Draft: this page hasn't been signed off yet.It describes the app as it is now, while it's being built and tested. It will be checked, and this notice taken off, before Luna Chart goes on sale.
Privacy: Louxi's Luna Chart
Last updated: 1 November 2026. One page for all three versions: Louxi's Luna Chart (the app), Louxi's Luna Chart Cloud (the same app, plus an optional online backup and sharing with a partner) and the website (the app in a browser).
Jump to: The short version · On your device · Cloud app: online backup · Cloud app: sharing with a partner · The website · Deleting your data · Who runs it · Questions
The short version
- Your chart stays on your device, encrypted. Your periods, symptoms, medicines, contraception, notes and questions for the doctor are kept in the app's own encrypted store, always, with or without a PIN.
- Luna Chart (the plain app) never uses the internet. Nothing you log ever leaves your device, unless you save a file and send it somewhere yourself.
- The Cloud app only sends anything if you turn it on: an online backup, and sharing with a partner. Both are locked on your device before they're sent. We can't read them. More below.
- No accounts, no sign-in, no email address, no adverts, no tracking, no analytics. We don't know who you are.
- We never see your chart, so there's nothing for us to keep, share, sell or hand over.
On your device
How it's locked. Everything you log is encrypted (AES-256) with a key made from a secret that's made on the device. In the phone app, that secret is kept by the phone's own secure key storage (the Android Keystore) and never leaves the phone, and the app is left out of the phone's backups. If you set a PIN, the key needs your PIN too, like a banking app: after 3 wrong PINs in a row, the app makes you wait 5 minutes. Fingerprint or face unlock, if you turn it on, is checked by the phone; the app never sees your fingerprint or face. The app never blocks screenshots.
Reminders are off until you say yes. They're the phone's own notifications, set on the phone. Each one only ever says a friendly hello from Louxi, never anything about periods, your body or your cycle, so anyone who sees your lock screen learns nothing. Tapping one opens the app (after your PIN, if you've set one).
Files you make. The doctor's report (a PDF) and a backup file are made on your device. In the phone app they go out through your phone's share sheet; in a browser they download. You choose where they go, and that app or service handles them under its own privacy policy. The report isn't locked, so treat it like any medical letter. The backup file is locked with a passphrase you choose, so it can't be read without it.
Cloud app: online backup
This part is only for Louxi's Luna Chart Cloud, and only if you turn on BACK UP ONLINE. Everything above applies to the Cloud app too.
What we keep. For each backup, our server keeps exactly four things:
| What | What it is |
|---|---|
| An account number | A long code worked out on your device from your name, question and answer. It can't be turned back into them. |
| A login check | A code that proves your device is allowed in. It's made from your passphrase, but the passphrase can't be worked out from it. |
| A version number | Counts up each time the backup changes, so your devices stay in step. |
| Your locked backup | Your chart, locked on your device: the days you've logged (with your notes), contraception, what you told the app about you (including your year of birth, if you gave it), your settings, your questions for the doctor, your partner shares and the charts shared with you (and the keys to them), and what you've deleted. To us, it's meaningless scrambled data. |
We keep no names, email addresses, dates or IP addresses, and we keep no logs of who uses the server.
Never in the backup: your reminder settings (each phone asks for its own permission), and the backup's own keys.
What we never get: your passphrase, the key that unlocks your backup, your PIN, anything you've logged, your name, your answers, or anything that says who you are.
Kept behind your lock. The keys to your backup are kept inside the app's encrypted store, so your PIN (if you set one) protects them too. The app only backs up while it's open.
Paying for online backup (when it's switched on: see the terms). You'll pay through your device's own app store, which handles the payment under its own privacy policy. We never see your payment details. Whether you've paid will be kept inside your own locked backup, so only your devices can read it: our server won't learn who has paid, or whether anyone has.
Forgetting your passphrase. Because we can't read your backup, we can't recover it for you. That's what keeps it private.
- If you still have your device, nothing is lost. Everything is on it, and CHANGE PASSPHRASE in settings sets a new one at any time.
- **If you lose your device and forget your passphrase,** the online backup can't be opened by anyone. That's why the app shows a "keep this safe" card when you turn it on, which you can print or save as a PDF.
We don't delete backups for being old. If you take a break for a year or two, your backup will be waiting.
Cloud app: sharing with a partner
This part is only for SHARING in the Cloud app, and only if you use it. It works whether online backup is on or not.
