1. Introduction
Welcome to Luna – Your AI Learning Companion ("Luna," "we," "us," or "our"). Luna is a Chrome Extension designed to provide an interactive and personalized learning experience for its users.
This Privacy Policy explains how we collect, use, store, protect, and disclose information when you, or a child authorized by you, use our Service. The "Service" refers to the "Luna – Your AI Learning Companion" Chrome Extension and any related services, including our backend infrastructure and options pages.
This policy is a legally binding agreement between you and Luna. By installing, accessing, or using the Service, you consent to the data practices described in this Privacy Policy.
We recognize that Luna is intended for use by children. We are committed to protecting the privacy of children who use our Service. Our data practices concerning children are detailed in our Commitment to Children's Privacy and COPPA Compliance section below.
For the purposes of this policy:
• "User" refers to any individual using the Service.
• "Child User" refers to a user under the age of 13.
• "Parent User" refers to a parent or legal guardian of a Child User, or an authorized educational instructor (e.g., a teacher or tutor) who creates or connects to an account used by a Child User.
2. Our Commitment to Children's Privacy (COPPA Compliance)
Luna is fully committed to complying with the Children's Online Privacy Protection Act (COPPA) and other applicable privacy laws.
Verifiable Parental Consent (VPC): Before a Child User can access and use the full features of the Service, we require a Parent User to provide verifiable consent. The product's "Relationship Management" feature, where a Parent User invites or connects to a Child User's account, serves as our mechanism for obtaining this consent. By connecting your account to a Child User's account, you represent that you are their parent, legal guardian, or authorized educator and that you consent to the collection, use, and disclosure of the Child User's personal information as described in this policy.
Data Collected from Child Users: We are transparent about the information we collect. For Child Users, this includes:
Account Information: Name, email address, and profile picture URL (provided via Google OAuth).
Audio Data: Real-time voice recordings during active tutoring sessions (“Audio Data”). You consent to the recording of your own voice and if you are a Parent User, the voice of your Child User.
Browser Content Data (Screenshots): Screenshots of the active browser tab during active tutoring sessions.
Session Transcripts: Full text transcripts of conversations between the Child User and the AI agent.
Usage Data: Information about their interaction with the Service, such as session duration and features used.
Parental Rights: As a Parent User, you have the right to:
Review your child's personal information.
Delete your child's personal information.
Refuse to permit the further collection or use of your child's information.
You can exercise these rights at any time by accessing the "Session History" and "Relationship Management" sections of the Luna Options page or by contacting us directly at the email address provided at the end of this policy.
3. Information We Collect
We collect several types of information to provide and improve our Service. This collection is strictly limited to what is necessary to operate the functionalities described in the product specification.
3.1 Information You Provide Directly
Account Information: When you create an account using Google OAuth 2.0 via the chrome.identity API, we collect your primary email address, full name, and profile picture URL. We assign a unique user ID (uid) to your account.
Relationship Information: When you use the Relationship Management feature to connect with other users (e.g., as a "parent," "guardian," or "teacher"), we collect the email address of the individual you wish to invite and store the nature of this relationship.
3.2 Information Collected During Your Use of the Service
This data is collected only when you are in an active session with the Luna AI agent. The Service is designed to cease this collection immediately upon session termination.
Audio Data: To enable the voice-based AI Tutoring Sessions, we require access to your microphone. Your voice audio is captured in real-time, streamed via our third-party provider LiveKit, and processed by our AI agent to provide a verbal response. The AI agent's audio response is streamed back to you. This audio stream is fundamental to the core tutoring functionality.
Browser Content Data (Screenshots): To provide contextual assistance, the Service captures screenshots of your active browser tab.
Activation: This feature is active only when a tutoring session is in progress.
Mechanism: Screenshots are captured approximately once per second. To minimize data transmission, a screenshot is only sent to the AI agent if it is visually different (greater than 1% mismatch) from the previous one, as determined by the resemble.js library.
Content: These screenshots may contain any information visible on your active tab at the time of capture.
Transmission: Screenshots are transmitted as PNG data via the secure LiveKit data channel to the AI agent.
Session Transcripts and Summaries: The full conversation between a User and the AI agent as captured through your voice audio during a tutoring session is transcribed into text. We store these transcripts and may use the AI to generate a title and summary for each session. These are made available for review in the "Session History" feature.
On-Page Annotation Data: The drawing, highlighting, and erasing tools create annotations on a temporary canvas overlaid on the webpage. This annotation data is stored in your computer's memory only for the current page view. It is not transmitted to our servers, not saved, and is permanently lost when you refresh or navigate away from the page.
3.3 Information We Collect Automatically
We may automatically collect the following information about your use of our Service through cookies and other technologies; in registering for and using the service you consent to the use of such cookies and other technologies. Currently, our systems do not recognize browser “do-not-track” requests. You may, however, disable certain tracking as discussed in this section (e.g., by disabling cookies), but such disabling will impair use of the Service. You may be able to edit your browser options to block cookies in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. However, this might prevent you from being able to use the Service.
Technical and Usage Data: The extension requests the following permissions to operate: identity, storage, tabs, activeTab, scripting, windows, and notifications. We use these permissions to collect technical data, including:
The URL of the active tab to inject the UI and provide context.
Information about your browser and operating system.
Interaction data, such as when you connect, disconnect, or use specific features.
Locally Stored Data (chrome.storage.local): For performance and to manage your session, we store certain information locally on your device. This includes:
Your user profile information (uid, name, email, photoURL).
