Last updated: October 24, 2026
Short version: Accounts are optional: everything in Luna works without one. An account (16 and older) keeps your achievements across devices and the systems you share together in Your Luna. People we invite can also post ideas and bug reports on our board, vote and comment; the other invited members see only the display name you choose. Your settings and saved simulations stay on your device, unless you press Share, which stores the system on screen on our server so the link can open it. Usage analytics are anonymous and cookie-free. We receive personal data only from you: what an optional account stores (your email address, the display name you choose and your account settings), what you post on the board, and what you type into an optional form on the website, such as a crash report or a newsletter sign-up. The iOS and Android apps have no accounts and no forms.
Luna is an educational space simulation built by Ali Karpuzoglu. It is available as a web app and as a mobile app on iOS and Android.
Anonymous analytics. Luna measures visits anonymously and without cookies: it counts which features are used, with nothing that identifies you. It counts every visit, also when a browser sends a Do Not Track signal. We use Umami, a privacy-focused analytics tool hosted on our own server. On the website its script and its counts normally go through the website's own address (for example luna.watermelonson.com/s/), which passes them on to that server together with your IP address, so Umami can tell visits apart and work out the country. The iOS and Android apps, and the website when that address cannot be reached, send them to that server directly. Umami:
We collect only aggregated, anonymous data: page views, browser type, screen size, country, and in-app events (e.g. which scenario was loaded, whether sound was toggled). This just helps us understand what people actually want out of the tool so we can make it better.
To see whether people come back, the website keeps two values in your browser's local storage: the day you first opened Luna there and how many times you have opened it since. When you press Play, the launch event carries only rough ranges of these two numbers (for example "3-4 visits, first seen 30-89 days ago"). No identifier is created or sent, and the ranges are shared by many visitors. The iOS and Android apps do not keep or send these values.
Local storage. Luna saves your settings, tutorial progress, and simulation saves in your browser's local storage. This data stays on your device and is not transmitted to any server, apart from the rough visit ranges described above, the visit count a form you send carries, and the sign-in session of an account, all described below.
Share links. When you press Share, Luna uploads the system on screen (its bodies, their orbits and settings, and the system's name) and gets back a short link that opens it. Anyone who has the link can open that system. The upload goes through a Cloudflare Worker we operate, which first runs a Cloudflare Turnstile check against automated abuse, and is stored in our own Supabase database on our own server. To limit how many links one network can make, we store a one-way hash of your IP address next to the system, never the address itself. A small picture of the scene, taken when you share or save it, is stored with the link and shown when the link is posted in a chat. A shared system carries no name of the person who shared it, but any names you gave to bodies are part of it. If you are signed in when you share, the link is tied to your account so you can see how often it was opened and turn it off; deleting your account deletes those links. When someone opens a link, we count the open: to count each network once a day we keep a one-way hash of the IP address, never the address itself, in a short log whose entries older than a day are deleted the next time the log is written. No account is recorded with an open.
Optional account. On the website you can create an account, if you are 16 or older, by signing in with Google, with Apple or with a code sent to your email address. We store your email address and which sign-in method you used (kept by Supabase Auth in our own database), the display name you choose, the time you confirmed you are 16 or older, your choices in Settings > Account (beta features, newsletter, whether you use Luna for teaching) and the interface language, and your achievements and their progress so they come back on every device you sign in on. Google and Apple send your email address, and Google also your name and the address of your profile picture; Supabase Auth keeps these with your login, and Luna neither shows nor uses the name or the picture. Your email address is never shown to anyone. Your display name is public. When you choose or change it, our own Supabase server sends the name alone to OpenAI's moderation service, which checks whether it is offensive; OpenAI receives no email address and nothing else about your account. If that check cannot be reached, our server uses a short built-in word list instead. You can download everything we store about you, or delete your account, at any time in Settings > Account.
The sign-in service also keeps a log of sign-ins and sign-outs, including the IP address they came from, to protect accounts against misuse. We keep it only as long as that protection needs. Your browser keeps the sign-in session in local storage until you sign out. Apple or Google take part in signing in only if you choose them, and then tell us your email address; their own privacy policies apply to that step. Forms you send while signed in are linked to your account.
