Data Retention Policy

Last updated: September 21, 2026

This policy says what Lunela keeps, why, and for how long. It sits alongside our Privacy Policy, which explains what we collect and who it goes to.

The short version: we keep a child’s information only while it is being used to continue their story, and no longer. There is no “soft delete” here: when something is deleted, it is gone, not hidden behind a flag.

What we keep, and for how long

Your child’s profile: first name, age, pronouns, chosen interests, and anything you entered about fears or themes: kept while the service relationship is live (see below).
Stories and audio: episodes, one-off stories, worlds, characters and narration files: the same.
Your account: your Apple identifier, your email if you chose to share it, and your notification token: the same.
A narration voice you recorded: removed when you delete it, when you delete your account, automatically after 365 days without being used, or 90 days after your subscription ends: whichever comes first.
The raw voice recording itself: never stored. It is sent to create the voice and not written to our systems at all.
A record of your purchase: kept after account deletion, because we are required to keep records of sales for tax and accounting. It holds subscription state and an anonymous customer id: no child data, no stories, no names.
Usage analytics: none. No analytics or crash-reporting service is switched on, so nothing about how your family uses the app is collected at all.

What “while the relationship is live” means

One rule, the same for everybody. We keep your family’s data while either the app has been opened in the last 18 months, or you have a subscription running. An active subscription always keeps your account, whether or not you have opened the app recently.

If neither is true, we should not still be holding a child’s details, so the account is removed, but never without telling you first:

We email you, saying exactly what will be deleted and when.
You have 30 days. Opening the app is all it takes to cancel it, with no reply and nothing to click.
Only then is the account erased, through the same process as the delete button in the app.

If that email cannot be sent, nothing is deleted; the account waits and is reconsidered later. Deletion for inactivity never happens without a warning having reached you first.

If you never signed in

You can try Lunela without an account, using “Look around first”. We have no way to contact you in that case, so the rule is shorter and has no warning: if the app is not opened for 90 days, that trial account and everything in it, including any child profile, is deleted. Signing in with Apple at any point keeps everything and moves you to the rule above.

What causes deletion

You delete your account: Profile → Delete account. Immediate and permanent: the child profile, every story, every audio file, any narration voice including the model held by our voice provider, and our records of rejected content. No grace period and no recovery window.
You delete a voice: Profile → Reading Preferences. Removed from our systems and from our voice provider.
A voice goes unused for 365 days: removed automatically, with no human involvement.
Your subscription ends and 90 days pass: the voice was made to narrate stories on a paid plan, so when the plan stops the reason for keeping it stops too. The 90 days are there so that a lapsed card put right a few weeks later costs you nothing.
The relationship lapses: as described above.
An account you never signed in to is not opened for 90 days: deleted without a warning, because there is nobody to send one to.
You ask us in writing: email [email protected] and we will action it by the same routes.

If your plan has ended but you recorded a voice while it was active, that voice stays visible in Reading Preferences so you can still remove it. Your ability to delete your own data never depends on paying us.

Our providers

The companies listed in our Privacy Policy delete what they hold on our instruction. Two are worth stating plainly:

Our story provider keeps a log of requests for up to 30 days to detect misuse of its own service, then deletes it. Neither your child’s first name nor their exact age is ever in it: the story is written and safety-checked against a placeholder, and we never send the exact age at all.
Our voice provider reads every story aloud, so it receives the finished story text, which does contain your child’s first name, because a name has to be spoken to be narrated. If you created a narration voice, it also holds that voice model, and destroys it on the triggers above. None of it is used to train anyone’s systems.

Backups

Deleting something removes it from our live systems immediately. Backups are a separate copy, and we would rather be exact than reassuring: our database is backed up once a day and each backup is kept for 7 days. So a deleted record can remain inside a backup for up to 7 days, and after that no copy of it remains anywhere.

Backups are only ever used to recover from failure, never to look up an individual account, and we do not edit inside them on request: the commitment is the 7-day window.

Changes

We review this policy whenever our providers, our systems or our deletion rules change, and at least once a year. If we change it we will revise the date above, and for material changes we will tell you in the app.

Contact

Questions or requests: [email protected].