Privacy Policy

1. Scope & Applicability

This Privacy Policy describes how LunoDB ("we", "us", "our") processes information when you use the LunoDB desktop application, the LunoDB mobile application for iOS and Android, and the LunoDB Cloud connection service (collectively, the "Software") and related purchase, licensing, and support flows. Our marketing website may provide additional notices (e.g., cookies) where applicable.

2. Information We Collect

2.1 Information You Provide

• Account & Purchase: email address and license details when you purchase or register the Pro license (desktop only).
• Free Trial: when you start the 14-day Pro trial in the desktop app, your email address, IP address, machine ID, operating system and app version. We use your email to deliver the trial and, after it ends, to send a few follow-up emails about LunoDB Pro; each one has an unsubscribe link.
• Mobile Waitlist: email address and platform preference (iOS, Android, or both) if you join the mobile app waitlist.
• Affiliate Program: if you apply to the LunoDB Affiliate Program, Affonso (acting as our processor) collects your name, email, website or social profiles, audience details, payout method (e.g., PayPal email or bank details), and — where required by law — tax identification information. Affonso collects and manages IRS Forms W-9 and W-8BEN/W-8BEN-E and issues any required 1099 forms on our behalf.
• Support: information you include in emails or tickets (logs or screenshots you choose to share).
• Crash report notes: if you type a note on the crash screen about what you were doing, it is sent with that crash report.

2.2 Automatically Collected (Desktop App)

• License and update checks: your license key, a machine ID (a hash of device characteristics, used to enforce device limits), app version and operating system, to validate your license and deliver updates. Update checks send the app version, platform and update channel.
• Anonymous Usage Telemetry, Error and Crash Reports: on by default; turn them off at any time in Settings → General ("Anonymous usage and crash reports"), and nothing is sent while they are off. Reports are tied to a random identifier, not to your name, email or license, and include:
  • Usage events: the app opening and closing, a connection being created (the database type and whether SSH is used), an update being installed, a CSV import finishing (row count)
  • Errors and crashes: the error message, stack trace, the app screen that failed, and your note if you add one
  • System information: app version, operating system and version, platform, language and memory use
  • The IP address the report was sent from, recorded by our server

  Telemetry never includes database credentials, connection details, AI API keys, or the contents of your queries or databases. An error message can occasionally include a table or column name when the error came from your database.

• Export to LunoDB Mobile (only if you use it): the desktop app uploads the connections you choose, including their passwords, SSH passwords, SSH key contents and access tokens (but not AI API keys or key files stored on your computer), plus your saved graphs (including their SQL) and connection order, so your phone can download them by scanning a QR code. The upload is sent over TLS, the connection data is encrypted at rest, it can be downloaded only once with the one-time secret in the QR code, and it expires after 15 minutes. We delete the connection data as soon as your phone downloads it, or within about an hour after it expires; a bare record of the session (its ID, timestamps and the IP addresses that uploaded and downloaded it) is deleted a day later.
• Local logs: operational logs stored on your device to help you troubleshoot.

2.3 Automatically Collected (Mobile App)

• No telemetry or analytics: The mobile app does not collect usage telemetry, analytics, or crash reports. We do not use any third-party analytics SDKs.
• Local data: Connection settings and credentials, query history, saved queries, graphs, AI chats, preferences, and AI API keys are stored on your device (see Section 5.2).
• SQL editor code: the SQL editor loads its code from a public content delivery network (cdnjs, operated by Cloudflare), which receives your device's IP address when the editor loads.
• App Store review prompts: The app may prompt you to rate the app via native iOS/Android review dialogs; we track locally (on your device only) whether you have been prompted.

2.4 LunoDB Cloud (Mobile Connections)

• Connection proxy: Due to mobile platform restrictions, LunoDB Mobile routes remote MySQL, MariaDB, PostgreSQL, SQL Server and MongoDB connections through LunoDB Cloud, our connection proxy service.
• What transits our servers: your database credentials (and SSH credentials, if you use SSH), SQL queries and query results. Your phone talks to LunoDB Cloud over TLS. From LunoDB Cloud to your database server, the connection is always encrypted for SQL Server, and for MySQL, MariaDB and PostgreSQL uses TLS whenever your server supports it, falling back to an unencrypted connection only for servers that don't. MongoDB uses TLS for MongoDB Atlas (mongodb+srv) hosts and is otherwise unencrypted. Except for Azure SQL and MongoDB Atlas, the server's certificate isn't verified, so TLS protects against eavesdropping but not against impersonation of your server.
• What we store: while you are connected, your database and SSH credentials are kept encrypted in a temporary session for up to 30 minutes and deleted when you disconnect or it expires. We log each request's endpoint, method, session identifier, IP address, status code and duration to operate and secure the service, and delete those logs after 90 days.
• What we do NOT store: your SQL queries, query results or database contents. Request logs never contain credentials or SQL.
• SSH: with SSH, LunoDB Cloud signs in to your SSH host and runs the database client there, so your database password and SQL may appear in that host's process list or logs.
• Databases that don't use LunoDB Cloud: local SQLite databases on your device are accessed directly, and Turso databases are reached directly from your device over HTTPS; neither transits LunoDB servers.

