Last updated: November 3, 2026
Short version: Accounts are optional: everything in Luna works without one. An account (16 and older) keeps your achievements across devices and the systems you share together in Your Luna. People we invite can also post ideas and bug reports on our board, vote and comment; the other invited members see only the display name you choose. Your settings and saved simulations stay on your device, unless you press Share, which stores the system on screen on our server so the link can open it. Usage analytics are anonymous and cookie-free. We receive personal data only from you: what an optional account stores (your email address, the display name you choose and your account settings), what you post on the board, and what you type into an optional form on the website, such as a crash report or a newsletter sign-up. The iOS and Android apps have no accounts and no forms.
Luna is an educational space simulation built by Ali Karpuzoglu. It is available as a web app and as a mobile app on iOS and Android.
Anonymous analytics. Luna measures visits anonymously and without cookies: it counts which features are used, with nothing that identifies you. It counts every visit, also when a browser sends a Do Not Track signal. We use Umami, a privacy-focused analytics tool hosted on our own server. On the website its script and its counts normally go through the website's own address (for example luna.watermelonson.com/s/), which passes them on to that server together with your IP address, so Umami can tell visits apart and work out the country. The iOS and Android apps, and the website when that address cannot be reached, send them to that server directly. Umami:
We collect only aggregated, anonymous data: page views, browser type, screen size, country, and in-app events (e.g. which scenario was loaded, whether sound was toggled). This just helps us understand what people actually want out of the tool so we can make it better.
To see whether people come back, the website keeps two values in your browser's local storage: the day you first opened Luna there and how many times you have opened it since. When you press Play, the launch event carries only rough ranges of these two numbers (for example "3-4 visits, first seen 30-89 days ago"). No identifier is created or sent, and the ranges are shared by many visitors. The iOS and Android apps do not keep or send these values.
Some game websites show Luna's start page in a frame on their own pages. Its Start button opens Luna in a new tab with the name of that website in the address (for example luna.watermelonson.com/?from=embed&host=spacesimulator.io). Luna then counts the arrival, removes the two values from the address, and keeps the website's name in your browser's local storage, so later anonymous events can say "this browser first came from that website": a later visit, the first sign-in and the first question to the Luna chat. Inside the frame, the browser keeps a separate note that Start was pressed there, so a visit through the same website again can be counted the same way. These events carry only the website's name, no identifier.
Local storage. Luna saves your settings, tutorial progress, and simulation saves in your browser's local storage. This data stays on your device and is not transmitted to any server, apart from the rough visit ranges and the name of a website described above, the visit count a form you send carries, and the sign-in session of an account, all described below.
Share links. When you press Share, Luna uploads the system on screen (its bodies, their orbits and settings, and the system's name) and gets back a short link that opens it. Anyone who has the link can open that system. The upload goes through a Cloudflare Worker we operate, which first runs a Cloudflare Turnstile check against automated abuse, and is stored in our own Supabase database on our own server. To limit how many links one network can make, we store a one-way hash of your IP address next to the system, never the address itself. A small picture of the scene, taken when you share or save it, is stored with the link and shown when the link is posted in a chat. A shared system carries no name of the person who shared it, but any names you gave to bodies are part of it. If you are signed in when you share, the link is tied to your account so you can see how often it was opened and turn it off; deleting your account deletes those links. When someone opens a link, we count the open: to count each network once a day we keep a one-way hash of the IP address, never the address itself, in a short log whose entries older than a day are deleted the next time the log is written. No account is recorded with an open.
Optional account. On the website you can create an account, if you are 16 or older, by signing in with Google, with Apple or with a code sent to your email address. We store your email address and which sign-in method you used (kept by Supabase Auth in our own database), the display name you choose, the time you confirmed you are 16 or older, your choices in Settings > Account (beta features, newsletter, whether you use Luna for teaching) and the interface language, and your achievements and their progress so they come back on every device you sign in on. Google and Apple send your email address, and Google also your name and the address of your profile picture; Supabase Auth keeps these with your login, and Luna neither shows nor uses the name or the picture. Your email address is never shown to anyone. Your display name is public. When you choose or change it, our own Supabase server sends the name alone to OpenAI's moderation service, which checks whether it is offensive; OpenAI receives no email address and nothing else about your account. If that check cannot be reached, our server uses a short built-in word list instead. You can download everything we store about you, or delete your account, at any time in Settings > Account.
