Privacy Policy

Introduction

Luna Maze ("we," "our," or "us") is an independent app studio based in India. This Privacy Policy covers Axiom, our dopamine recovery tracker, available on the Apple App Store and Google Play. Policies for our other products will be published here as they launch.

Across everything we build, the same commitments hold: your data is stored on your device first, we run no third-party analytics or advertising SDKs, and we never sell or share your information for anyone else’s purposes.

Axiom — Dopamine Recovery Tracker

Axiom ("the App") is a personal wellbeing and habit-tracking app that supports brain recovery, dopamine detox, and digital wellbeing. This section applies to Axiom on both the Apple App Store (iOS) and Google Play (Android). The same policy governs both; the only differences are the store that processes your payment and the sign-in options on each platform.

Data stored only on your device

By default, Axiom stores your data locally using an on-device database (Hive), protected by your device’s own security. This includes:

• Daily check-in entries (mood, energy, urge levels, and any notes you write)
• Streak and recovery timeline (start dates, reset reasons, reset triggers)
• Journal and reflection text
• Breathing exercise history
• Mission progress, achievements, and XP
• Your onboarding answers, pact, and personalized settings

This information stays on your device, except for the specific, limited flows described below — and even then, your free-text recovery content is removed first.

Product analytics (first-party, opt-out)

To understand which parts of the App help and which get ignored, Axiom records product-analytics events on our own infrastructure (our Supabase database). No third-party analytics vendor, ad network, or data broker is involved.

• What is recorded: app opens, which screens you visit and for how long, feature-usage signals (for example, that a breathing session completed and how long it ran), onboarding progress as lengths and counts only, and paywall interactions. Events also carry coarse context: app version, a device performance tier (a high / mid / low bucket, not a device ID), your language setting, and a coarse install-month cohort.
• What is never recorded: your journal or reflection text, your mood values, your trigger names, your check-in notes, your pact text, or any other recovery content. The App strips these before any event is sent, enforced as a hard rule in the code and by a fixed deny-list of sensitive keys.
• How it links to you: when you are signed in, events are tagged with your account ID; when you are signed out, they are not linked to any account. Deleting your account removes the link between past events and you.
• Your control: the Settings > Privacy toggle turns analytics off at any time, and the App stops collecting immediately.

Account and authentication (only if you create an account)

Creating an account is optional — Axiom is fully usable without one. If you choose to sign in, you can use email and password, Google, or (on iOS) Sign in with Apple.

• We receive your email address. With Sign in with Apple you may use Apple’s private relay email, in which case we only ever see the relay address.
• With Google or Apple, we may also receive your name, only to set up your account.
• You may choose an optional display name and username.
• With email and password, your password is sent over HTTPS and stored only as a one-way hash by our authentication provider (Supabase Auth). We never see or store your plaintext password.

This account information is held by our authentication provider (Supabase Auth) and is not copied into any other database we run.

Cloud backup of your progress (only if you are signed in)

When you are signed in, Axiom backs up a minimal slice of your progress to our own database so you can restore it on a new device:

• Streak records: start date, end date, and whether the streak is active.
• Check-ins: the date and a single numeric mood level (a 1 to 5 rating).

Your journal notes, your trigger names, and your reset reasons never leave your device. They are removed by the App before syncing, and our database additionally refuses to store those fields as a hard rule at the server level, so plaintext recovery content is never persisted on our servers. This backup is encrypted in transit (HTTPS/TLS) and encrypted at rest; it is not end-to-end encrypted, and we are technically able to access the minimal fields listed above.

Subscriptions and payments

If you purchase a subscription, payment is processed entirely by Apple (on iOS) or Google Play (on Android). We never receive or store your card, bank, or other payment details.

We use RevenueCat to manage subscription status. RevenueCat receives your purchase receipt and entitlement status (active, trial, expired). Its identifier for you is anonymous until you make a purchase; because purchasing requires signing in, at that point the identifier is set to your Axiom account ID so your subscription follows your account across devices and platforms. RevenueCat still never receives your name, email, or any recovery or health data.

Community and support features you choose to use

These are optional and only send data when you actively use them:

• Username: if you claim a username, it becomes a public handle other signed-in users can see.
• Buddy Bond: to connect with an accountability partner, you generate a share code and choose a display name. If someone bonds with you, the display name you chose is shown to that one partner. "Nudges" between buddies are dated pings that carry no message content. No recovery data is ever shared with a buddy.
• Messages you send us: when you contact the team through the App (for example, the in-app founder channel), report a buddy, or answer our cancellation survey, the message or feedback you write and your account ID are sent to and stored on our servers so we can read and respond. If you ask for a personal reply, we also store the email you provide for that purpose. We use these only to support you and improve the App, never for advertising, and they are deleted when you delete your account.

Photos, notifications, and permissions

• Photos: Axiom accesses your photo library only when you choose a profile picture or attach an image, and only from the gallery (never the camera). The image is copied to local storage on your device and is never uploaded.
• Notifications: reminders and milestone alerts are generated on your device by the operating system’s local scheduler. No push token is sent to any server, and notifications contain only what you already entered.
• Biometrics: Face ID or fingerprint is used by your device to unlock the App locally; the biometric itself never reaches us.

Data we do not collect

• Location data
• Contacts, calendar, or files
• Camera (image selection is gallery-only and stays on your device)
• Browsing history, or usage of other apps on your device
• Advertising identifiers (no IDFA / IDFV / Google Advertising ID)
• Device fingerprints or cross-app tracking
• Any third-party advertising or analytics SDK

We do not sell or share your data for advertising, and we do not use your data to train AI models.

Third-party services

Data retention and deletion

• Local data: use "Delete All Data" in Settings, or uninstall the App.
• Account & cloud data: delete your account in the App (Settings) or by email; cloud data is permanently erased within 30 days of a deletion request.
• Subscription records: retained by Apple, Google, and RevenueCat per their own policies.

Managing your subscription

• iOS: manage or cancel from your Apple ID subscription settings in the App Store.
• Android: manage or cancel from your subscriptions in Google Play.

Security

Local data is protected by your device’s own security. Data sent to our servers is encrypted in transit (HTTPS/TLS) and at rest, and passwords are hashed before storage. As defense-in-depth for such a sensitive category of app, your free-text recovery content is stripped before it can be sent and is additionally blocked at the database level, so it is never stored on our servers.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to the processing of your data (GDPR in the EU/UK; CCPA/CPRA in California, including the right to opt out of any sale — Axiom does not sell personal data). Because most data stays on your device, you can exercise most rights yourself with "Delete All Data" or by uninstalling. For account or cloud data, use in-app account deletion or contact us.

Age requirement and children’s privacy

Axiom is intended for users aged 17 and older. It addresses topics related to compulsive behavior and pornography recovery that are not appropriate for minors. We do not knowingly collect data from anyone under 17. If you believe a minor has used the App, contact us for immediate deletion.

Health and wellness disclaimer

Axiom is a general wellbeing and habit-tracking tool. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any condition. Its statistics and recovery phases are informational only and not a substitute for professional advice. If you are experiencing a mental-health crisis, please contact a qualified professional or your local emergency services.

International users

We are based in India, and our infrastructure providers may process and store data on servers located outside your country, with appropriate safeguards where required.

Changes to this policy

We may update this Privacy Policy from time to time. Changes are posted here with an updated "Last updated" date, and — for Axiom — material changes are announced within the app or on the store listing. Continued use after changes take effect constitutes acceptance.

Contact us

If you have questions about this Privacy Policy:

• Email: lunamaze.dev@gmail.com
• Developer: Luna Maze, a studio of Harikrishnan V (shadowline), India