Cookie Policy

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website or use an app. They help services remember your preferences and authenticate your sessions. Cookies can be "session cookies" (deleted when you close your browser) or "persistent cookies" (remain until they expire or you delete them).

2. How We Use Cookies

Luna Money takes a minimal, privacy-focused approach to cookies. Inside the app, we use only strictly necessary cookies for authentication and security. On our marketing website (lunamoney.io), we additionally use a small number of analytics and advertising cookies (Google Analytics and the Meta Pixel) to measure how effective our advertising is and to improve the site. Both are described below.

Essential Cookies We Use

3. Authentication and Security

Our authentication system uses a hybrid approach for maximum security and compatibility:

• Bearer Token Authentication: For API calls, we use JWT tokens in Authorization headers (not stored as cookies)
• Session Cookies: For browser-based authentication, we use secure, encrypted session cookies
• Session Storage: Active sessions stored in encrypted Firestore collection with Redis caching (TTL: 5-30 minutes)
• Token Generation: Cryptographically secure random tokens (256-bit entropy)
• Multi-Factor Authentication: When enabled, adds an extra layer without additional cookies
• Device Fingerprinting: Used for security without storing tracking cookies
• Push Notifications: FCM tokens stored securely for notification delivery

4. Third-Party Services and Cookies

Services That Don't Use Cookies

The following third-party services we use do not place cookies on your device:

• Plaid: Financial data aggregation (uses secure API tokens)
• Stripe: Payment processing (tokenized, no cookies on our domain)
• Firebase: Database and authentication backend
• Sentry: Error monitoring (anonymized, no tracking cookies)
• OpenAI: AI services (API-based, no cookies)

Google Services

We use Google services with privacy-preserving configurations:

• Google Sign-In: Only during authentication flow, cookies are managed by Google on their domain
• Google Analytics (GA4): Used on our marketing website to measure traffic and improve the site. Configured with IP anonymization and with Google's advertising features turned off. GA4 sets first-party analytics cookies (e.g., _ga) to distinguish visits; these persist beyond a browser session.
• reCAPTCHA: Used only on critical forms for security, minimal cookie usage

Advertising (Marketing Website)

On our marketing website (lunamoney.io) we use the Meta Pixel (Meta Platforms, Inc.) to measure how well our advertising performs — for example, which ads bring people to our site. The pixel sets cookies such as _fbp (and, when you arrive from an ad, _fbc), which can persist for up to 90 days.

• It runs only on our marketing website — never inside the Luna Money app or on any signed-in page.
• We do not send your name, email address, or phone number to Meta through the pixel.
• It never receives your financial account data, balances, or transactions.

5. What We Don't Do

Luna Money is committed to your privacy. We do NOT:

• Use any advertising or tracking cookies inside the Luna Money app or on signed-in pages
• Sell your personal or financial information to anyone
• Share your financial account data, balances, or transactions with advertisers or the Meta Pixel
• Send your name, email address, or phone number to Meta through the pixel
• Track your in-app financial activity across other sites or devices

6. Local Storage and Session Storage

In addition to cookies, we use browser local storage and session storage for:

• Caching non-sensitive data to improve app performance
• Storing user preferences (theme, layout settings)
• Temporary form data to prevent loss during navigation
• App state management for better user experience

Specific Storage Usage

We use the following storage mechanisms for app functionality:

• luna_dashboard_preferences: Your dashboard layout and display preferences
• luna_${key}: Various user preferences and feature settings
• activeAuthTab: Multi-tab authentication coordination (sessionStorage)
• luna-last-sync: Last synchronization timestamp for offline functionality

Automatic Cleanup: All localStorage data is automatically cleaned up after 24 hours of inactivity.

Important: We never store sensitive financial data, passwords, or personal information in local storage. All sensitive data is encrypted and stored securely on our servers.

Service Worker Caching

Our Progressive Web App uses service workers for offline functionality and performance:

• Main Service Worker: Caches static assets and provides offline support (cache: luna-v3)
• Push Notification Service Worker: Handles Firebase Cloud Messaging for notifications
• OAuth Bypass: Authentication requests are never cached for security
• Automatic Updates: Service worker updates automatically with app versions

7. Managing Cookies

Cookie Controls

The app's authentication cookies are essential — disabling them will prevent you from using Luna Money. The analytics and advertising cookies on our marketing website (lunamoney.io) are optional, and you can block or remove them at any time using the controls below, your browser's tracking/ad settings, an ad blocker, or Google's and Meta's own opt-out tools:

• Your Privacy Choices: Use the Your Privacy Choices link in our website footer to turn advertising cookies (the Meta Pixel) off at any time. The rest of the site keeps working normally.
• Browser Settings: Most browsers allow you to view, delete, and block cookies. Note that blocking our authentication cookies will require you to sign in again.
• Sign Out: Signing out of Luna Money will clear your session cookies.
• Private/Incognito Mode: Browsing in private mode will delete cookies when you close the browser.

Clearing Local Storage

You can clear local storage data through your browser's developer tools or by signing out of the app, which automatically clears cached data.

8. Cookie Security

We implement industry best practices for cookie security:

• Encryption: All session data is encrypted using strong cryptographic algorithms
• Secure Flag: Cookies are only transmitted over encrypted HTTPS connections
• HttpOnly Flag: Cookies cannot be accessed by JavaScript, preventing XSS attacks
• SameSite Strict: Cookies are not sent with cross-site requests, preventing CSRF attacks
• Short Expiration: Session cookies expire after 24 hours of inactivity
• Secure Token Generation: We use cryptographically secure random token generation

9. Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in our practices or for legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the "Effective Date."

We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies.

10. Contact Us

If you have questions about our use of cookies or this Cookie Policy, please contact us:

11. Your Rights

Depending on your location, you may have certain rights regarding cookies:

• Right to Information: This policy provides full transparency about our cookie usage
• Right to Refuse: You can refuse cookies through browser settings (though this will prevent app usage)
• Right to Delete: You can delete cookies at any time through your browser
• Right to Complain: You can contact privacy authorities if you have concerns

© 2025 Luna Money. OS Financial LLC / Luna Money LLC. All rights reserved.

Luna Money - Your trusted financial companion