The sign-in service also keeps a log of sign-ins and sign-outs, including the IP address they came from, to protect accounts against misuse. We keep it only as long as that protection needs. Your browser keeps the sign-in session in local storage until you sign out. Apple or Google take part in signing in only if you choose them, and then tell us your email address; their own privacy policies apply to that step. Forms you send while signed in are linked to your account, except the suggestions form and the teachers form, which are always sent without it.
The board of ideas and bugs. The board is open only to accounts we invite and to the Luna team; we note on your account whether it was invited. Invited members can post feature ideas and bug reports, comment and vote. Posts and comments are shown to the other invited members with your display name. They see how many votes a post has, but nobody else can see who voted. Without an invitation, ideas and bug reports go through the private feedback forms as before. A bug report carries the app version, the platform and the interface language, and, if you choose, a share link to the scene on screen. Before anything is shown on the board, its text goes through a Cloudflare Worker we operate to OpenRouter, where a language model (Qwen) checks whether it is spam and whether it repeats an existing post; then we read it ourselves and decide whether to show it. We store the model's verdict with the post; only we can see it. New posts also go through a Cloudflare Turnstile check. If someone posts spam, we can hide their posts and stop them from posting for a while.
Forms you choose to fill in. The Luna website has a few optional forms: a crash report that is offered if Luna stops working (also open from Menu > Report a bug when you cannot see the public board), a suggestions form (Menu > Send feedback, for the same case), a short form for teachers (Learn > For teachers), and a newsletter sign-up for updates and classroom material. Where you can see the public board described above, ideas and bug reports go there instead. The iOS and Android apps contain none of these forms and send no crash reports. Each one is entirely voluntary and the app works fully without them. When you submit one, we receive what you typed. Depending on the form that can include:
The suggestions form, the teachers form and the newsletter form go straight to our own self-hosted Supabase database on our own server. To limit how often one network can send a form, the database keeps a salted one-way hash of your IP address for one day, never the address itself, and then deletes it. Crash reports travel through a Cloudflare Worker we operate and are stored in our own NocoDB database on our own server. Submissions are not sold, rented, or used for advertising, and they are not shared with anyone outside this project.
Where you heard about Luna. From your second visit to the website on, Luna may ask once where you heard about it. If you answer, our Supabase database stores your choice, the text you type (for Other, or the name of the YouTube, Instagram or TikTok channel, both optional), the app version and the interface language. The answer is stored anonymously, without your account even when you are signed in, so it is not part of your data download and stays when you delete your account. The rate limit works like the forms above.
Newsletter. The newsletter is double opt-in: after you sign up we send one confirmation mail, and your address is on the list only once you click its link. A request that is not confirmed within 7 days is deleted. Mail is sent through Brevo, which receives your email address and the mail's content for that purpose. Every mail has an unsubscribe link, and unsubscribing needs no account.
AI features. Some parts of Luna can generate content or answer questions using a large language model. If you use one of those features, the text of your prompt and the relevant scene context are sent through a Cloudflare Worker we operate to OpenRouter, which forwards it to the model provider that serves the request and returns the response. We do not attach your identity to these requests, and we do not store the conversations. The worker uses your IP address only to count requests against the daily limit. The system generator returns only a planetary system (bodies, masses and orbits); Luna assigns the names itself and shows no text written by the model. Please do not type personal information into the prompt.
Luna chat (test version). While it is being tested, the Luna chat can be used only on the website, by signed-in accounts aged 16 or older that have turned on "Try beta features". It answers questions about the scene on screen, the physics behind it and where to find things in Luna, and when you ask it to, it can move the camera, run or pause time and change the mass of a body. A change happens only after you press Apply, and you can undo it. When you send a message, Luna sends it to our own Supabase server together with a description of the scene on screen (the names, types, masses, sizes and orbits of its bodies, the simulated date and speed, the selected body, and the most recent lines of the Scene log with their impact and tidal records). Our server checks that you are signed in and passes your message, the earlier messages of that conversation, the scene and the results of the look-ups the chat makes in it to LiteLLM, a relay we run ourselves on our own server, which forwards them to the API of Anthropic PBC in the United States. There Claude, Anthropic's language model, writes the answer. Anthropic states that it does not use data sent through its API to train its models. LiteLLM and Anthropic receive your messages and the scene, but no email address, no account ID and nothing else about your account. Each account can send a limited number of messages to Claude per day. When Claude does not answer, or that day's Claude messages are used up, the same content goes instead to a language model (Qwen), which can run in two places:
When you tap one of the suggested first questions in an empty chat, Luna may answer it with a written answer stored in Luna; then no language model is asked.
