Last updated: 2026-07-04
Lunes Studio is built privacy-first. Documents are stored locally and cloud copies are encrypted on your device before upload. In Standard mode, Lunes stores an encrypted spare key and can decrypt stored copies only through a gated, logged recovery path. In Advanced mode, only you hold the keys, so Lunes cannot decrypt stored copies. AI features send relevant text to the model route you select; the Brain may process document text after you open a document. Built-in AI and OpenRouter BYO use no-logging/no-training/ZDR routing controls. Browser-direct routes do not pass through Lunes servers, but content still goes to the configured provider. The plaintext BYO key stays on your device, while an encrypted copy may sync with your settings. We collect as little as we can, never sell data or use it for advertising, and let you export or permanently delete your data.
Lunes Studio ("we", "us", "our") is an online writing studio with built-in AI feedback. This Privacy Policy explains, in plain English, what personal information we handle, how we use it, who we share it with, and the choices and rights you have. It applies to our website and app (together, the "Service"). If anything here is unclear, contact us (see "Contact us" at the end).
Lunes is local-first: your documents are created and stored on your own device. When your work syncs or backs up to the cloud, it is encrypted on your device first (AES-256-GCM, using a master key that unlocks your per-project keys, which in turn unlock per-document keys), so what we store is unreadable ciphertext, never your actual text. On your device, your documents are protected by your device's and browser's own security; we do not add a separate layer of at-rest encryption to your local storage, so keep your device secure.
Standard vs Advanced, your choice: Standard (the default) keeps an extra copy of your master key, locked by Amazon's Key Management Service (KMS) and stored as ciphertext. This lets you recover your work on a new device, and it means we are technically able to decrypt your documents through that recovery path. That path is gated: it requires you to have signed in within the last 5 minutes, it is rate-limited (about 10 attempts a minute), and every access is recorded in an audit log. Advanced removes that spare key entirely: only you hold your keys, recovery depends on your passkey, master password, or recovery phrase, and no one (including us) can read your documents. You can switch to Advanced once you have at least two recovery methods set up.
We try to collect only what the Service genuinely needs. Here is the full list:
Account information: When you sign in with Google, we receive and store your name, email address, and profile photo URL, plus your Google account's stable ID so we can recognise you. We also create an internal user ID and store a one-way hash of your email to look your account up without keeping a second readable copy.
Billing information: Payments are handled by Stripe. We never see or store your card number, payment method, or billing address. We only store your Stripe customer ID and subscription ID, your plan's renewal date, whether it is set to cancel, and its status (for example active or past due), just enough to keep your plan accurate.
Beta program: If you join our beta, we store your email and name so we can reach out about the beta, and any feedback you submit. This is deleted when you delete your account (or sooner if you email us to be removed from the beta).
Usage and diagnostics: To keep the Service running fairly and prevent abuse, we store small, opaque counters: how many AI tokens you've used today and rate-limit counts. These hold only numbers and timestamps tied to your user ID (for signed-out visitors, a hashed version of your IP address, never the raw IP), and they auto-expire within about a week. We also process your IP address transiently to apply rate limits and prevent fraud.
Your documents: Your documents and the conversations you have with the AI are yours. They stay on your device (local copies rely on your device's own security), and any cloud copy is encrypted as described above. We do not read them, and in Advanced mode we cannot.
AI features send relevant text to a language model. Persona analysis, chat, and editing run when you ask; the Brain may also process document text automatically after you open a document. Where that text goes depends on which model you choose:
Built-in (free) models: Routed through our server to OpenRouter, which sends your text to an outside model provider. Every request includes no-logging, no-training, and ZDR routing controls; if no eligible provider is available, the request fails. We relay the text for the request and do not store it. OpenRouter and the selected model provider process it under their own terms.
Your own API key: AI calls go straight from your browser to OpenRouter, so the plaintext key and request content do not pass through Lunes servers. The encrypted key may sync with your settings. Calls include no-logging, no-training, and ZDR routing controls and fail if no eligible provider is available.
Local models: If you run a model on your own machine (for example Ollama or LM Studio), your document content never leaves your device at all.
