Privacy
Last updated 2 November 2026. Luna is a demo, for use in the UK only, so this page may change.
The short version
- Your voice isn't recorded.
- Your contact's details and your code phrase are wiped from the app when you close its tab (or tap “Wipe them now” after a walk), unless you ask it to remember you.
- Your location is only shared with your contact if you send an alert (or one is sent for you because you didn't confirm you were home by the time you set), or if you choose to let them follow your walk.
- Notes (made when you mention someone or something you've noticed, like a person or a car, or when you ask) are backed up privately for 90 days, unless you switch that off, in case they're needed, for example by the police. You can delete them below.
- If memory is on, the companion remembers everyday things you chat about (like a deadline, a friend's first name or something you asked it to remind you of) so it can ask how they went. They stay on your phone, never on our servers, and you can see, delete or switch them off at any time.
- No adverts, no tracking, no selling your information. Ever.
- Luna is for adults (18 and over) only.
Who runs Luna
Luna is a demo run by ABAW Ventures Ltd (company number 17518132, registered in England and Wales), which is responsible for your information under UK data protection law. For questions, or to use any of your rights below, ask the person who shared this demo with you.
What we use, why, and for how long
| What | Why | How long |
|---|---|---|
| Your first name | So the companion can use it, and so your contact knows who an alert is from. | Kept in the app's browser tab until you close it, so you can start another walk (but see notes and alerts below). |
| That you're 18 or over | Luna is for adults only. | Used to set up each walk and forgotten when it ends (kept on your phone only if you choose Remember me). |
| What you say on the walk | Sent live to the voice service so the companion can answer, and listened to for your code phrase. Your phone first holds back street noise and the companion's own voice coming back through the speaker (this happens on the phone; nothing is kept). The same service also turns what you say into text on a second, listen-only line, so your code phrase is caught the moment you say it, even while the companion is talking. | Not recorded by Luna. The voice service is told to delete the conversation within a day. The listen-only line has no such setting: ElevenLabs handles that sound under its own rules for keeping data. |
| Your code phrase | So the companion knows what to listen for. | Kept in the app's browser tab until you close it, unless you tick “remember my code phrase”. |
| Your contacts' names and mobile numbers (or ntfy codes) | To send your chosen contact your alerts, and the start and finish messages if you choose them. If nobody says they've seen an alert within 2 minutes, it goes on to your other saved contacts, one every 2 minutes (or, if you only have one, they get a reminder), and anyone it reached hears if you call it off. | Outside an alert, numbers aren't stored on our servers: during a walk we keep only a scrambled version of your chosen contact's number (or ntfy code), so the walk's messages can't be sent anywhere else, until about an hour after the walk's latest end time. When you send an alert, the names and numbers of the contacts it may go on to are kept with the alert, so it can be passed on even if your phone dies. Those it hasn't reached yet are deleted as soon as someone says they've seen it; the rest are deleted when you say it's a false alarm or you're home (so they hear), or when the alert link expires (an hour after the walk's latest end time at most). The text service (Twilio) keeps its own record of texts sent. |
| Your own mobile number (optional) | So your contact can call or text you with one tap from the alert page. | Shown only on your contact's private link while it's live, then deleted when the walk ends (or, if an alert is still open when the walk ends, when the link expires: see your location, below). |
| Your location | For alerts (including the one sent for you if you don't confirm you're home in time), to save where each note was made, and (as a rough location, to about 100 m) to find open places, street lighting and CCTV nearby, and to check you're in the UK. | Rough location: up to 30 minutes for places and the UK check, a day for the lighting map (kept as map data, not as who asked). We also note for 30 days that the 10 km square around you is in the UK, which isn't about anyone. If you share your walk, or after an alert, your contact's link shows your location until the walk ends, then it's wiped. If an alert is still open when the walk ends (or your phone loses connection), the link keeps showing the last place your phone shared until an hour after the walk's latest end time, so your contact can still find you, then it's deleted. An alert text has a map link to where you were: Twilio (and ntfy.sh, if you use it) keeps that, as below. |
| Where you're heading (on a walk, if you add one: before each walk you can choose “No address this time”) | So your companion can check you're OK if you go well off your way and stop getting closer. To find the place, your phone asks free address services directly as you type (Photon, run by komoot in Germany, using OpenStreetMap data; and postcodes.io for postcodes): they get what you type. For the walking route it asks Valhalla (run by FOSSGIS in Germany), which gets the place and, at the start of a walk, where you are. None of this is sent to our servers. If you ask your companion which way to go, the next turn or two and the distance left go to the voice service so she can tell you: that's street names on your route (near the end, that can include your own street), never the address you chose. If you don't answer the check, your contact gets an alert with your location, as with any other alert. | You choose it before each walk. Your last 3 places are kept on your phone (in the app, or in this browser if you tick “Remember me”) as quick choices, until you remove one or tap “Forget me”. These services may keep ordinary server logs for a short time. |
| Evening check-in (phone app, only if you switch it on) | In the hours you choose, your phone notices when you're out walking and Luna sends one notification asking if you'd like company. To do that, the app reads your location in the background during those hours (you allow “Always” for it). It's all worked out on your phone: nothing is sent to our servers or anyone else. | The last half hour of readings, on your phone only, then forgotten. Switching it off, or “Forget me”, stops it and deletes them. It's never on in private mode. |
| Notes | A record of something you noticed (a person, a car, a number plate, something that happened), in case it's needed later, for example by the police. The companion makes one whenever you mention something like that, or when you ask. You can see and delete them on the call screen and after the walk. | On your phone until you delete them. Backup: 90 days, or 7 days after you ask for it to be deleted. |
| Small things the companion remembers (only if memory is on) | So it can ask how things went next time, like a friend would: your course or job (not where), hobbies, plans, deadlines, pets, shows, friends' first names, and reminders you ask for. Never where you live or go regularly, your code phrase, anything worrying, partners or dating, family or money problems, or health, sex, religion or politics. The app refuses those even if the companion tries. | On your phone only, until you delete them, switch memory off (which forgets everything), or after 180 days. At the start of each walk they're sent to the voice service with the conversation, which is deleted within a day. Never stored on our servers. |
| A random ID for your phone, and your internet address (both scrambled) | To stop misuse: one walk per phone at a time, and limits on how often walks can start. | A few hours at most. |
| Your university or employer, if you entered its code | To show you its own helplines (the companion knows them too), and to keep its walks separate from everyone else's. It sees daily totals only (how many walks and alerts), never who walked. | On the walk itself until it ends; with backed-up notes for as long as they're kept; daily totals 400 days. |
| A log of each time backed-up notes are looked at | So there's a record of who was looked up, when and why. | 365 days. |
Our legal reasons
- Running your walk, alerts and notes: our “legitimate interests” in helping you get home safely, which is what you asked the app to do. In an emergency, it's also to protect someone's life.
