We take the security of your data seriously. This page describes the measures in place to protect your information within Luna and future Paradigm Shift Apps products.
Authentication & session security
Handled through Supabase Auth. Session tokens are stored using device-level secure storage, not plain local storage.
Encrypted transit
All data sent between the App and our servers is encrypted using HTTPS/TLS.
Backend hardening
Our AI-powered backend functions enforce rate limiting, POST-only request handling, and schema validation, to guard against malformed or abusive requests.
Least-privilege data collection
We only request the device permissions the App actually needs. For example, we removed the Android microphone permission once we confirmed it was unused.
Dependency monitoring
We track and patch known vulnerabilities in the libraries the App depends on.
AI data handling
Several Luna features send your content to Anthropic's Claude API: journal entries and sleep data for check-ins and weekly reflections, and Face check / Room check photos for alarm verification. This content leaves your device and is transmitted over HTTPS/TLS via our Supabase Edge Functions. Verification photos are processed in-flight and are never written to our database or storage — see the Privacy Policy for the full detail on what is and isn't retained.
Reporting a vulnerability
If you discover a security vulnerability in Luna or any Paradigm Shift Apps product, please email suria@paradigmshiftapp.com so we can investigate and address it promptly.