In every case we send only the minimum needed for the feedback you asked for, typically the section you're working on plus short summaries of the rest, not your whole workspace.
We use the information above only to run and protect the Service:
We do not sell your personal information, we do not use your content to advertise to you, and we do not use your documents to train our own models. We only email you about your account, your collaborations, the beta (if you joined), and important service or security notices, not marketing campaigns.
We don't sell or rent your data. We share the minimum necessary with a small set of service providers that help us run the Service. Each only receives what its job needs, and each has its own privacy policy:
These providers process data on our behalf under their own terms and privacy policies. We encourage you to review them.
We use Google Analytics 4 (GA4) to understand, in aggregate, how visitors use the site, things like which pages are viewed. It relies on cookies and is pseudonymous, not anonymous.
Off by default, opt-in only: Analytics is disabled until you explicitly accept it in the cookie banner shown on your first visit. No analytics cookies or scripts load before you consent.
Cookies used (only after you accept):
_ga Distinguishes unique users. Expires after 2 years._ga_* Maintains session state. Expires after 2 years.Withdrawing consent: You can withdraw consent at any time using the cookie control on the site, or by clearing your browser cookies. When you withdraw, existing analytics cookies are deleted and no further analytics data is collected.
Beyond analytics, we use a small amount of local storage in your browser to keep you signed in and remember your preferences. This is essential to the app and isn't used for tracking.
Our server and app logs are designed to exclude your content and personal data: they record opaque IDs, coarse actions, and counts, not what you wrote. We never log encryption keys, recovery phrases, or passwords.
We use Sentry to catch and fix errors. It is configured not to attach personal data, not to capture local variables, and not to record sessions, and an extra filter strips out anything that looks like a key, token, password, or credential. In production we sample only a small share of events.
Your documents live on your device for as long as you keep them. Encrypted cloud copies are kept so your work syncs across devices, until you delete the document or your account. Your account record is kept while your account is active. Usage and rate-limit counters auto-expire within about a week.
When you delete your account, we remove your data as described in section 11. A minimal "tombstone" record (your internal ID marked deleted, with the personal fields stripped out) may remain so the system stays consistent and the same account can't be silently re-created.
When you invite a collaborator, we wrap a project key for them using their public key, so they can decrypt the shared project on their device. Share links carry their key in the part of the URL after the "#", which your browser never sends to our servers.
Revoking access rotates the live-collaboration password and, while the owner is online, re-encrypts the project's current synced data under a fresh Project Key. That key is rewrapped only for remaining collaborators, and active public links and pending invites are retired. This cannot erase copies that someone previously downloaded or kept offline.
Your data is yours, and you stay in control:
Export everything: In Settings → Security → "Your data", you can download all your projects and documents as a single file, created entirely on your device.
Permanent deletion: You can permanently delete your account. We erase your cloud documents, your escrowed key, your sharing records, your account profile, and related records, and your device is wiped of local Lunes data. Deletion means deletion: we don't keep backups of your content to restore later.
Depending on where you live, you also have rights to:
To exercise any of these, contact us (section 13). We'll respond as soon as we can and within the time limits the law requires. There are no automated decisions made about you; you're always in control of which AI suggestions to accept.
Children: Lunes Studio is intended for people aged 16 and over. We don't knowingly collect personal information from children under 16. If you believe a child has given us their information, contact us and we'll delete it.
Our infrastructure and service providers (such as Amazon Web Services, Stripe, OpenRouter, Google, Cloudflare, Resend and Sentry) operate primarily in the United States, so your information is processed and stored there. Wherever it's processed, it remains protected by this policy and by each provider's own commitments.
Lunes Studio is operated from Australia and we handle personal information in line with the Australian Privacy Principles. If you have a concern we can't resolve, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
We protect your data with encryption, access controls, and the practices described above. No service can promise perfect security, but if a breach ever affects your personal data, we will notify you and the relevant authorities without undue delay, as required by law.
We may update this policy as the Service evolves. If we make a material change, we'll update the date above and, where appropriate, tell you in the app or by email. Continuing to use the Service after a change means you accept the updated policy.
Questions, requests, or privacy concerns? Email us at hello@lunes.studio and we'll help.