Privacy Policy

Last updated: 30 September 2026

This says what LunaGramm stores, why, for how long, and how to get it back or get rid of it. It describes what the software actually does.

Questions, or to exercise any right below: support@lunagramm.site — or, faster, the LunaGramm Discord server (discord.gg/KBcHQhDHGf) or @LunaGramm inside LunaGramm

The short version

• No adverts, no trackers, no analytics, nothing sold to anyone
• No email address or phone number is asked for
• Your IP address is not recorded. The server does not keep access logs of who connected
• Ordinary messages are not end-to-end encrypted. They are stored as plain text on the server, so whoever runs it could technically read them
• Secret chats are. A secret chat is encrypted on the machine that sends it and decrypted on the machine that receives it. The server holds bytes it cannot read, and neither can we
• Pictures and videos are checked on the server before they are sent, and explicit ones are refused. See "Reading your messages"
• Calls are end-to-end encrypted, always. The server relays them without being able to hear or see them. See "Calls"
• You can download everything, or delete everything, from Settings

What is stored

Because you typed it:

• Username, display name, and any bio, emoji status or birthday you add
• A birthday is a day and a month only. No year is asked for or stored
• Your profile picture, if you set one
• Your password, as a bcrypt hash. The password itself is never stored and cannot be recovered from the hash

Because it is a messenger:

• Messages you send, and any photo, video, file or voice message attached
• A line in the chat for each call: who called whom, when, whether it was a video call, how it ended and how long it lasted. It is an ordinary message and is deleted the same ways
• Which chats, groups and channels you are in
• Who you have blocked, who you have messaged, and anyone you have marked trusted
• Read receipts, typing, and online status, if you leave those on. Turning them off in Privacy and Security stops them being shown
• View counts on channel posts, as a number only. Which post you looked at is not stored against your name
• Your Moons balance and the ledger behind it

Because of how sign-in works:

• A random installation id, generated on your machine, used only to keep one account per installation. It is not tied to your hardware and does not follow you anywhere
• The public half of this installation's encryption key, once you have used a secret chat. It is public by nature: it is what other people encrypt to. The private half stays on your machine and cannot be exported
• For each device signed in: the name your computer calls itself, its operating system, when the session started and when it was last used. This is shown only to you, in Settings
• A message from @LunaGrammBot each time someone signs in to your account, naming the device and the time, so you find out if it was not you

If you link your Discord account (Settings, My Account - it is optional):

• Your Discord account id and name, whether you boost the LunaGramm Discord server, whether you wear its LUNA tag, and when that was last checked
• The keys Discord gives LunaGramm to check those two things again once a day. They allow reading who you are on Discord and your membership of the LunaGramm server, nothing else - no messages, no friends, no other servers. Disconnecting deletes all of it here and asks Discord to cancel the keys. Discord's own privacy policy covers what Discord keeps

What is not stored:

• Your IP address. Not in a log, not against your account, not anywhere. Rate limits count addresses in memory for a few minutes and then forget them
• Which country you connect from. Each connection's address is checked against the address ranges of the countries LunaGramm is not offered in (see the Terms). The check happens in memory while the request is answered, and neither the address nor the answer is kept. The ranges come from DB-IP's free country database (IP Geolocation by DB-IP, db-ip.com, CC BY 4.0) and are built into the server: your address is not sent to DB-IP or anyone else
• Your email, phone number, real name, or location
• A proxy you set. It is saved on your computer only, and never sent to the server
• Your contacts or address book. LunaGramm never reads them
• Anything from analytics, advertising or tracking services. There are none

Reading your messages

There are two kinds of conversation, and they are different in the way that matters.

Ordinary chats are stored as plain text in a database on one server. They are not end-to-end encrypted, which means whoever runs the server is technically able to read them. The commitment is that they do not, with one exception: a message that has been reported is read by moderators, because that is the only way a report can be acted on.