Authentication tokens (Firebase ID token, LiveKit token).
Session state information (e.g., connection status, unique room ID).
UI preferences (e.g., the screen position of the overlay).
Information about connected users and dependents.
4. How We Use Your Information
We use the information we collect for the following specific purposes:
To Provide and Operate the Service: To authenticate you, establish a real-time connection, provide AI-powered tutoring, enable page annotation, and allow you to manage your account.
To Provide Contextual Assistance: To use Audio Data and Browser Content Data (Screenshots) to allow the AI agent to understand your questions in the context of the web page you are viewing and to deliver AI-generated responses.
To Enable Session Review: To store session transcripts and summaries so that Users and connected Parent Users can review past learning activities.
To Manage Family and Group Relationships: To allow Parent Users to connect with and monitor the learning progress of Child Users, as authorized.
To Communicate With You: To send you notifications related to the Service's functionality (e.g., warnings about feature availability on certain pages).
To Maintain and Improve the Service: We may use aggregated and anonymized data to understand usage trends, diagnose technical problems, and improve the overall user experience. A key part of this process is using this data to train and refine our artificial intelligence models, helping us enhance the quality, safety, and accuracy of our AI-powered tutoring.
5. How We Share and Disclose Your Information
We do not sell your personal information. We only share your information with third parties in the specific circumstances outlined below.
With Third-Party Service Providers: We engage third-party companies to perform parts of our Service. These providers are contractually obligated to protect your data and are prohibited from using it for any other purpose. Some of those third-party service providers include, but are not limited to, the following:
Google (OAuth & Firebase): For user authentication and account management. We share your Google profile information to create and secure your Luna account.
LiveKit: For real-time communication. We transmit your Audio Data and Browser Content Data (Screenshots) through LiveKit's servers to facilitate the connection between you and the AI agent.
Google Cloud Functions (Backend): Our backend infrastructure, which manages user data, session history, transcripts, and agent dispatching, is hosted on Google Cloud. Your data, including transcripts and profile information, is stored and processed within this environment.
With Parent Users and Educational Institutions: As a core feature of the Service, if you are a Child User, your session history—including start time, duration, AI-generated summaries, and the full session transcript—will be accessible to your connected Parent User(s) and if you accessing the Service though an arrangement with an educational institution with authorized representatives of that educational institution. This sharing is controlled by the relationship established within the Service.
For Legal Reasons: We may disclose your information if required to do so by law, in response to legal process (such as a warrant, subpoena or civil discovery) or requests by law enforcement or regulatory or governmental authorities, or in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, prevent fraud, or protect the personal safety of Users or the public.
In Case of a Business Transfer: In the event of a merger, acquisition, or sale or other transfer of all or a portion of our assets, your personal information may be transferred as part of that transaction. If required by law, we will notify you via a notice within the Service of any change in ownership or uses of your personal information.
6. Data Storage and Security
Data Storage: User data is stored in two primary ways:
Locally: Non-sensitive session data, tokens, and preferences are stored on your local machine using chrome.storage.local.
Cloud Backend: Your profile information, relationship data, session history, and session transcripts are stored securely on our backend servers, hosted by Google Cloud Platform or such other cloud based system we may use in the future.
Data Security: We take the security of your data very seriously and implement certain commercially reasonable measures designed to protect it, including but not limited to the following.
Encryption: All data transmitted between the extension, our backend, and third-party services is encrypted in transit using HTTPS/TLS.
Authentication: We use secure Firebase ID tokens to authenticate all API requests, ensuring that only authorized users can access or modify data.
Isolation: The extension's user interface is rendered within an iframe to protect it and the host webpage from cross-site scripting attacks.
Despite these measures, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.
Your Data Rights and Choices
We provide you with control over your personal information. You can make a request regarding your personal information by emailing us at support@heyluna.com. We will respond to such requests as required by law. We may request certain information as permitted by law to confirm your identity before responding to your request.
Accessing and Reviewing Information: You can access your profile information, relationship data, and full session history (including transcripts) at any time through the Luna Options page.
Updating or Correcting Information: You can manage your profile information through the Options page. You can also request to correct your personal information by emailing us.
Managing Relationships: You can add or remove relationships with other users through the Options page.
Data Deletion: You can request the deletion of your account and all associated personal information by contacting us. Upon receiving a deletion request, we will permanently delete your account, session history, transcripts, and all other identifiable information from our production servers within a reasonable timeframe, subject to certain exceptions under applicable laws.
Disabling the Extension: You can stop all data collection by disabling or uninstalling the Luna Chrome Extension at any time.
Please note that we do not share your personal information for purposes of targeted advertising or the sending of marketing emails and communication and therefore do not offer such an opt-out for this kind of activity.
Data Retention
We retain your personal information, including session transcripts and history, for as long as
your account is active to provide you with the Service, particularly the session review feature. If
you delete your account, we will delete your information as described in the "Data Deletion"
section above, subject to any legal requirements we may have to retain your information.
International Data Transfers
Our Service is hosted and operated globally. By using the Service, you acknowledge that your
personal information may be transferred to, stored, and processed in countries outside of your
own, where data protection laws may be different. If you live in the European Economic Area or
the United Kingdom, please see our Privacy Policy at Pencil Spaces | Privacy Policy for
information on how to exercise your rights with respect to personal information collected through
the Service.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify
you by posting the new policy within the Service or by other means of communication if required
by law. Your continued use of the Service after any changes constitutes your acceptance of the
new Privacy Policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data
practices, please contact us at: support@heyluna.com