- Backing up notes: legitimate interests in keeping you safe and helping to prevent and solve crime. It's your choice: switch it off at setup, or delete the backup below.
- Remembering small things between walks: legitimate interests in making the companion feel like a friend who remembers you, which you can turn down at any time with one switch.
- Sharing notes with the police: only when the police make a proper request, or someone's safety is at serious risk. UK data protection law allows this to prevent or detect crime. Every look-up is logged.
Who else handles it
- ElevenLabs runs the AI voice, and the listen-only line that catches your code phrase. It uses Anthropic's Claude AI to write the companion's replies, and if Claude is slow to answer, OpenAI's AI instead. ElevenLabs passes them the conversation and the companion's instructions, which include your first name, your code phrase and (if memory is on) the small things it remembers.
- Twilio sends texts, and an automated alert call if you choose it. It keeps its own record of the texts, including the map link to your location in an alert.
- ntfy.sh sends app notifications, only if you choose ntfy instead of texts. It's a free public service without a data protection agreement, and it holds messages (including an alert's map link) for up to 12 hours so they arrive.
- OpenStreetMap data is used to find open places, street lighting and CCTV nearby, and to check you're in the UK (Luna only works there). Our server asks for you, using only a rough location: open places and the lighting map through free public servers run by others (overpass-api.de, overpass.private.coffee and overpass.kumi.systems, and for open places also Photon, run by komoot in Germany), and the UK check through OpenStreetMap's own service. If you open the lighting map, the map pictures load straight from OpenStreetMap's servers, which see your internet address and the area on screen. Your contact's live link shows a map from openstreetmap.org too, which sees your location and their internet address.
- Tavily runs web searches when you ask the companion something it needs to look up (like opening times or a score). Our server sends only the search words, never your name, your phone's location or your code phrase, with safe search on. If you name a place yourself (“Tesco in Headingley”), that name is part of the search words. Tavily is based in the US.
- Google Maps, only when someone opens a map link: the one in an alert text, “Open in Google Maps” on your contact's link, or the map links on your notes. Google then sees that location.
- Vercel hosts the app (on servers in London) and Upstash runs our small database.
Some of these companies are based in the US. Where information leaves the UK, their standard data protection terms cover it, apart from the free services (ntfy.sh and the OpenStreetMap servers), which we have no agreement with.
On your phone
The app keeps a few things in your phone's browser: your walk details (wiped when you close the tab), your notes, a random ID for your phone, the small things the companion remembers (only if memory is on), and, only if you choose “Remember me”, your name and contacts. There are no cookies, no adverts and no tracking.
If you're under 18
Luna is only for adults (18 and over), so please don't use it. If you walk on your own, ask someone you trust to share locations with you. If you're ever in danger, call 999. You can talk to Childline about anything, free, any time: 0800 1111.
If you're someone's trusted contact
A walker gave us your name and mobile number so we can send you their alerts (and start and finish messages, if they chose them). If you're one of their other contacts, you may get an alert that their first contact hasn't seen within 2 minutes. We use your details only for that. They aren't stored on our servers outside an alert (during the walk we keep only a scrambled version of the chosen contact's number, so its messages can't go anywhere else). While an alert is open, the names and numbers of the walker's other contacts are kept with it so it can be passed on, and deleted when it's seen or called off, or within about an hour of the walk's end. Twilio keeps a record of texts it sends. If you don't want these messages, tell the walker, or ask the person who shared this demo with you.
Your rights
You can ask for a copy of your information, to correct it, to delete it, or for us to stop using it. Ask the person who shared this demo with you and they'll sort it out. We'll reply within a month.
If you're not happy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
Your backed-up notes
This is a demo, for use in the UK only. It is not an emergency service. If you are in danger, call 999. Luna is run by ABAW Ventures Ltd, company number 17518132, registered in England and Wales.