Last updated: 2026-07-04
Your documents are stored locally first, and cloud copies are encrypted on your device. You choose Standard or Advanced protection. In Advanced mode Lunes cannot decrypt stored copies; in Standard mode it can only through a gated, logged recovery path. AI and Brain features require sending relevant text to the selected model, including automatic Brain processing after document open. See below for each route.
A Master Key unlocks Project Keys, which unlock per-document Data Keys, AES-256-GCM throughout. Keys are derived and held on your device. Collaborators only ever receive a Project Key for a shared project, never your Master Key.
Lunes is local-first: your documents are created and stored on your own device. When your work syncs or backs up to the cloud, it is encrypted on your device first (AES-256-GCM, using a master key that unlocks your per-project keys, which in turn unlock per-document keys), so what we store is unreadable ciphertext, never your actual text. On your device, your documents are protected by your device's and browser's own security; we do not add a separate layer of at-rest encryption to your local storage, so keep your device secure.
Standard (the default) stores a KMS-locked spare copy of your Master Key, so new devices unlock after you sign in and you can recover access if you forget everything. The trade-off: the server can decrypt your documents through that gated, logged path.
Advanced removes the spare key entirely. Only you hold your keys, new devices require your passkey, master password, or recovery phrase, and no one (including us) can recover or read your data. Set up at least two recovery methods before switching.
then choose your protection
Switch to Advanced in Settings (needs 2 saved recovery methods)
Three independent ways back in: a passkey (WebAuthn, hardware-backed), a master password (Argon2id key derivation), and a 24-word recovery phrase. Keep the recovery phrase offline and secret, because anyone who has it can decrypt your workspace.
Each feature sends the bounded context needed for that operation. Chat, Persona, and editing run when you ask; enabled Brain features can process relevant document sections automatically after open. No route sends your whole workspace.
| Route | Features | When it runs | Context sent | Destination | Retention control | Cost owner |
|---|---|---|---|---|---|---|
| Built-in | Chat, Persona, document generation, autocomplete, and Document Brain. | Chat, Persona, and editing run when you ask. Enabled Brain and autocomplete features can run automatically after open or while typing. | The current operation's bounded sections, retrieved claims, necessary history, or nearby editing context. Never the whole workspace. | Lunes gateway, then an eligible OpenRouter model provider. | Lunes does not durably log prompts or evidence. Requests require no-logging, no-training, and ZDR provider routing. | Included Lunes allowance first, then purchased Lunes credits. |
| OpenRouter BYO | Chat, Persona, document generation, autocomplete, Document Brain, and PDF vision import. | Chat, Persona, and editing run when you ask. Enabled Brain and autocomplete features can run automatically after open or while typing. | The current operation's bounded sections, retrieved claims, necessary history, or nearby editing context. Never the whole workspace. | Browser-direct to OpenRouter with your key. | Requests require no-logging, no-training, and ZDR routing. OpenRouter and the selected provider enforce their terms. | Your OpenRouter account and provider allowance. No Lunes credits. |
| Custom endpoint | Chat, Persona, document generation, autocomplete, and Document Brain. | Chat, Persona, and editing run when you ask. Enabled Brain and autocomplete features can run automatically after open or while typing. | The current operation's bounded sections, retrieved claims, necessary history, or nearby editing context. Never the whole workspace. | Browser-direct to the HTTPS endpoint you configured. | The endpoint operator's policy. Lunes cannot enforce OpenRouter-specific retention controls on this route. | The endpoint operator or your provider account. No Lunes credits. |
| Local model | Chat, Persona, document generation, autocomplete, and Document Brain. | Chat, Persona, and editing run when you ask. Enabled Brain and autocomplete features can run automatically after open or while typing. | The current operation's bounded sections, retrieved claims, necessary history, or nearby editing context. Never the whole workspace. | The local Ollama or LM Studio endpoint on this device. | Controlled by your local model runtime and device configuration. | Your device compute. No Lunes credits. |
The context depends on the feature: requested work is bounded to its operation, while enabled Brain features can process relevant sections automatically after open.
Invites wrap a Project Key to each collaborator (RSA-OAEP), and share links carry their key in the URL fragment, which never reaches our server. Revoking access rotates the Project Key, re-encrypts current synced project data on the owner's device, rewraps the new key for remaining collaborators, retires public links and pending invites, and rotates live-room access. Previously downloaded or offline copies cannot be recalled.
Diagnostic logs use opaque IDs and aggregates, never document content or personal data. Analytics (GA4) are opt-in and load only with your consent.
You can export everything you've created, and permanent deletion means deletion, locally and in the cloud.
Found a vulnerability? Please contact us before disclosing it publicly. We investigate every report and credit responsible disclosures.