Privacy notes.

Your face and Mac password

The native app processes camera frames in memory and runs face recognition on your Mac. Face enrollment and the saved Mac login password are stored in an encrypted local vault. macOS Keychain protects the vault’s encryption key; an authorized local session keeps the key in memory while needed.

The website’s interactive preview does not access your camera. Never enter your Mac login password on this website. The intended app setup asks for it only inside the native app on your own Mac.

Your account and membership

When account services are enabled, sign-in uses your email address and the shared SignPulsar authentication system hosted by Supabase. Existing SignPulsar users can use the same email. Authentication identifies your account; a separate Lunlo membership record determines access.

The planned membership service stores account and Stripe customer/subscription identifiers, subscription status, billing-period and trial dates, cancellation state, trial-use history, checkout references, and billing event identifiers. These support access checks, billing updates, and prevention of duplicate trials or subscriptions. Face images and your Mac password are not inputs to that service.

Payments go through Stripe

When checkout is available, payment details are entered on Stripe’s hosted checkout page. Stripe also hosts the billing portal for payment methods, invoices, and cancellation. The Lunlo account service uses billing identifiers and status; its database schema does not include full card numbers.

Read the provider notices for their own processing: Stripe privacy and Supabase privacy.

Sessions and website requests

The account page stores a Lunlo authentication session and sign-in verifier in this browser’s local storage. The native app stores its separate authentication session in macOS Keychain. These allow sign-in to persist and membership checks to be authenticated.

The current website implementation includes no advertising pixel or analytics script. Hosting, authentication, and payment providers may process request information, such as IP addresses and operational logs, while delivering their services. The browser sends membership requests only after sign-in and only when the account service is configured.

Removing local data

Use the native app’s controls to remove enrolled identities and the saved password before uninstalling. Moving the app to Trash alone does not erase its application-support data. Camera, Accessibility, and Input Monitoring permissions can be managed in macOS System Settings.

Signing out in the browser clears that Lunlo browser session; it does not delete your shared SignPulsar account, native app data, or billing history. This preview does not yet include an online account-deletion workflow or a published support channel. Account services remain closed while that release setup is incomplete.

Scope of these notes

These notes describe the current implementation and the planned account-enabled release. They do not promise a fixed retention period or a particular security outcome. Service configuration and available controls need to be reflected here before a public subscription launch.