No Database Content Storage. The desktop Software connects directly from your machine to your databases. The mobile Software routes connections through LunoDB Cloud but does not store your data. We do not store your database contents on LunoDB servers, and we hold your credentials only briefly: for the length of a LunoDB Cloud session, or until your phone downloads an Export to LunoDB Mobile upload.

3. How We Use Information

• Provide, secure, and maintain the Software and Pro licensing.
• Process purchases, verify licenses, and deliver updates.
• Respond to support requests and improve stability.
• Develop new features and improve user experience.
• Comply with legal obligations and enforce terms.

4. Legal Bases (EEA/UK users)

Where GDPR/UK GDPR applies, we process personal data on these bases: (a) contract (to provide the Software and licensing), (b) legitimate interests (to secure, improve, and support the Software, including anonymous telemetry and crash reports, which you can turn off at any time in Settings → General, and follow-up emails after a free trial, which you can unsubscribe from), (c) consent (for non-essential website cookies, where required), and (d) legal obligations.

5. Local Storage & Security

5.1 Desktop Application

• Local credentials: connection settings and secrets are stored locally. When available, the OS keychain (e.g., Keychain/DPAPI/Keyring) is used to protect secrets at rest.
• If OS keychain is unavailable/disabled: secrets may be stored unencrypted; you assume associated risks and must secure your device and OS account.
• Transmission: license checks, update checks, telemetry and mobile export uploads use HTTPS. Database connections are direct from your machine to your database server.

5.2 Mobile Application

• Local storage: connection settings, credentials, query history, saved queries, graphs, AI chats and AI API keys are stored unencrypted in the app's local storage on your device. This storage can be included in your device's iCloud, iTunes/Finder or Google backups.
• No OS keychain integration: Unlike the desktop app, the mobile app does not currently use iOS Keychain or Android Keystore for credential storage. Credentials are stored in the app's local storage.
• Biometric protection: You can enable Face ID, Touch ID, or fingerprint authentication to lock the app. This prevents unauthorized access to the app but does not encrypt stored credentials.
• Connection backup files: when you export connections for backup, the file includes passwords and is encrypted with AES-256 using a password you choose. Backups made with older versions of the app used weaker password obfuscation, so export them again. Data exports (JSON, CSV, SQL) are not encrypted. Keep these files somewhere safe.
• Device security: You are responsible for securing your mobile device with a passcode, biometric lock, and keeping your OS updated.

6. AI Features & Third-Party AI Services

6.1 Overview

The Software includes optional AI-powered features: natural language SQL generation, AI filters, a chat assistant that can answer questions by running read-only queries, graph suggestions, data insights, and query optimization. They use the AI provider you choose: a third-party service with your own API credentials, a local model (Ollama), or on-device Apple Intelligence, which needs no API key. On macOS 27 or later, the desktop app uses Apple Intelligence by default until you choose another provider.

6.2 Supported AI Providers

Desktop Application:

• OpenAI (GPT-6.1 Sol, GPT-6 Astra, Sol & Luna, GPT-5.4 Mini, and future models)
• Anthropic Claude (Claude Opus 5.5, Claude Sonnet 5.5, Claude Haiku 5.5, and future models)
• Google Gemini (Gemini 3.8 Flash, Gemini 3.7 Flash, Gemini 3.6 Flash, Gemini 3.5 Flash Lite, and future models)
• xAI Grok (Grok 4.7, Grok 4.6, Grok 4.5, and future models)
• DeepSeek (DeepSeek Chat, Coder, and Reasoner models)
• OpenRouter (access to hundreds of AI models via OpenRouter API)
• Ollama (local AI models running on your device)
• Apple Intelligence (on-device AI on Apple silicon Macs running macOS 26 or later; no API key)
• Custom (any OpenAI-compatible API endpoint)

Mobile Application:

• Apple Intelligence (on-device AI on iPhones and iPads with Apple Intelligence; no API key)
• Anthropic Claude (Claude Opus 5.5, Claude Sonnet 5.5, Claude Haiku 5.5, and other models)
• OpenAI (GPT-6 Astra, GPT-6.1 Sol, GPT-6 Sol & Luna, and other models)
• Google Gemini (Gemini 3.8 Flash, Gemini 3.7 Flash, Gemini 3.6 Flash, and other models)
• xAI Grok (Grok 4.7, Grok 4.6, Grok 4.5, and other models)

Note: The mobile app supports a subset of AI providers compared to the desktop app. On mobile, on-device AI is provided by Apple Intelligence; DeepSeek, OpenRouter, Ollama, and custom endpoints are not available on mobile.