Luna chat without an account. Without an account (or with "Try beta features" turned off) you can open the chat and tap its suggested first questions. Luna then sends the question and the description of the scene to our own Supabase server, which answers with the written answer stored in Luna; no language model is asked. To limit how many of these answers one visitor can get, our database keeps a one-way code made from your IP address with a secret key (not the address itself) for one day. When there is no written answer that fits your scene, the chat does not answer the question. To ask questions of your own you need an account. While we allow it, someone who is not signed in can also ask a few questions of their own each day. Then Luna signs your browser in to our Supabase server as an anonymous user: a random ID with no email address or name, kept in your browser's storage. Before the first such question your browser passes Cloudflare Turnstile, a check that you are a person, and our server asks Cloudflare whether the check went through. These questions then take the same way as an account's (LiteLLM to Anthropic, or Qwen) and are stored the same way as described below, with the anonymous ID in place of an account ID. Our database also records the time of each such question and of each answer the language model writes for it, with the anonymous ID, for two days, to limit how many questions one visitor and all visitors together can ask, and when the anonymous ID passed the check. Answers to the suggested first questions without any sign-in are stored without an ID. An anonymous ID that never passed the check is deleted after a day; any other is deleted, together with its chats, 30 days after its last message. To have chats without an account deleted sooner, write to us at the address at the end of this page.
What we store from the Luna chat, and why. Chats are saved, and the chat says so before your first message is sent. They are saved so that Ali, who builds Luna, can see where the chat answers wrongly or slowly and improve it. For every message our database stores your account ID (not your email address), which conversation it belongs to, your message, the answer, the look-ups and actions the chat made or proposed and whether you applied them, a short description of the scene (the scenario, the number of bodies, the selected body, the simulated date and speed), the app language, the time, how long the answer took, how much text the model processed, and any error. Only Luna's administrators can read these records (today that is Ali alone). They are kept for 12 months and then deleted. When you delete your account, they are deleted at once, and until then they are part of the data you can download in Settings > Account. To have your saved chats deleted without deleting your account, write to us at the address at the end of this page. To continue a conversation, our server also keeps its current state (the recent messages and a change waiting for your Apply) for one day; New chat in the chat deletes it sooner. To limit how many messages one account can send, our database records the time of each message with your account and deletes that record after one day. Names you give to bodies are part of the scene and are sent and stored too, so please do not put personal information into messages or names. If a message gets no answer because of a connection problem, the chat records that in the same place (the error and the message, with your account ID), so Ali can find the problem. Feedback you send with the chat's Feedback button is stored with your account ID, the conversation it is about and its latest answer, the app version, language and browser, so Ali can read it next to the chat; it is kept like the other form messages and deleted with your account. If you rate an answer with the thumbs (Good answer, Bad answer), the rating is stored with that answer and your account ID, kept and deleted like the answer, and part of your data download; what you write under "What went wrong?" after a thumbs-down is stored like Feedback, linked to that answer. When the chat cannot do something you asked for, it may show a button under its answer, "Send this to Ali so Luna learns it". Only if you tap it, that request (your words, what the chat offered instead and the short description of the scene stored with the answer) is stored with your account ID, so Ali can see what people want Luna to do; it is kept and deleted like the answer and is part of your data download. If you connect an AI agent of your own to Luna's AI services with your sign-in token, that agent and the AI service it uses receive what Luna sends back and anything you give them; Luna has no control over them.
Chat traces. To find answers that are slow or wrong, our server also sends a record of each chat message to Langfuse, a tool for inspecting AI answers that we run ourselves on our own server at Hetzner. Langfuse keeps a copy of each record in Cloudflare R2, a file storage service, in the European Union. A record holds the time each step took, how much text the model processed, which model answered, the look-ups and actions the chat made, any error, and, while we use the full setting, also your message, the answer, the earlier messages and the scene description the model saw, and the results of its look-ups. We can switch it to numbers only, so that no text is sent. A thumbs up or down you give an answer is added to that answer's record, with your "What went wrong?" text while we use the full setting. Your account and the conversation appear there only as a one-way code made with a secret key; Langfuse receives no account ID, email address or name. Only Luna's administrators can read these records (today that is Ali alone). Langfuse keeps each record for 90 days and then deletes it, together with its copy in Cloudflare R2. New chat in the chat deletes the records of the conversation it ends, and deleting your account deletes all of yours, both within about an hour. Until then they are part of the data you can download in Settings > Account.
