Effective date: 13 October 2026 · Version: 1.1
1. Scope and definitions
1.1. This Privacy Policy (the "Policy") describes how personal data is processed through the Luluna mobile application (the "App") and the luluna.app website (the "Site"). It is provided in accordance with Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Data Protection Act 2018, the Turkish Personal Data Protection Law No. 6698 ("KVKK") and applicable US state privacy laws.
1.2. In this Policy:
- "User" or "you" means the parent or caregiver who uses the App;
- "Baby" means the child whose information the User enters in the App;
- "Health-related records" means records of sleep, feeding, nappies/diapers, length and weight, stool colour and consistency, medicines, vaccinations and reminders;
- "Account" means the anonymous user account the App creates on first launch, which contains no name, e-mail address or telephone number.
2. Controller
2.1. The controller responsible for your personal data is:
Onur Coşkun
Yakut Mah. 3851. Sk. No: 8 Kat: 3 Daire: 15, 38000 Kocasinan / Kayseri, Türkiye
E-mail: support@luluna.app
2.2. The App is published by the controller as an individual, not by a company. No data protection officer has been appointed. All requests concerning personal data may be sent to the contact details above. Legal notice: luluna.app/impressum
3. Personal data we process, purposes and legal bases
3.1. We process the following categories of personal data for the purposes and on the legal bases set out below:
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Baby profile | Name, date of birth, sex (optional), country, unit preferences | Showing age-appropriate content, the correct national vaccination schedule and units | Performance of a contract (GDPR Art. 6(1)(b)) |
| Health-related records | Sleep, feeding, nappies/diapers, length and weight, stool colour and consistency notes, medicines, vaccinations and reminders | Providing the App's core tracking, summary and reminder features | Explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6) |
| Account data | Anonymous Firebase user ID; date and version of the consent given | Keeping records in the User's Account, synchronisation and proof of consent | Performance of a contract and legal obligation (GDPR Art. 6(1)(b) and (c)) |
| Usage statistics | Features used (e.g. "feeding logged", "article opened"), App version, country code | Improving the App | Consent (GDPR Art. 6(1)(a)); not processed unless switched on by the User |
| Crash reports | Device model, operating system version, error log | Detecting and fixing errors | In the EU, EEA, UK and Switzerland: consent (GDPR Art. 6(1)(a)), off by default. Elsewhere: legitimate interests (GDPR Art. 6(1)(f)), can be switched off at any time |
| Support correspondence | E-mail address and content of the message | Responding to requests | Performance of a contract and legitimate interests (GDPR Art. 6(1)(b) and (f)) |
| Subscription data (once Premium is offered) | Google Play purchase token (stored as an irreversible hash), product, subscription status and expiry date | Verifying the subscription and assigning it to the Account | Performance of a contract (GDPR Art. 6(1)(b)) |
3.2. Usage statistics and crash reports never include the Baby's name, health-related records, dates or any text written by the User.
3.3. Data processed on the device only. The Baby's profile photo and stool comparison photos are stored only on the User's device. They are not transmitted to the controller or any third party, are not subject to any automated analysis and are excluded from device backups. Comparison photos are deleted automatically 60 days after they are taken or when the related record is deleted. Sleep sounds, notifications and App settings are also processed on the device.
3.4. AI-supported features. AI-supported features are not active in the current version of the App. If they are introduced, Users will be informed before first use of the service provider and country to which data would be transferred, separate consent will be requested where required, and this Policy will be updated.
3.5. Personal data is not sold, rented or used for advertising or marketing, and no profiles are created for those purposes. The App contains no advertising.
4. How we collect personal data
Personal data is collected electronically and by automated means: from information the User enters in the App; through the Firebase Analytics and Firebase Crashlytics software development kits where enabled; through the Google Play billing system; and through e-mail correspondence. The User's IP address and device information may be processed temporarily by the service providers listed below in order to establish a technical connection.
5. Recipients
5.1. Personal data is shared, solely for the purposes in section 3, with the following service providers acting as processors (GDPR Art. 28):
| Recipient | Service | Location |
|---|---|---|
| Google Ireland Limited and its affiliate Google LLC | Firebase Authentication, Cloud Firestore (storage of records) | Frankfurt, Germany (europe-west3) |
| Google Ireland Limited and its affiliate Google LLC | Cloud Functions (subscription verification) | United States (us-central1) |
| Google Ireland Limited and its affiliate Google LLC | Firebase Analytics, Firebase Crashlytics (only if enabled) | Google's global infrastructure, including the United States |
5.2. Payments for a Premium subscription are handled by Google Play. Your payment and billing details are not shared with the controller; Google acts as an independent controller for that data under its own privacy policy.
5.3. Personal data may otherwise be disclosed only where required by applicable law in response to a lawful request by a competent public authority, and only to the extent required.
