This policy explains what data the Lunu mobile app and this website collect, why, and what you can do about it. We have tried to describe exactly what the software does rather than what sounds reassuring.
Who we are
prefrontal systems S de R L de CV, a company registered in Mexico, is responsible for the data described here. You can reach us at support@lunumusicgroup.com.
This policy covers the Lunu app for iOS and Android (com.flowstate.music) and
the website at lunumusicgroup.com.
What we collect and why
| Data | Why |
|---|---|
| Email address | To create your account and sign you in. If you use Sign in with Apple and choose to hide your email, we only receive Apple's private relay address. |
| Account identifier | An internal ID that links your playlists and subscription to your account. |
| Sign in with Apple token | If you sign in with Apple, Apple gives us a token tied to your connection to Lunu. We store it encrypted, for one purpose only: so that when you delete your account we can ask Apple to revoke Lunu's access to your Apple ID, which Apple requires us to do. It is never used to read anything from your Apple account, and it is deleted along with your account. |
| Your playlists | The playlists you create and the tracks in them, so they follow you across devices. |
| Subscription status | Plan, price, renewal dates and the transaction identifier Apple sends us, so the app knows whether Premium is active. |
| Usage events | When the app is opened and when playback starts and stops, to understand which content is used and to find problems. Processed by PostHog in the United States. |
| Feedback you send | The message you write in the app's feedback screen, plus your platform and app version. |
| Advertising identifier | Your device's advertising ID (IDFA on iOS, Advertising ID on Android), used through the Meta SDK to measure advertising. See "Tracking" below — on iOS this only happens if you allow it. |
| Website analytics | Page views on lunumusicgroup.com. |
Two things worth being explicit about
Usage analytics are not linked to your account. The app never sends your account identifier to our analytics provider, so those events are tied to an anonymous device-level identifier and we cannot look up "what did this user listen to". This is also why we cannot delete your analytics individually — see below.
Feedback messages do not include your account identifier. If you want a reply, include your email address in the message itself, otherwise we have no way to know who wrote it.
What we do not collect
- Payment details. Subscriptions are billed by Apple. We never see or store your card number.
- Your location.
- Your contacts, photos or files.
- Microphone or camera input. The app plays audio; it does not record.
- Health or fitness data.
Downloads stored on your device
If you enable offline listening, the audio files are stored on your device only. They are not uploaded anywhere, and deleting the app removes them.
Tracking and advertising
Lunu includes Meta's SDK, which can use your device's advertising identifier to measure the performance of our advertising.
On iOS, Apple requires your permission first: the app shows the App Tracking Transparency prompt, and if you decline, the identifier is not used for tracking. You can change your mind at any time in Settings → Privacy & Security → Tracking. On Android you can reset or delete your Advertising ID in Settings → Google → Ads.
Who else processes this data
- Supabase — accounts, playlists, subscription records and audio hosting.
- PostHog — usage analytics.
- Meta — advertising measurement.
- Apple — sign-in, payments and subscription management.
- Google — distribution through Google Play.
- Netlify — hosting for this website.
We do not sell your personal data.
Where your data is processed
We are based in Mexico and the services above process data on servers in the United States. Using Lunu means your data is transferred and processed there.
How long we keep it
Account data — your email, playlists and subscription record — is kept for as long as your account exists. If you delete your account, it is removed as described on the account deletion page.
Usage analytics are retained according to our analytics provider's retention settings. Records related to purchases may be kept longer where accounting or tax rules require it.
Your choices
You can:
- Ask us what data we hold about you.
- Ask us to correct it if it is wrong.
- Delete your account and its data.
- Turn off tracking, as described above.
Write to support@lunumusicgroup.com from the address you use to sign in and we will handle it.
Under Mexican data protection law (LFPDPPP) you have rights of access, rectification, cancellation and objection — the "derechos ARCO" — over your personal data, exercisable at that same address. If you are in the European Economic Area, the United Kingdom or California, local law may give you additional rights; write to us and we will do our best to honour them.
Children
Lunu is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.
Security
Data is transmitted over encrypted connections, and our database restricts each account to its own rows. We do not handle card data at all. No system is perfectly secure, but we do not store what we do not need.
Changes to this policy
If we change how we handle data we will update this page and its "last updated" date. For significant changes we will also say so in the app.