Privacy Policy

Last Updated: 08/27/2026 Effective Date: 08/27/2026 Previous Version: 06/08/2026

1. Introduction

Lunabeam ("we," "us," or "our"), based in California, is committed to protecting your privacy. We provide a digital coaching and goal-setting platform designed to support independent living. We understand that our users trust us with personal details about their lives, challenges, and growth. We take that trust seriously.

This Privacy Policy describes how we collect, use, and share your personal information when you use our mobile application and website. It is designed to comply with applicable privacy laws, including the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), comparable state privacy laws described in Section 9, and, where we process student education records on behalf of educational institutions, the Family Educational Rights and Privacy Act (FERPA).

2. Information We Collect

We collect information that identifies, relates to, describes, or could be linked to you ("Personal Information").

A. Information You Provide to Us

Category	Examples of Data We Collect
Identifiers	Full name, email address, and account credentials.
Protected Classifications	Date of Birth.
Sensitive Personal Information	Information regarding personal challenges (e.g., anxiety, motivation, physical limitations) that you voluntarily input into your "Goal Challenges," "Journals," or "Playbooks."
User Content	Goals, tasks, notes, and confidence ratings you enter into the app.

Note on Date of Birth: We collect date of birth to confirm you meet the age requirement for the account type you are creating, and to set the age range used to make coaching content developmentally appropriate. We do not use date of birth for profiling, advertising, or any other inference about you.

B. Information We Collect Automatically

Category	Examples of Data We Collect
Internet Activity	App usage logs, interaction with features (e.g., "Session Completed"), and crash reports.
Device Data	IP address (processed but not stored for tracking), device model, and operating system.

Note on Analytics: We use privacy-centric tools (PostHog) to understand how our app is used. We have configured these tools to avoid collecting unnecessary personal identifiers and strictly prohibit cross-site tracking.

3. How We Use Your Information

We use your Personal Information for the following business purposes:

Service Delivery: To create your account, generate your "Playbook," and track your progress.
AI-Powered Coaching: We use Artificial Intelligence (AI) technologies to process the goals and challenges you enter to generate personalized steps and advice.
Safety & Compliance: To verify your age and ensure the safety of our platform.
Internal Improvement: To fix bugs (via Sentry) and understand which features are most helpful (via PostHog).
Communication: To send you service-related notifications (e.g., "Schedule Updated") via Resend.

A. Information You Choose to Share About Your Challenges

The Service asks you to describe the challenges you want help with. You choose what to share, and you may leave these fields empty. Under California and comparable state laws this may be treated as Sensitive Personal Information.

We use it for one purpose: delivering the coaching and planning features you asked for. Specifically:

We do not use it to diagnose, screen for, infer, establish, or record any disability, impairment, or medical or psychological condition.
We do not use it to make or support any determination about your eligibility for an accommodation, academic adjustment, or auxiliary aid.
We do not use it for advertising, for profiling, or to train AI models.
We do not sell it, and we do not share it for cross-context behavioral advertising.
If you use Lunabeam through your school, this information forms part of the record your school holds. Authorized staff at your school can see it on the same basis as your other information in the Service, and only as your school directs.
You may delete it at any time in your privacy settings.

These commitments are also binding contractual terms. See Section 3 of our Terms of Service.

B. How AI Processing Works

To generate your coaching content, the Service sends the following to our AI service providers (see Section 4) through secure server-side gateways:

the text you provide, and the goal, task, or conversation in context;
your first name, so that responses can address you by name; and
an age range derived from your date of birth, so that responses match your developmental stage.

We do not send your email address, your account credentials, or your exact date of birth to AI providers. Provider credentials are held server-side and are never exposed to your browser. Text drawn from external sources, such as campus web pages, is fenced and labeled as untrusted before it reaches a model, so that it cannot issue instructions to the system.

AI providers process your content only to return a result to you and are bound by confidentiality terms and by contractual no-training terms.
Lunabeam does not use your content to train or improve AI models, and will not do so without your separate, explicit opt-in.
AI output is generated text. It is not a clinical, diagnostic, or evaluative finding, and it is not a determination about you or about your access to any accommodation.

4. Selling and Sharing of Personal Information

We do not sell your Personal Information.

We do not share your Personal Information for cross-context behavioral advertising. We do not use "pixels" from advertising networks (such as Facebook or Google Ads) that track you across other websites.

Service Providers (Subprocessors)

We disclose data to the following trusted service providers, who process data on our behalf under written agreements requiring confidentiality, appropriate security measures, and use limited to providing services to Lunabeam. Each AI provider is contractually prohibited from using Lunabeam data to train or improve its models.

