legal bases: crash reporting and usage analytics rest on our legitimate interest in keeping the app working and knowing which screens are used. Purchase records are processed to carry out the transaction you asked for and to meet accounting obligations.
Changes
If this policy changes in a way that affects what we collect, the updated date at the top of this page changes with it.
Who is responsible, and how to reach them
The data controller for Luna is Florian Paillard, acting as an individual rather than a company.
For anything on this page, including a request to access or delete data, write to contact@sertook.com. For help setting the app up, the support page is the faster route. You can also complain to your national data protection authority.