Luna Cycle ("the app", "we", "us") is an Android application published by Stoatworks. This Privacy Policy explains what information the app handles, how it is stored, and the controls you have over it. Luna Cycle is designed to work fully offline — if you never sign in, no data we handle ever leaves your device.
1. Data we process
The following categories describe the kinds of data the app can store. What is actually stored depends on what you choose to log and whether you enable cloud sync.
- Cycle data you enter. Period start/end dates, flow intensity, daily logs (flow, mood, symptoms, energy, sleep hours and quality, free-text notes), custom tags, and reminders you configure.
- Account data (only if you sign in). Email address and a Firebase Authentication user ID. If you sign in with Google, we receive the email tied to that Google account; we do not request any additional profile information.
- Device storage.The app's local database is stored inside Android's per-app private storage sandbox on your device.
Luna Cycle does not collect device identifiers, advertising IDs, location data, contacts, photos, or any analytics of your in-app behavior.
2. Offline-first storage
All data is written first to a local SQLite database on your device. This database is the single source of truth for the app and is readable only by Luna Cycle itself. Uninstalling the app removes this database.
3. Optional cloud sync
Cloud sync is off by default and can be enabled or disabled at any time from Settings → Sync. When you enable sync:
- Data is transmitted over TLS to Google Cloud Firestore, scoped under
/users/<your-uid>. - Firestore security rules enforce that only you — authenticated as your Firebase user ID — can read or write data under your path.
- Disabling sync stops further uploads. You may also delete all remote data from Settings → Sync → Delete remote data, which irreversibly removes your documents from Firestore while leaving local data intact.
4. Authentication providers
Luna Cycle uses Firebase Authentication to manage optional accounts. Sign-in methods supported:
- Email + password
- Google Sign-In
Authentication is processed by Google as a data processor under their terms. See Google's Firebase Privacy & Security page for details.
5. Analytics and tracking
Luna Cycle does not use Firebase Analytics, Crashlytics, or any other analytics or tracking SDKs. We do not sell, share, or trade any data with advertisers or other third parties.
6. Permissions requested
- Notifications— required to deliver period forecast reminders, daily-log nudges, and medication alarms you configure. All reminders are scheduled locally via Android's AlarmManager; no server sends push notifications.
- Internet — required only when you choose to use cloud sync or sign in. The app functions fully with the network disabled.
- Biometric (optional) — used only if you enable biometric app lock in Settings. Biometric data never leaves the Android Keystore.
7. Your rights
- Export. Export all your cycles and daily logs as CSV or JSON at any time from Settings → Data.
- Delete. Clearing app data (Android Settings → Apps → Luna Cycle → Storage) removes all local data. Deleting your account from Settings → Account removes authentication and all synced documents.
- Access. The app itself is a full interface onto every piece of data it holds — there is no hidden telemetry to request.
8. Children
Luna Cycle is intended for users aged 14 and above. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact us at the email below and we will delete the associated data.
9. Changes
If we make material changes to this policy, we will update the effective date above and, for users with sync enabled, surface a notice in-app on next launch. Continued use of the app after a change constitutes acceptance of the revised policy.
10. Contact
Questions, data access requests, or deletion requests: privacy@stoatworks.dev.