6. International transfers
Where personal data is transferred outside the European Economic Area or the United Kingdom, Google relies on its certification under the EU–US Data Privacy Framework (and the UK Extension) and/or the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) (GDPR Art. 45 and 46). Transfers from Türkiye are carried out in accordance with Article 9 of KVKK.
7. Retention
| Data | Retention period |
|---|---|
| Baby profile and health-related records | Until deleted by the User |
| Account data and consent record | Until the Account is deleted; as long as needed to prove consent |
| Usage statistics | 2 months |
| Crash reports | Up to 90 days |
| Support correspondence | As long as needed to resolve the request and any related dispute |
| Subscription data | For the duration of the subscription and as long as needed afterwards for any related dispute |
| Photos on the device | As set out in section 3.3 |
7.1. Using Profile → Delete my data in the App immediately deletes the Account document, all records, reminders, the photos on the device and the App settings, and resets the analytics identifier on the device.
7.2. Because the Account is anonymous, uninstalling the App does not delete records stored in the cloud, and a new installation cannot access earlier records. We therefore recommend using "Delete my data" before uninstalling. Deletion can also be requested by e-mail to support@luluna.app; see luluna.app/delete.
8. Consent and your choices
8.1. Explicit consent for health-related records is requested on first launch in a separate step; no record is stored before consent is given. If this Policy changes materially, consent is requested again before the App can be used further.
8.2. Consent may be withdrawn at any time. Because health-related records are the core of the App, consent is withdrawn by using "Delete my data". Withdrawal does not affect the lawfulness of processing carried out before it.
8.3. Usage statistics and crash reports can be switched on or off at any time under Profile → Support and privacy.
9. Your rights
9.1. Under the GDPR and the UK GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 21), and the right to withdraw consent at any time.
9.2. Users in Türkiye have the rights set out in Article 11 of KVKK.
9.3. US residents. Depending on your state of residence, you may have the right to know, access, correct and delete personal data and to opt out of its sale, targeted advertising and profiling. We do not sell personal data, do not use it for targeted advertising and do not engage in such profiling. Some records may qualify as "consumer health data" under laws such as Washington's My Health My Data Act, Nevada SB 370 and Connecticut's data privacy law; our separate Consumer Health Data Privacy Policy is available at luluna.app/consumer-health-data. You may appeal a decision on your request by replying to our response.
9.4. How to exercise your rights. Send your request to support@luluna.app. Because Accounts are anonymous, we may ask for information that allows the request to be matched to the correct Account. We respond within one month (extendable where permitted by law), free of charge.
9.5. Complaints. You may lodge a complaint with a supervisory authority, in particular in the country where you live: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Germany, the data protection authority of your federal state; in Türkiye, the Personal Data Protection Authority (kvkk.gov.tr).
10. Automated decision-making
No decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect the User are made (GDPR Art. 22). Calculations shown in the App, such as the sleep window, are general information based only on the User's own records.
11. Children
The App is intended for adults (parents and caregivers) and is not directed at children. Information about the Baby is entered by a User who has parental responsibility for or care of the Baby, and the User confirms that they are entitled to enter it.
12. Security
The controller takes appropriate technical and organisational measures (GDPR Art. 32). Data is encrypted in transit (TLS) and encrypted at rest on Google's infrastructure. Server-side access rules ensure that each Account can access only its own data. Subscription status can be written only on the server. The Baby's photos never leave the device. In the event of a personal data breach, the competent authorities and affected Users will be notified within the time limits required by law.
13. The luluna.app website
13.1. No account is needed to read the Site. Google Analytics is loaded only if you allow analytics cookies in the Site's cookie panel. In that case, page visits, the number of search results and clicks on app store links are measured; search and question text, article identifiers and URL query parameters are not added to analytics data. Advertising personalisation is switched off. You can withdraw your permission at any time through "Analytics preferences" at the bottom of the Site; withdrawal does not automatically delete data already sent.
13.2. Questions typed into "Ask Luluna" on the Site are processed on the Site's server only to match them with published guides. They are not sent to an external AI service and are not stored as a chat history. Please do not enter names, addresses, telephone numbers, identification numbers or information that could directly identify your child.
13.3. The Site uses the cookieless visit counter of its host, Vercel (Vercel Web Analytics). It does not place cookies or similar records on your device; it only shows aggregate counts such as which page was opened, the referring site, country and device type. It does not recognise visitors across days and does not build personal profiles. We use it to see which guides are useful (legitimate interest).
14. Changes to this Policy
This Policy may be updated to reflect changes in law or in how the App works. The current version is always available at luluna.app/privacy. Section 8.1 applies to material changes.
| Version | Date | Change |
|---|---|---|
| 1.0 | 11 October 2026 | First publication |
| 1.1 | 13 October 2026 | Restructured; recipients, subscription data, US rights and website sections added |
15. Contact
For any questions about this Policy: support@luluna.app