Pictures and videos are checked automatically before they are sent. This is LGAC - LunaGramm Anti Cheat. When you send a picture or a video in an ordinary chat, the server runs it through an image classifier on the server itself - nothing is sent to any other company - and refuses it if it looks sexually explicit. For a video, eight frames spread through it are checked.

• A picture that passes is stored and sent as normal. Nothing about the check is kept
• A picture that is refused is not stored and not sent. The moderators and the owner are told who sent it and when, what the classifier thought it was, and are shown a copy blurred until only shapes and colours are left. That blurred copy is the only thing kept
• The classifier is wrong about one picture in a dozen or so, in both directions. If an ordinary picture of yours is refused, that is why. A refusal on its own does nothing to your account; the moderators look at the blurred copy and decide whether anything needs doing
• Secret chats are not checked. The server cannot see into them

Secret chats are encrypted on your machine and decrypted on theirs. The key is made on your computer and never leaves it - it is generated in a form the operating system will not hand back, so there is no way to upload it even by mistake. The server stores and forwards bytes it cannot open.

Three things about secret chats that are true and worth knowing before you rely on them:

• They live on one machine. Sign in on another computer and the secret chats will not be there, because the key is not. Lose the machine and those messages are gone. There is no recovery, by design
• There is no forward secrecy. The key does not change as you talk, so somebody who later takes one of the two machines can read that machine's old secret messages. A "double ratchet", as Signal uses, is what fixes this and it is not built here
• Check the safety number. The server is what hands out public keys, so a dishonest server could hand over one of its own and sit in the middle. Each secret chat shows a safety number computed from both real keys; if yours and theirs match, nothing is in between. Compare it somewhere other than LunaGramm

Files, pictures and voice messages are not encrypted yet, so a secret chat takes text only.

Calls

Calls are one to one, voice or video, and they are always encrypted end to end. There is no setting that turns it off.

• Each call gets fresh keys, made on the two computers for that call only. They are never sent to the server and are gone when the call ends
• Every piece of sound and picture is encrypted by the app before it leaves your computer, on top of the encryption every WebRTC call already has, and can only be decrypted by the other person's app
• The call screen shows a code. Both apps work it out from both call keys; if the two of you read out the same digits, nothing is listening in between. Compare it by voice on the call itself - a server in the middle cannot make the two screens agree
• Every call goes through a relay on the LunaGramm server, so neither person learns the other's IP address. The relay passes on encrypted packets it has no key for. It needs your IP address while the call is running, to send the packets back to you, and keeps it in memory for that long only - it writes no log
• The relay logins the app uses expire after a few hours and name only your account

Who can call you is in Settings, Privacy and Security: everyone, or nobody. People you have blocked can never call you - and to them, a call to you simply goes unanswered, the same way a message to you simply goes unread.

Nothing about a call is kept apart from its line in the chat. Calls are not recorded, and could not be: the server never has the sound or the picture.

Reporting from a secret chat

A report carries the messages your own app attaches to it, decrypted by your app at the moment you report. The server never goes and reads the conversation - it cannot for a secret chat, and it does not for an ordinary one either. Moderators see the lines that were handed in and nothing else, and each line is marked with whether the server's own copy agrees with it.

Who else sees it

Nobody. Data is not sold, rented, or shared with advertisers, analytics providers or anyone else.

These are unavoidably involved in running the service:

• The hosting provider, whose machine the server runs on, in Italy, inside the EU. They hold the disk; they are not given access to the data
• Let's Encrypt, which issues the certificate that encrypts the connection. They see the domain name, nothing else
• Cloudflare, in the six places listed below

Where Cloudflare comes in (its own privacy policy is at cloudflare.com/privacypolicy):

