Luni — Privacy Policy

Last updated: 2026-06-21

Luni (“we”, “us”) helps you evaluate skincare products on evidence and fit. This policy explains what we collect, why, and your choices.

Who we are

Luni (KvK 94418691), Leliestraat 31, 2011 BL Haarlem, Netherlands. Contact: [email protected].

What we collect

• Account data — email address and (optional) display name, to create and secure your account. Authentication is handled by Supabase.
• Skincare inputs you provide — your selected skin goals, the products on your Skin Shelf, pasted ingredient (INCI) lists, product links you submit, and routine/usage check-ins. Most of this is stored locally on your device; account-linked data is stored on our backend.
• Face Scan images (Premium, optional) — if you use Face Scan, a photo you capture or upload is sent to our analysis service to detect cosmetic skin signals. We do not store the image by default; only the structured, non-identifying result is kept unless you opt into progress tracking. You give explicit consent before any image is uploaded.
• Advisor chat (Premium, optional) — messages you send to the AI Advisor are processed to generate a reply (see “AI processing” below).
• Subscription status — managed by RevenueCat and the App Store / Google Play. We receive your entitlement status (active / not), not your payment card details.
• Device & diagnostic data — basic technical data needed to run the app and, if enabled, anonymized crash/diagnostic reports to fix bugs.

We do not sell your personal data.

AI processing

Face Scan and the Advisor use AI models (including Anthropic Claude) via our secure backend. Inputs are sent to generate analysis/replies and are not used to train third-party models. The Advisor and Face Scan provide cosmetic, educational guidance only — not a medical diagnosis.

How we use your data

To provide the core features (scoring, routine fit, recommendations), to operate your account and subscription, to improve the app, and to comply with law. Legal bases (where GDPR applies): performance of contract, your consent (e.g. Face Scan images), and our legitimate interests in operating and improving Luni.

Third-party services

• Supabase — authentication, database, storage, serverless functions.
• Anthropic (Claude) — AI analysis for Advisor / Face Scan.
• RevenueCat + Apple App Store / Google Play — subscription processing.
• Cloudflare — hosting the web app.

Each processes data under its own terms; we share only what’s needed for the feature you use.

Data retention & deletion

You can delete your account from Settings → Delete account, which removes your account and associated server-side data. Locally stored data is removed when you delete the app. Subscription records held by the app stores follow their policies.

Your rights

Depending on your location (e.g. GDPR/UK GDPR, CCPA), you may have rights to access, correct, delete, or export your data, and to withdraw consent. Contact [email protected] to exercise them.

Children

Luni is not directed to children under 16. We do not knowingly collect data from children under that age.

Changes

We’ll update this policy as the app evolves and revise the “Last updated” date.

Contact

Questions: [email protected], Luni (KvK 94418691), Leliestraat 31, 2011 BL Haarlem, Netherlands.