Talking to the Luna chat. The chat has a microphone button and a switch to read replies aloud; both are off until you use them. When you record a question, your browser asks for the microphone, records until you let go or tap again (at most one minute), and sends the recording to our own Supabase server, which checks that you are signed in and passes it to a speech recognition model (Whisper) on Luna's own computers. While you speak, the recording so far is sent again about once a second, so your words appear in the chat's input as you say them. When you let go of the button or stop talking, the text is sent, or it stays in the input to be corrected if you turned off "Send after speaking". Only while that speech recognition on Luna's computers cannot be reached, Luna uses your browser's own speech recognition instead (the chat says so while it listens): Chrome sends the audio to Google and Safari to Apple for that. When replies are read aloud, English replies are sent the same way, a sentence or two at a time, to a speech model (Kokoro) on the same computers, and the audio comes back to your browser. German and other replies, and English ones when that model cannot answer, are read by your browser's own voice: Luna picks a voice that runs on your device where the browser has one, but some browsers' online voices send the text to the browser's maker. The recordings and the audio are not stored. For each recording or piece read aloud our database stores your account ID, whether it was a recording or speech, its size, the length of the text, the language, the time it took and any error, but no audio and no text, for 12 months (deleted with your account and part of your data download), and the time of each one for one day, to limit how much one account can use.
Purchases. On iOS and Android, Luna is a paid app. Apple and Google handle the purchase and the payment details; we receive no payment information and no card data at any point. There are no in-app purchases.
Beyond what you type into an optional form yourself, Luna never asks for or receives:
We do not use advertising SDKs, social media trackers, or any other third-party analytics.
Luna is designed to be educational. Using it requires no account and no personal data entry. Accounts are for people aged 16 and older: sign-up asks first, and someone who answers no gets no account, and the iOS and Android apps contain no forms, so they never ask for an email address. The optional forms on the website are the only place an email address can be entered, and they are intended for adults. We do not knowingly collect personal information from children under 16. If you believe a child has sent us their email address, contact us at the address below and we will delete it.
Anonymous analytics data is retained on our self-hosted Umami instance. Form submissions are retained in our own database until we no longer need them, until you ask us to delete them, or, for those sent while signed in and linked to your account, until you delete your account. The IP hashes the forms and the Luna chat's suggested first questions use for rate limiting, and the Luna chat's records of when an account sent a message and of an open conversation, are deleted after one day, and unconfirmed newsletter sign-ups after 7 days. Luna chat messages are kept for 12 months, their records in Langfuse (the chat traces) for 90 days. Shared systems are kept so their links keep working, until we remove one, you ask us to remove yours (send us the link), or you delete it yourself in Your Luna while signed in. Your account is kept until you delete it. When you delete it, your login, profile, votes, settings and Luna chat messages are deleted at once, and the chat traces in Langfuse within about an hour; your board posts and comments stay, shown as "Deleted user"; systems you shared stay online without your name unless you tick the box to delete them too. Local storage data persists on your device until you clear your browser data or uninstall the app. We do not have access to your local storage data.
With an account you can download all your data and delete your account yourself in Settings > Account, and change the newsletter there or with the link in every newsletter mail. If you have sent us a form submission or made a share link, you can ask us for a copy of it or ask us to delete it, and you can unsubscribe from the newsletter at any time. Write to the address below and we will act on it. Under the GDPR you also have the right to object to processing and to complain to your local data protection authority. Everything else Luna stores is on your own device: clearing your browser's local storage removes all locally stored preferences and saves.
If we make changes to this policy, we will update the date at the top. Significant changes will be noted in the app's changelog.
If you have questions about this privacy policy, you can reach us at:
The rules for using Luna are in the Terms of Service (Nutzungsbedingungen).
Anbieterkennzeichnung nach deutschem Recht: Impressum