• The website. lunagramm.site is hosted on Cloudflare Pages. Visiting it means Cloudflare handles the request, including your IP address, the way any web host does, and may use it to block attacks. Cloudflare's Web Analytics is not switched on, and the site has no scripts, cookies or trackers of its own
• Downloads. The app is downloaded from downloads.lunagramm.site, which is Cloudflare R2, with the same request data
• DNS. Cloudflare answers lookups for the domain. The chat server's main address, chat.lunagramm.site, is not behind Cloudflare: through it, messages and calls go straight to the server in Italy
• The backup address. Where the main address is blocked, the app can reach the same server through edge.lunagramm.site, which runs through Cloudflare's network. Only then, Cloudflare carries that connection: it sees your IP address, and, because Cloudflare opens the encryption at its edge and re-encrypts it to the server, could technically see ordinary messages passing through. Secret chats stay end-to-end encrypted. Calls always go straight to the call relay, never through Cloudflare
• Backups. A copy of the daily backup is kept in Cloudflare R2, encrypted on the server before it is sent. Cloudflare holds bytes it cannot read, and the copies are deleted after 30 days like the others
• Uptime. Every few minutes a check run on Cloudflare asks the server for its health page, to notice when it is down. It carries nobody's data

Data may be disclosed if the law requires it, or to prevent serious harm.

How long it is kept

• Messages: until you delete them, or until a chat's disappearing timer removes them. There is no automatic expiry otherwise. A secret chat's messages are kept the same way, as bytes nobody on this side can read
• Backups: one copy of the database a day, the most recent 30 kept, older ones deleted - on the server, and an encrypted copy in Cloudflare R2. A message you delete can survive in a backup for up to 30 days
• Calls: the line in the chat is kept like any message. Nothing else is
• Your account: until you delete it
• Frozen accounts: deleted with everything in them 30 days after freezing
• Reports: kept while the account exists, so repeat behaviour can be seen
• Your username: released immediately when you delete your account. If you merely change it, it is held for 30 days so nobody can pick it up and be mistaken for you in old chats

Your rights

Under the GDPR you can see your data, correct it, take it elsewhere, have it deleted, and object to how it is used. In LunaGramm:

• See it and take it: Settings → My Account → Download my data. One JSON file with your profile, your messages, your uploads and your Moons ledger. Messages other people sent are not included; those are their data, not yours
• Correct it: the pencil on your profile changes your name, username, bio and birthday
• Delete it: Settings → My Account → Delete my account. Your account, messages, uploads and pictures are removed at once, from the database and from the disk. It cannot be undone
• Anything else: write to support@lunagramm.site — or, faster, the LunaGramm Discord server (discord.gg/KBcHQhDHGf) or @LunaGramm inside LunaGramm

Deletion has two limits worth stating. A message you sent to somebody else stays in the copy delivered to them, the same way a letter you posted is theirs. And something deleted today can still sit inside a backup taken yesterday for up to thirty days, until that copy is deleted with the rest of them - backups are for recovering from a dead disk and are never used to undo a deletion. What is removed straight away is everything held on the running server under your account.

If you think your data is being mishandled, you can complain to your national data protection authority. In Cyprus that is the Office of the Commissioner for Personal Data Protection.

Keeping it safe

• Connections use HTTPS and WSS. The app refuses to send a password or a session token to anything but an encrypted connection
• Passwords are hashed with bcrypt at cost 12
• Every sign-in is a session you can end from Settings, on any device
• Repeated wrong passwords slow the machine guessing them down, not your account
• Uploaded files are identified by their own bytes, not by what they claim to be, and are served so a browser can never run one as a web page

No system is perfectly secure, and this one is a small project rather than audited commercial software. Weigh that before trusting it with something sensitive.

Children

LunaGramm is for people aged 14 and over. It is not designed or marketed for children, and no account is knowingly kept for anyone younger. If you believe a child has an account, write to support@lunagramm.site — or, faster, the LunaGramm Discord server (discord.gg/KBcHQhDHGf) or @LunaGramm inside LunaGramm and it will be removed.

Changes

If what is collected or how long it is kept changes, this page changes with it and the date at the top moves. Material changes are announced in the app before they take effect.