Subprocessor	Purpose	Data Categories
Supabase / Amazon Web Services	Cloud hosting and database	All Service data
Vercel	Application delivery	Request metadata, IP address
Anthropic	AI coaching content	Goals, tasks, user-provided text, first name, age range
Google	AI coaching content	Goals, tasks, user-provided text, first name, age range
OpenAI	AI coaching content	Goals, tasks, user-provided text, first name, age range
PostHog	Product analytics	Usage events, device data
Sentry	Error monitoring	Error traces, device data
Resend	Transactional email	Name, email address

Lunabeam is hosted in the United States. We maintain a current list of subprocessors and will give institutional customers at least thirty (30) days' advance notice before engaging a new subprocessor that processes institutional data, with a right to object as set out in Section 9.2 of our Terms of Service.

5. Children's and Minors' Privacy

Lunabeam is a postsecondary transition and coaching service. Protecting the privacy of minors is a priority.

Age Requirement: The Service is not directed to and is not offered to children under 13. We do not knowingly collect Personal Information from a child under 13.
Age Gating: We collect date of birth during sign-up to confirm the age requirement is met.
If We Learn Otherwise: If we learn that we have collected Personal Information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with Personal Information, contact us at support@lunabeam.app and we will remove it.
Users Aged 13 to 17: Minors aged 13 to 17 may use the Service only through an account created and managed by a parent or legal guardian, or under an agreement with an educational institution that permits it.
No Third-Party Sharing: We strictly do not share the personal information of minors with third parties for marketing or advertising purposes.
Parental Rights: A parent or guardian managing a minor's account may review or delete that minor's data, or close the account, at any time by contacting us at support@lunabeam.app.

6. Educational Institutions and Student Records (FERPA)

When Lunabeam is provided to you by a college, university, or postsecondary program, the relationship differs from individual sign-up.

Roles. Your institution is the data controller for the student education records processed in Lunabeam. Lunabeam acts as a service provider and "School Official" with a "legitimate educational interest" in those records, as those terms are used in the Family Educational Rights and Privacy Act (FERPA) at 34 CFR § 99.31(a)(1). Lunabeam performs a service the institution would otherwise use its own employees to perform, remains under the direct control of the institution as to the use and maintenance of education records, and uses those records only for the purpose for which disclosure was made.

What we treat as an education record. Within the Service this includes a student's identifiers, enrollment and course information supplied by the institution, goals, tasks, plans, notes, check-ins, and coordinator observations.

Use. We do not use student education records for any purpose other than providing the service to your institution. We do not use them to train or improve AI models.

Re-disclosure. We do not re-disclose personally identifiable information from education records except (i) to the subprocessors listed in Section 4, bound by written terms at least as protective as these; (ii) as your institution directs in writing; or (iii) as required by law, in which case we will notify your institution before disclosure unless we are legally prohibited from doing so.

Directory information. Lunabeam does not designate, publish, or treat any student information as directory information.

Your rights. Your rights to inspect, review, correct, or control disclosure of your education records are exercised through your institution, in accordance with FERPA and your institution's policies. Contact your institution; we will support it in responding. You may also contact us directly at support@lunabeam.app and we will route your request to your institution and confirm to you that we have done so.

Return and destruction. On termination, we return or destroy education records as your institution directs, on the timeline set in the data protection addendum signed with that institution.

Specific commitments. The security and operational commitments Lunabeam makes to each institution, including access logging, incident notification, subprocessor terms, and return or deletion of data, are set out in Section 13 of our Terms of Service and in the data protection addendum signed with that institution.

Where you use Lunabeam as an individual consumer (not through an institution), the rest of this Privacy Policy applies.

7. Data Security

A. Controls in Place Today

The following are implemented in the Lunabeam production environment:

Encryption in transit: TLS 1.2 or higher for all connections to the Service.
Encryption at rest: AES-256 encryption of the production database and backups, provided by our cloud infrastructure providers.
Row-level authorization: Row-level security is enabled and enforced at the database layer on every application table in the production database, so access is evaluated per row rather than per query.
Institution-level data isolation: Each institution's data is scoped to that institution and is not accessible across institutional boundaries.
Least-privilege access: Staff access is role-based and limited to the records a role requires.
Server-side AI gateway: Provider credentials are held server-side and are never exposed to your browser.
Automated security review: We run our database platform's security analyzer against production and remediate the findings it reports.

Lunabeam is hosted in the United States.