6.3 How AI API Keys Are Handled

• On the desktop, API keys you provide are stored locally on your device, encrypted with the operating system's secure storage (Keychain/DPAPI/Keyring), and decrypted only when a request is sent. On mobile, API keys are stored unencrypted in the app's local storage (see Section 5.2).
• API keys are never transmitted to LunoDB servers.
• API keys are only sent directly from your device to your chosen AI provider when you use AI features.
• For Anthropic, you may instead sign in with identity federation: LunoDB reads an identity token from a file you specify and exchanges it directly with Anthropic for a short-lived Claude access token. Only that short-lived token is held in memory — no long-lived API key is stored, and no federation credentials are ever transmitted to LunoDB servers.
• You are solely responsible for obtaining, securing, and managing your AI provider API credentials.

6.4 Data Sent to AI Providers

When you use an AI feature, the Software sends what that feature needs directly from your device to the AI provider you chose. LunoDB does not receive any of it.

• Always: your request (the questions or instructions you type), and database schema information (table names, column names, data types, keys, indexes and relationships) plus the current database and table
• Chat: your messages, earlier messages in the same chat, and any SQL you include. When an answer runs a read-only query, the rows it returns (on the desktop, up to 50 rows; fewer with on-device AI) are sent so the assistant can describe them
• Data insights: on the desktop, the rows shown on screen (up to 50) and column statistics; on mobile, column statistics (null and unique counts, minimum, maximum and most common value) and the first 5 rows of the table
• Graph suggestions (desktop): a small sample of rows from the selected tables
• Query optimization (desktop): the query text and, when available, its execution plan

Some AI features send your database data to the AI provider. Schema information and data can reveal sensitive details about your database. Don't use cloud AI providers with data you are not permitted to share with them; use a local model or Apple Intelligence instead, or turn AI features off.

AI-run queries: on the desktop, when the chat assistant answers with a query, it may run it without a separate confirmation if "Run read-only answers automatically" is on (the default, except on connections marked as production). It only runs queries it has checked read data without changing it, in a read-only transaction with a time and row limit. Turn this off in Settings → AI.

6.5 Third-Party AI Provider Privacy Policies

Data sent to AI providers is subject to their respective privacy policies and terms of service:

• OpenAI: https://openai.com/privacy/
• Anthropic: https://www.anthropic.com/privacy
• Google: https://policies.google.com/privacy
• xAI: https://x.ai/legal/privacy-policy
• DeepSeek: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
• OpenRouter: https://openrouter.ai/privacy
• Apple (Apple Intelligence): https://www.apple.com/legal/privacy/

You are responsible for reviewing and complying with your AI provider's terms and privacy policies. LunoDB is not responsible for how third-party AI providers handle your data.

6.6 Local & On-Device AI (Ollama, Apple Intelligence)

When using Ollama or other local AI models, all AI processing occurs entirely on your device. No data is sent to external servers. You are responsible for the installation, configuration, and security of local AI models.

Apple Intelligence (available on Apple silicon Macs running macOS 26 or later) likewise runs entirely on-device using Apple's built-in model. Your schema, queries, and context are processed locally and are not sent to LunoDB or to any third-party AI provider, and no API key is required.

6.7 Opting Out of AI Features

AI features are optional. No data is sent to an AI provider unless you use an AI feature, and you can turn AI features off in Settings → AI on the desktop. You can use all other Software functionality without AI features.

6A. Affiliate Program & Referral Tracking (Website)

6A.1 Affonso Attribution Pixel

Our marketing website (lunodb.app) loads a tracking pixel from Affonso (https://affonso.io), the third-party platform that operates the LunoDB Affiliate Program. When a visitor arrives via an affiliate referral link, the pixel sets a first-party cookie containing an attribution identifier for up to 30 days. This cookie is used solely to credit qualifying LunoDB Pro purchases to the referring affiliate.

6A.2 Information Collected by the Pixel

• Standard web-request data (IP address, user agent, referrer URL, page URL, timestamp);
• The affiliate identifier embedded in the referral link;
• Upon purchase, the order identifier, purchase amount, and currency (to calculate commissions). We do not share your name, email, or payment details with Affonso for this purpose.