You choose who, and what. Each share is for one person, and shows only the pieces you turn on: the current phase and next period; pain; flow; mood and energy; other symptoms; contraception and medicines (which asks you first, with a warning). Your notes are never shared. Nor is your year of birth, your questions for the doctor, your answers to Louxi's questions, or the red flags.
How it's sent. Your device works out what the share shows, from the last 90 days, locks it, and puts it on our server. It's sent again when your chart changes. The share has its own random number and its own keys, with nothing linking it to you or your backup. The person you share with gets the keys to read it from the QR code on your phone: the code lets them see, never change anything. The nickname you give a share stays on your devices and is never sent.
What we keep, for each share: its random number, a check made from the key your devices use to update it, a check made from the key the other person uses to read it, and the locked share. We can't read it: only your devices and the person with the code have the key.
Anyone with the code can read the share while it's on. Only show it to the person it's for. STOP SHARING deletes the locked share from our server straight away; we keep only the share's number and the two checks, so that share can never be used again, and the other person sees "This chart isn't being shared any more." Changing what a share shows takes effect the next time it's sent.
Seeing someone else's chart. If someone shares with you, your app keeps the keys to it (in its encrypted store, and in your online backup if you have one), and downloads their chart when you look. Their chart is never saved on your device: it's only kept in memory while the app is open, and cleared when it locks.
The camera. SCAN PARTNER'S LUNACHART uses the camera to read the QR code, only while that screen is open. The pictures are looked at on your device, a few times a second, until a code is found. They're never saved or sent. On Android, the phone asks your permission first. You can paste the code instead.
The website
The website version works the same way: everything is saved in your browser, on that device only, encrypted. A browser has no secure chip, so the device secret is kept in the browser's own storage; the PIN still locks everything, but the phone app is safer. Clearing the browser's data erases everything.
The website never backs up and never shares. BRING BACK A BACKUP downloads a locked backup made in the Cloud app and unlocks it in your browser, once; the browser doesn't keep the backup's keys or any keys to update a share, and nothing is ever uploaded from it. DELETE A BACKUP sends the server only what deleting needs: the account number and login check, both worked out in your browser from the four details. SCAN PARTNER'S LUNACHART works as in the Cloud app, using the camera inside the page.
The website is hosted by Cloudflare. Like any website, Cloudflare sees your device's internet (IP) address when you open a page, which it uses to deliver the page and keep the site safe from attacks. What Cloudflare keeps, and for how long, is in Cloudflare's privacy policy. The website uses no cookies, analytics or adverts.
Who else is involved
The backup and sharing server runs on Cloudflare. Like any internet service, Cloudflare sees your device's internet (IP) address when it connects, which it uses to keep the service working and safe from attacks. It also sees when you connect and how big the locked data is, but never what's in it. What Cloudflare keeps is in Cloudflare's privacy policy. Nobody else is involved. We don't sell, share or analyse anything, and nothing is ever used for advertising.
If anyone asks us for your data, all we could give them is what's above: scrambled data we can't unlock, with no names attached. We can't read your chart, so we can't hand it over.
Deleting your data
On your device (every version):
- Settings > START AGAIN wipes everything logged on the device, and the PIN.
- Uninstalling the app removes everything it kept on that device. On the website, clearing the browser's data does the same.
The Cloud app's online backup:
- Settings > BACK UP ONLINE > DELETE ONLINE deletes the backup for good, straight away. The device keeps everything on it.
- On the website, without the app: open the website and tap Delete a backup (or go straight to its /delete page), then type the four details from the card. The backup is deleted for good, straight away. Nothing is downloaded or kept in the browser while doing it.
- STOP HERE stops backing up from that device only. The backup stays online.
Partner shares:
- Settings > SHARING > CHANGE > STOP SHARING deletes that share's data from our server straight away.
- If someone shares with you, REMOVE THIS CHART takes it off your app.
Who it's for
Louxi's Luna Chart, in all three versions, is for adults (18+). It's for keeping your own records. It isn't a medical device, and doesn't diagnose, treat, cure or prevent any medical condition.
Who runs it
Louxi's Luna Chart is made and run by Lish.Tech, in Melbourne, Victoria, Australia. "We" and "us" on this page means Lish.Tech.
Changes, and questions
If how your data is sent or kept ever changes, this page will be updated first, with a new date at the top.
Questions: nikku.rupert@gmail.com. If you email us, we see your email address, as with any email. We only use it to reply, and it's never connected to a backup or a share: we couldn't connect them even if we tried.