B. Additional Commitments for Institutional Deployments

The following apply to any institutional deployment, from the start of that deployment:

Access to student education records is logged, the access history is provided to the institution on request, and logs are retained for a minimum of twelve (12) months.
Staff access to institutional data is reviewed at least annually, and immediately on any change in personnel.
Multi-factor authentication is required for administrative access to systems holding institutional data.
We will notify the institution's designated contact of a security incident affecting its data without undue delay and no later than seventy-two (72) hours after confirming the incident, providing the information reasonably available about scope, affected individuals, and remediation.

Lunabeam is an early-stage company and does not hold a SOC 2 attestation. We will describe the current state of our security program accurately to any institution on request, including what is in place, what is planned, and when.

8. Data Retention

We retain your Personal Information only for as long as necessary to fulfill the purposes outlined in this policy.

Institutional deployments. We retain institutional data, including student education records, for the term of the agreement with your institution. Within thirty (30) days after that agreement ends, we will, at the institution's election, return the data in a commonly used machine-readable format or delete it, and we will confirm deletion in writing. Residual copies held in backup media are removed on the normal backup rotation and in no event later than ninety (90) days after termination.

Individual accounts.

Active Accounts: We retain data while your account is active to provide the service.
Inactive Accounts: If you have not logged in or interacted with the service for 24 months, we will mark your account for deletion and attempt to notify you by email. The account is deleted 30 days after that notice unless you log in.
Deleted Accounts: When an account is deleted, by you or due to inactivity, your personal identifiers are removed from our active databases immediately. Residual copies in backup systems are securely destroyed within 90 days.

Retained after deletion. We may retain de-identified or aggregated information that cannot reasonably be re-associated with you, and records we are required by law to keep.

9. Your Privacy Rights

Depending on where you live, you may have the following rights:

Right to Know: Request details about the specific pieces of information we hold about you.
Right to Access: Obtain a copy of your personal information in a portable format.
Right to Delete: Request that we delete your personal information.
Right to Correct: Request that we fix inaccurate data.
Right to Limit Use of Sensitive Information: Direct us to limit the use of your Sensitive Personal Information (e.g., Challenge data) to only what is necessary to perform the service.
Right to Opt Out: Opt out of sale or targeted advertising. Lunabeam does not sell personal information and does not use it for targeted advertising, so there is no such processing to opt out of.
Non-Discrimination: We will not discriminate against you for exercising these rights.

These rights are available to residents of California, Virginia, Colorado, Connecticut, Texas, Utah, Oregon, and Montana, among other states with comparable laws. We extend them to all users regardless of where you live.

These rights apply to personal information Lunabeam handles as a business on its own behalf. They do not cover student education records that Lunabeam processes solely as a service provider and School Official on behalf of an educational institution. To exercise rights over records held by your institution, contact your institution, which is the controller of those records (see Section 6).

How to Exercise Your Rights

Email: support@lunabeam.app
In-App: Go to You > Privacy > "Manage My Data." If this feature is not yet available in your version of the app, please use the email above and we will fulfill your request.
Authorized Agents: You may designate an authorized agent to make a request on your behalf. To protect your data, we require a signed permission form from you authorizing the agent to act on your behalf, and we may verify your identity directly.

Our Response

We will respond within forty-five (45) days. We may extend once where permitted by law, and we will tell you if we do. If we deny a request, you may appeal by replying to our response, and we will decide the appeal within the period your state's law requires and explain our reasoning.

10. Changes to This Privacy Policy

We may modify this Privacy Policy at any time. If we make material changes, we will notify you via the App or email, and we will notify institutional customers' designated contacts at least thirty (30) days before the change takes effect. Continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.

11. Dispute Resolution

Disputes are governed by Section 12 of our Terms of Service, which contains a binding arbitration provision and a class action waiver, together with the exclusions set out in Section 12.4 of those Terms.

Those exclusions mean that no agreement to arbitrate and no class action waiver is formed with any educational institution, any user accessing the Service under an institutional agreement, any public or governmental entity, any party prohibited by law from agreeing to arbitration or to a class action waiver, or in respect of claims that may be brought in small claims court.

12. Do Not Track and Opt-Out Preference Signals

We do not track our users over time and across third-party websites to provide targeted advertising, and we therefore do not respond to Do Not Track (DNT) signals. Because we do not sell or share personal information for cross-context behavioral advertising, there is no such processing for an opt-out preference signal, including Global Privacy Control (GPC), to disable. If that ever changes, we will honor those signals and update this policy first.

13. Contact Us

If you have questions about this policy or our data practices, please contact us.

Lunabeam Labs 455 Market Street Suite 1950 #806521 San Francisco, CA 94105

Email: support@lunabeam.app