6A.3 Affiliate Applications & Payouts

If you apply to the Affiliate Program, Affonso processes your application data, payout details, and tax information as our processor. Affonso uses this data to evaluate applications, track referrals, calculate and pay commissions, detect fraud, and meet tax-reporting obligations. Affiliate records and related tax documents are retained for as long as required by applicable tax and financial-reporting laws (typically up to 7 years).

6A.4 Legal Basis (GDPR/UK GDPR)

We process affiliate and attribution data on the basis of (a) contract (to operate the Program with approved affiliates), (b) legitimate interests (referral attribution, fraud prevention, and Program analytics), and (c) legal obligation (tax reporting and recordkeeping). Where your local law requires consent for non-essential cookies, we honor your choices via our cookie preferences tool.

6A.5 Your Choices

You can block or delete the Affonso cookie via your browser settings. Doing so will not prevent you from purchasing LunoDB Pro, but it may prevent a referring affiliate from receiving credit. Affiliates may also request access to, correction of, or deletion of their data by emailing [email protected], subject to legal retention requirements.

6A.6 Affonso's Own Privacy Practices

Affonso processes data both as our processor (for Program data) and as an independent controller for its own service operations. See Affonso's privacy policy at https://affonso.io/privacy for details.

7. Do We Sell or Share Personal Information?

No. We do not sell or share personal information for cross‑context behavioral advertising as those terms are defined by the California Consumer Privacy Act (CCPA/CPRA). If this ever changes, we will provide required notices and opt‑out mechanisms (including honoring browser‑based opt‑out signals on our website where applicable).

8. Disclosures to Third Parties

We may disclose limited personal information to service providers acting on our behalf, such as:

• Payment and licensing providers (to process purchases and manage licenses).
• Affiliate program platform — Affonso (to track referrals, calculate commissions, administer payouts, and support tax compliance for the LunoDB Affiliate Program).
• Application monitoring — Laravel Nightwatch (nightwatch.laravel.com), to detect errors and performance problems on our website, licensing service and LunoDB Cloud. It receives details of requests to our servers (such as the URL, which for LunoDB Cloud can include a database or table name, and your IP address), errors, and the recipients of emails we send. It does not receive request bodies, so never your database credentials, SQL queries or query results.
• Email and customer support tools (to respond to your inquiries).
• Cloud hosting and security providers (to operate our website and licensing services).

These processors are contractually bound to use the data only per our instructions and to protect it appropriately.

9. Data Retention

• License & purchase records: retained as long as needed to administer your license and for tax/compliance (typically up to 6 years, depending on jurisdiction).
• Support tickets: 2 years from last activity (or sooner upon your request, unless needed to resolve an issue or comply with law).
• Telemetry, error and crash reports: deleted 90 days after we receive them.
• License check logs (license key, machine ID, app version, OS): 90 days, except the most recent check for each device, kept to enforce device limits.
• Free trial records: as long as needed to prevent repeat trials and to administer any later purchase.
• Export to LunoDB Mobile uploads: connection data deleted when your phone downloads it, or within about an hour after the 15-minute session expires; the bare session record is deleted a day later.
• LunoDB Cloud: session credentials up to 30 minutes; request logs 90 days.
• Local app data (on your device): persists until you delete it or uninstall the Software.

10. International Data Transfers

If you are located outside the United States and we transfer your information internationally (e.g., to service providers), we will rely on appropriate safeguards, such as Standard Contractual Clauses where applicable.

11. Your Privacy Rights

Subject to applicable law, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. If we rely on consent, you may withdraw it at any time.

CCPA/CPRA (California) & similar US state laws. California (and some other US states) provide rights to know/access, correct, delete, portability, and to opt out of sale/share and targeted advertising. We do not sell or share personal information. You will not receive discriminatory treatment for exercising your rights.

GDPR/UK GDPR. EEA/UK users have rights to access, rectification, erasure, portability, restriction/objection, and to lodge a complaint with a supervisory authority.

How to exercise your rights: Email [email protected]. We will verify your request and respond within the timelines required by law (e.g., 45 days for CCPA, extendable as permitted). If we decline your request, you may appeal by replying to our decision; if unresolved, you may contact your local regulator/attorney general.

12. Children's Privacy

The Software is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us and we will take appropriate action.

13. Changes to This Policy

We may update this policy from time to time. We will post updates in‑app or on our website and update the “Last updated” date above. Material changes will be communicated via in‑app notice or email.

14. Contact Us

Questions or requests: [email protected]. For legal notices, you may also write to [email protected].

We do not maintain a postal mailing address. Please contact us via email at [email protected]. For legal notices or service of process, email [email protected] to coordinate delivery.