The board of ideas and bugs. The board is open only to accounts we invite and to the Luna team; we note on your account whether it was invited. Invited members can post feature ideas and bug reports, comment and vote. Posts and comments are shown to the other invited members with your display name. They see how many votes a post has, but nobody else can see who voted. Without an invitation, ideas and bug reports go through the private feedback forms as before. A bug report carries the app version, the platform and the interface language, and, if you choose, a share link to the scene on screen. Before anything is shown on the board, its text goes through a Cloudflare Worker we operate to OpenRouter, where a language model (Qwen) checks whether it is spam and whether it repeats an existing post; then we read it ourselves and decide whether to show it. We store the model's verdict with the post; only we can see it. New posts also go through a Cloudflare Turnstile check. If someone posts spam, we can hide their posts and stop them from posting for a while.
Forms you choose to fill in. The Luna website has a few optional forms: a crash report that is offered if Luna stops working (also open from Menu > Report a bug when you cannot see the public board), a suggestions form (Menu > Send feedback, for the same case), a short form for teachers (Learn > For teachers), and a newsletter sign-up for updates and classroom material. Where you can see the public board described above, ideas and bug reports go there instead. The iOS and Android apps contain none of these forms and send no crash reports. Each one is entirely voluntary and the app works fully without them. When you submit one, we receive what you typed. Depending on the form that can include:
The suggestions form, the teachers form and the newsletter form go straight to our own self-hosted Supabase database on our own server. To limit how often one network can send a form, the database keeps a salted one-way hash of your IP address for one day, never the address itself, and then deletes it. Crash reports travel through a Cloudflare Worker we operate and are stored in our own NocoDB database on our own server. Submissions are not sold, rented, or used for advertising, and they are not shared with anyone outside this project.
Newsletter. The newsletter is double opt-in: after you sign up we send one confirmation mail, and your address is on the list only once you click its link. A request that is not confirmed within 7 days is deleted. Mail is sent through Brevo, which receives your email address and the mail's content for that purpose. Every mail has an unsubscribe link, and unsubscribing needs no account.
AI features. Some parts of Luna can generate content or answer questions using a large language model. If you use one of those features, the text of your prompt and the relevant scene context are sent through a Cloudflare Worker we operate to OpenRouter, which forwards it to the model provider that serves the request and returns the response. We do not attach your identity to these requests, and we do not store the conversations. The worker uses your IP address only to count requests against the daily limit. The system generator returns only a planetary system (bodies, masses and orbits); Luna assigns the names itself and shows no text written by the model. Please do not type personal information into the prompt.
Purchases. On iOS and Android, Luna is a paid app. Apple and Google handle the purchase and the payment details; we receive no payment information and no card data at any point. There are no in-app purchases.
Beyond what you type into an optional form yourself, Luna never asks for or receives:
We do not use advertising SDKs, social media trackers, or any other third-party analytics.
Luna is designed to be educational. Using it requires no account and no personal data entry. Accounts are for people aged 16 and older: sign-up asks first, and someone who answers no gets no account, and the iOS and Android apps contain no forms, so they never ask for an email address. The optional forms on the website are the only place an email address can be entered, and they are intended for adults. We do not knowingly collect personal information from children under 16. If you believe a child has sent us their email address, contact us at the address below and we will delete it.
Anonymous analytics data is retained on our self-hosted Umami instance. Form submissions are retained in our own database until we no longer need them, until you ask us to delete them, or, for those sent while signed in, until you delete your account. The IP hashes the forms use for rate limiting are deleted after one day, and unconfirmed newsletter sign-ups after 7 days. Shared systems are kept so their links keep working, until we remove one, you ask us to remove yours (send us the link), or you delete it yourself in Your Luna while signed in. Your account is kept until you delete it. When you delete it, your login, profile, votes and settings are deleted at once; your board posts and comments stay, shown as "Deleted user"; systems you shared stay online without your name unless you tick the box to delete them too. Local storage data persists on your device until you clear your browser data or uninstall the app. We do not have access to your local storage data.
With an account you can download all your data and delete your account yourself in Settings > Account, and change the newsletter there or with the link in every newsletter mail. If you have sent us a form submission or made a share link, you can ask us for a copy of it or ask us to delete it, and you can unsubscribe from the newsletter at any time. Write to the address below and we will act on it. Under the GDPR you also have the right to object to processing and to complain to your local data protection authority. Everything else Luna stores is on your own device: clearing your browser's local storage removes all locally stored preferences and saves.
If we make changes to this policy, we will update the date at the top. Significant changes will be noted in the app's changelog.
If you have questions about this privacy policy, you can reach us at:
The rules for using Luna are in the Terms of Service (Nutzungsbedingungen).
Anbieterkennzeichnung nach deutschem Recht: Impressum