Privacy Policy
Effective date: 2026-08-18
1. Our commitment to your privacy
Lunawake is built on a simple principle: trust comes from structures you can verify, not from promises. This policy explains, in plain terms, what data Lunawake processes, why, where it goes, and the control you have over it. We answer three questions throughout: what we collect, who controls it, and where it goes. We do not fill this document with reassurances we cannot back up.
We do not sell your personal data. We do not use your data for advertising. We do not share your health data with third parties for their own purposes.
2. Who we are
Lunawake (the "App," "we," "us") is operated by SYNC ART LIMITED, located at Flat/Rm 12B1, 9/F, Harbour Crystal Centre, 100 Granville Road, Tsim Sha Tsui East, Kowloon, Hong Kong. For any privacy question, or to exercise your rights under Section 8, contact us at support@lunawake.ai.
For users in the European Economic Area (EEA) and the United Kingdom, SYNC ART LIMITED is the data controller responsible for your personal data.
3. What data we collect
We collect only what the App needs to function. We collect the following categories:
- Health and fitness data — With your explicit permission, the App reads sleep, heart rate, and heart rate variability (HRV) data from Apple Health (HealthKit). This is the primary source of your sleep insights. See Section 5 for how HealthKit data is handled.
- Account information — Your email address and an account identifier, used to create and secure your account and to sync your data across your devices.
- Purchase information — Your subscription and entitlement status. Purchases are processed by Apple through in-app purchase; we do not receive or store your payment card details.
- Chat and written content — The messages, notes, and questions you write to the in-app coach. These are stored in your account so your conversations are available across your devices, and — together with the relevant sleep data — are sent to the third-party AI providers described in Section 6 to generate responses.
- Derived insights — Sleep scores, trends, and event labels generated from your data, stored in your account so we can show you reports and guidance over time.
We do not collect usage analytics or diagnostic data. The App integrates no third-party analytics or crash-reporting SDKs. If this changes in the future, we will update this policy and our App Store privacy disclosures before doing so.
4. How and why we use your data, and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Generate sleep analysis, reports, and personalized guidance using AI (see Section 6) | Health and fitness data, derived insights, chat and written content | Your explicit consent (Art. 9) |
| Provide the in-app coach and AI-generated answers (see Section 6) | Chat and written content, health and fitness data, derived insights | Your explicit consent (Art. 9) |
| Create and secure your account; sync across devices | Account information, chat and written content, derived insights | Performance of a contract |
| Provide and manage subscriptions | Purchase information | Performance of a contract |
| Comply with legal obligations | As required | Legal obligation |
We do not use your data for advertising, profiling for marketing, or any automated decision-making with legal or similarly significant effects.
5. Apple Health (HealthKit) data
Health data obtained through HealthKit is treated with heightened protection:
- It is used solely to provide App features — sleep analysis, reports, and guidance.
- It is never used for advertising or marketing.
- It is never sold, and is never shared with third parties for their own purposes.
- It is never used with third-party SDKs for advertising or data-mining purposes.
- To generate your insights, your sleep and heart-rate data (and insights derived from it) is sent to the third-party AI providers described in Section 6, which process it only on our instructions to produce your response — never for their own purposes, advertising, or data-mining, and it is never sold. This happens only after you consent in the App.
- You grant access through Apple's permission prompts, and you can revoke it at any time in the iOS Settings app or the Apple Health app.
This use complies with Apple's HealthKit requirements and applicable health-data law.
6. How we share data
We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share data only in these limited cases:
- AI processing providers — Luna's insights, coaching, and answers are generated using artificial intelligence. To produce them, we send the relevant data — your sleep and heart-rate data from Apple Health, the messages and notes you write to the coach, and derived insights — over an encrypted connection to OpenRouter, Inc. (openrouter.ai), which routes each request to the large-language-model providers Anthropic and OpenAI. These providers process the data solely to generate your response, act on our instructions, and may not use it for their own purposes, for advertising, or for data-mining. We ask for your explicit consent in the App before any of this data is sent, and you can withdraw it by discontinuing use of the AI features.
- Service providers — We use a cloud hosting provider to store your account and derived insights, and Apple to process in-app purchases. These providers act on our instructions and may not use your data for their own purposes.
- Legal requirements — We may disclose data if required by law, regulation, or valid legal process, or to protect the rights and safety of users.
- Business transfers — If the business is involved in a merger or acquisition, data may transfer as part of that transaction, subject to this policy.
7. Data retention
- Chat and written content is stored in your account so it syncs across your devices, and is deleted when you delete your account.
- Derived insights are retained for as long as your account is active.
- When you delete your account, all associated data is deleted.
We do not impose an artificial expiry on your data, and we do not retain it longer than needed for the purposes described, except where law requires.
8. Your rights and choices
You control your data. Within the App you can delete data at three levels of granularity: a single night, all of your data, or your entire account. You can also export your data to a file stored locally on your device.
Depending on where you live, you have the following rights:
- EEA / UK (GDPR): access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent at any time. You also have the right to lodge a complaint with your local data protection authority.
- California (CCPA/CPRA): the right to know what personal information we collect and how it is used, to access and delete it, to correct it, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of.
To exercise any right, use the in-app controls or contact us at support@lunawake.ai. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights.
9. How we protect your data
We protect your data with encryption in transit and at rest, access controls, and the principle of keeping sensitive data where it does not need to leave. We share data with the AI providers described in Section 6 only as needed to generate your insights, over an encrypted connection, and only after you consent. No method of storage or transmission is perfectly secure, but we work to protect your data using measures appropriate to its sensitivity.
10. Children's privacy
The App is not directed to children. We do not knowingly collect personal data from anyone under 16 in the EEA/UK, or under 13 in the United States. If you believe a child has provided us data, contact us at support@lunawake.ai and we will delete it.
11. International data transfers
We are based in Hong Kong. We and our service providers process data in Hong Kong, the United States, and other countries where those providers operate. Wherever you are, your data may be transferred to and processed in countries other than your own. If you are in the EEA or the UK, when your data is transferred outside your region we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. For users in Japan, we handle personal data in accordance with the Act on the Protection of Personal Information (APPI), including notice for cross-border transfers.
12. Cookies and the website
The App itself uses no tracking or advertising cookies.
13. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the App. Continued use of the App after changes take effect constitutes acceptance of the updated policy.
14. Contact us
For any question about this policy or your personal data, contact:
SYNC ART LIMITED Flat/Rm 12B1, 9/F, Harbour Crystal Centre, 100 Granville Road, Tsim Sha Tsui East, Kowloon, Hong Kong support@lunawake.ai