Stathmos

Legal

Privacy Policy

Effective date: October 23, 2026

This Privacy Policy explains how Stathmos ("we," "us," or "our") collects, uses, and protects information when you use our apps, including Lunara and Hourmark (the "Apps"), and this website. Section 2 gives the specific details for Lunara.

1. Information we collect

  • Account information. Your name and email address. If you sign in with Google or X, we receive basic profile information from that service (typically your name, email address, and an account identifier). Passwords are stored only in hashed form.
  • Information you enter. Content you add to the Apps, such as budgets, records, and notes in Lunara, or logged hours and related entries in Hourmark.
  • Optional information. Information you choose to add for specific features, described for Lunara in Section 2.

We do not use advertising or analytics tools in Lunara, Lunara's database does not store your IP address (our host's short-lived technical logs can, as described in Section 7), and we do not collect your location. We do not ask for bank account passwords, and Lunara does not connect to your bank.

2. Lunara: what we collect and why

  • Your records. Bills, income, amounts, paid dates, accounts, balances, debts, interest rates, targets, categories, notes, reminders, and birthdays, so the app can show and sync your budget.
  • Phone number (optional). If you add a mobile number, we use it to send two-factor sign-in codes by text message and to let people you know find you when sharing.
  • Sharing contacts (optional). Names, email addresses, and phone numbers of people you save as sharing contacts or groups.
  • Photos (optional). Photos you attach to a record or debt.
  • Read with Grok (optional, Lunara Paid). When you use Read with Grok, the photo you choose is sent to xAI to read the details (such as name, amount, and date). Lunara keeps only the text that comes back. It does not keep that photo unless you separately save it on a record or debt. xAI states that it stores API requests, encrypted, for up to 30 days to check for abuse, and does not use them to train its models.
  • Calendar imports (optional). Events you import from Google Calendar, an .ics file, or pasted text.
  • Support messages (optional, Lunara Paid). Messages you send to Lunara support from the app.
  • Subscription details. If you subscribe to Lunara Paid, we store your plan and the customer and subscription identifiers from our payment processor. We never receive or store your card number.
  • Notifications (optional). If you turn on notifications, we store your device's push notification subscription so reminders can reach you.

3. How we use information

  • To provide, maintain, and secure the Apps and your account, including sign-in codes and password resets.
  • To store and sync the content you create so it is available on your devices.
  • To enable features you choose to use, such as sharing records, reminders, and Read with Grok.
  • To process Lunara Paid subscriptions.
  • To respond to support requests and send important service notices.

4. We do not sell your data

We do not sell, rent, or trade your personal information. We do not show ads, and we do not use your information for advertising.

5. How information is shared

  • Sharing you choose. In Lunara, records you share go to the people you pick, and only after they accept in their Inbox. Copies a person has accepted stay on their calendar even if you later delete your account.
  • Service providers. We use these companies to run Lunara. They process data on our behalf:
    • Neon: database hosting where your account and records are stored.
    • Vercel: hosts the app and runs its servers. Like most hosts, Vercel keeps short-lived technical logs of requests, which can include your IP address and the page requested.
    • xAI: reads photos you send with Read with Grok.
    • Twilio: sends text-message sign-in codes.
    • Resend: sends email sign-in codes and password-reset emails.
    • Stripe: processes Lunara Paid payments. Your payment details are handled under Stripe's own privacy policy.
    • Google Play: processes Lunara Paid purchases made in the Android app. We receive a purchase token and subscription status to verify your plan, never your card details. Google handles payment under its own privacy policy.
  • Third-party sign-in. If you sign in with Google or X, your use of those services is governed by their own privacy policies.
  • Legal reasons. We may disclose information if required by law or to protect the rights, safety, and security of our users or others.

6. How we protect your data

  • All data travels over encrypted connections (HTTPS) between the app, our servers, and our service providers.
  • In Lunara, record titles, amounts, notes, photos, phone numbers, debt notes, and support messages are encrypted in the database with AES-256. The database storage is also encrypted. Your account email is stored without that extra field encryption so you can sign in.
  • You can turn on two-factor sign-in (authenticator app, text message, or email code) and a 4-digit PIN that hides amounts on your device.
  • Copy on your device. So Lunara works offline, a copy of your records is kept in the app's storage on your phone. This copy is not encrypted by Lunara, so protect your phone with a screen lock. Lunara erases this copy when you sign out or delete your account.

No method of transmission or storage is completely secure, but we work to protect your data.

7. How long we keep data

We keep your information while your account is active. When you delete your account or individual items, we remove them as described in Section 8.

  • Deleted data may remain in our database backups for up to 30 days before it is automatically removed.
  • Technical server logs kept by our host, such as failed sign-in attempts and request records that can include IP addresses, are kept for no more than 30 days.
  • If we cannot reach Stripe to cancel a subscription when you delete your account, we keep a short note for up to 30 days, without your email or IP address, so we can finish the cancellation.
  • Photos sent with Read with Grok may be kept by xAI for up to 30 days, as described in Section 2.
  • Stripe keeps payment records as required by law and its own policies.

8. Your choices and deleting your data

You can view, edit, and export your Lunara data from inside the app, and delete individual records, photos, contacts, and other items at any time.

Delete your account in the app: in Lunara, open My account, choose Delete account, and type your email address to confirm.

Delete your account without the app: follow the steps on our account deletion page, or email [email protected] from the email address on your account with the subject "Delete my Lunara account" (or "Delete my Hourmark account"). We will confirm the request and complete it within 30 days.

What account deletion removes: your account and sign-in, sessions, records and record photos, debts and debt photos, goals, birthdays, categories, reminders, shares you own, records other people shared with you, your saved sharing contacts and groups, support messages, plan details, phone number, sign-in and password-reset codes, two-factor settings, and notification subscriptions.

Lunara Paid: if you subscribed on our website, deleting your account cancels your Lunara Paid subscription immediately, so you will not be billed again, and deletes your customer record at Stripe. Stripe may keep payment records as required by law. If you subscribed through Google Play, Lunara cannot cancel that subscription for you: cancel it in Google Play (Google Play subscriptions) before you delete your account. The app reminds you of this before you confirm. Google keeps its own purchase records under its privacy policy.

On your device: deleting your account (or signing out) erases the copy of your data stored on that device and turns off notifications. Your theme and text size settings stay.

What stays: records you already shared that another person accepted remain on that person's calendar. If you appear in someone else's sharing contacts, that entry is part of their account. Data in backups and logs is removed as described in Section 7.

9. Children's privacy

The Apps are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and, where appropriate, notify you in the Apps.

11. Contact us

Questions about this policy or your data? Email [email protected].