Lunode Privacy Policy
Luna Company (the “Company”) complies with applicable privacy law and seeks to process only the information required for Lunode's P2P personal-cloud architecture.
1. Controller
Operator: Luna Company
Address: 501, 13 Jangcheon-ro 19beon-gil, Michuhol-gu, Incheon, Republic of Korea
Privacy contact: support@luna-company.co.kr
2. Data, purposes, and retention
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Account and authentication | Email, display name, internal user ID, sign-in provider and provider ID, password hash, authentication-token hash | Registration, sign-in, account linking, identity verification, session maintenance | Until account deletion, or token expiry/revocation |
| Device and connection | Device ID and name, platform, app version and capabilities, online status, access time, IP address, user agent, network and connection state | Device registration, P2P discovery and connection, sync, troubleshooting and security | Until device removal or account deletion; transient state expires after connection end |
| Sharing and collaboration | Folder name and ID, permissions, invitation and share-code state, member and team relationships, activity and access records | Folder and web sharing, access control, collaboration, abuse prevention | Until sharing/collaboration deletion or account deletion |
| Subscription verification | Plan, status and period, store, product/transaction/order IDs, receipt-verification data, relay usage | Purchase verification, entitlement and restore, duplicate-use prevention, usage accounting | Until account deletion; store-held records follow store policy |
| Push, support, and security | Encrypted push token, notification settings, support content, login attempts, security and audit logs | Notifications, support, fraud prevention, incident response | Until account deletion or completion of purpose |
Operating systems and servers may automatically generate connection times, IP addresses, and error records. The Company does not provide personalized advertising or sell personal data for advertising.
3. Files and device permissions
- Original photos, videos, music, documents, and folders normally remain on devices selected by you and are not permanently stored on the central Company server.
- At your request, file data may travel through encrypted communications or be temporarily stored on a device for transfer, web sharing, preview, conversion, or relay.
- Optional features may request photo/media/file, camera for QR codes, notification, local-network, and background permissions. Refusal limits only the related feature, and permissions can be withdrawn in operating-system settings.
- End-to-end encrypted content is designed to be decrypted only by approved devices; the Company may be unable to recover a lost decryption key.
4. Third parties and external services
The Company does not sell personal data. The following providers may independently process data or support the Company when you choose login, payment, or notification functions.
| Provider | Data | Purpose/timing | Retention |
|---|---|---|---|
| Google LLC | Login token, provider ID and email; Google Play product and transaction data; Firebase token and delivery data | Google sign-in, Android purchase verification, and notification delivery | As needed for the feature and under provider policy |
| Apple Inc. | Login token, provider ID and email; App Store product, transaction, and receipt data | Apple sign-in and purchase/restore | As needed for the feature and under provider policy |
| Microsoft Corporation | Microsoft Store product, subscription, and transaction-verification data | Windows purchase/restore | As needed for the feature and under provider policy |
| Email and server-infrastructure providers | Email, password-reset/support information, server access and encrypted data | Email delivery, hosting, and security operations | Until the purpose is complete or as required by contract/law |
These global providers may process data in the United States and other countries. Transfers use encrypted transport such as TLS. You may avoid optional features or withdraw operating-system permissions, but required login or purchase verification cannot work if its processing is refused.
5. Retention and deletion
- After account deletion, the operational database permanently deletes account, authentication, device, session, sharing/collaboration, subscription-verification, relay-usage, and linked log data.
- Deletion does not erase originals or synchronized files on your devices, copies you exported, copies lawfully retained by another user, or payment records held by a store.
- Encrypted disaster-recovery backups are isolated from normal service use and removed through a rolling cycle of no more than 30 days.
- Records required by law are segregated, retained only for the statutory period, and then destroyed. Other data is removed promptly after its purpose is complete.
6. Your rights
You may request access, correction, deletion, restriction, or withdrawal of consent. Delete the account directly in settings or on the web deletion page; submit other privacy requests by email. The Company will verify identity and respond within the period required by law.
7. Security
Measures include encrypted transport, one-way password hashing, token hashing/encryption, least-privilege access, protected administrator access, security logging, restricted database access, encrypted backups, and vulnerability review.
8. Children
Lunode is not directed to children under 14. If the Company learns that such data was processed without valid guardian consent, it deletes the account and information.
9. Changes
The website or app will announce changes and their effective date. Material changes to user rights are generally announced 30 days in advance and other changes 7 days in advance.
10. Contact
Privacy questions and rights requests: support@luna-company.co.kr