Privacy Policy

Lunar Studios is creator software for TikTok LIVE and related creator workflows. The product includes marketing pages, account sign-in, a signed-in workspace and dashboard (including Account Security for password changes and optional authenticator MFA), OBS-ready overlay browser sources, engagement hubs (such as sound alerts, TTS, Actions and Events, giveaways, auctions, chatbot, points, song requests, and webhooks), analytics and My LIVE history, Studio editing tools, optional cloud backups, optional LIVE recording or VOD features where enabled, Creator subscription billing, and the Lunar Desktop application that loads the same product surfaces.

This Policy applies to information processed in connection with:

• Websites and domains we operate for Lunar Studios (including lunarstudios.org and related app or API hosts we publish)
• The Lunar Studios dashboard, workspace, and authenticated APIs
• Overlay and widget URLs you place in OBS or other broadcast software
• The Lunar Desktop app when you sign in with a Lunar account
• Communications and support interactions related to Lunar Studios

This Policy does not control the privacy practices of TikTok, Discord, Twitch, Spotify, Stripe, OBS, Cloudflare, Supabase, or other third parties. Those services have their own policies. When you connect or use them, their terms and privacy notices also apply.

Related documents: our Terms of Service govern use of the product. Pricing and plan details may be described on Pricing and in the billing area of your workspace.

For purposes of this Policy, "Lunar Studios," "we," "us," and "our" refer to the operator of the Lunar Studios product described on our websites. If you need to contact us about privacy, use the methods in Section 24 (Contact).

Depending on how a feature works, we may act as a controller of account and product data you provide to us, and in some cases as a processor of stream or viewer-related data that you configure the product to process on your behalf while you stream. You remain responsible for complying with applicable laws for your stream, your audience, and any disclosures you owe to viewers under platform rules or local law.

In this Policy:

• Personal information means information that identifies, relates to, describes, or could reasonably be linked with an identifiable person.
• Account data means information tied to your Lunar Studios user profile and sign-in.
• Connected accounts means third-party identities you link (for example Discord, TikTok, Twitch, or Spotify).
• Product configuration means settings, layouts, rules, media references, webhook endpoints, and similar data you save so features work across sessions.
• LIVE event data means stream signals and derived records processed while a LIVE or connector session is active (for example gifts, follows, likes, comments, joins, and feature outcomes such as points or giveaway entries).
• Service providers means vendors that help us host, secure, process payments, store files, or operate the product under our instructions.

The categories below describe information we may collect depending on how you use Lunar Studios. We do not require every category for every user. Optional connections and optional features only create additional data when you enable them.

4.1 Account and authentication. When you create or use a Lunar account, we collect and store information such as:

• Email address
• Authentication credentials handled by our auth provider (we do not store your password in plain text; password hashing and credential storage are performed by Supabase Auth)
• Optional multi-factor authentication (MFA) enrollment records when you enable an authenticator app (TOTP), including factor identifiers, status, and related challenge metadata needed to verify codes at sign-in and for sensitive account actions such as password changes
• Internal user identifiers and profile records needed to keep you signed in and associate settings with your account
• Session tokens or sealed session cookies that recognize your signed-in browser or desktop window
• Short-lived security cookies used only during MFA enrollment or MFA sign-in challenge steps
• Account timestamps such as creation or last activity where our systems retain them for operations and security

Authenticator apps on your device generate MFA codes using a shared secret provisioned during enrollment (shown as a QR code labeled with issuer "Lunar Studios" and your email). We verify codes you submit; we do not receive the ongoing stream of codes from your authenticator except when you enter one to authenticate.

4.2 Profile and contact details. You may provide a display name, email used for billing or account notices, or other profile fields available in the product. If you subscribe, we may associate a billing email with your subscription records.

4.3 Connected platform identities. If you connect Discord, TikTok, Twitch, Spotify, or similar providers, we may store:

• Provider user or account identifiers
• Username, handle, display name, and avatar URL when provided
• OAuth access tokens, refresh tokens, scopes, expiry metadata, and related connection status
• Manual LIVE settings you enter (for example a TikTok LIVE username or room handle used by the connector)
• Connection preferences such as whether a LIVE connector is enabled

Token material is treated as sensitive. Where implemented, tokens may be encrypted at rest using application secrets. You can disconnect linked providers from Connections where the product exposes that control.

We collect information in these ways:

• Directly from you, when you sign up, sign in, edit settings, connect accounts, subscribe, upload media, or contact us
• From connected platforms, when you authorize OAuth or when LIVE connectors deliver events for rooms you enable
• Automatically, through cookies, local storage, logs, and similar technologies when you use websites, overlays, APIs, or the desktop app
• From service providers, such as Stripe payment events that confirm subscription status, or storage providers that acknowledge uploads

We use information to:

• Create and secure accounts, authenticate users, and maintain sessions
• Support optional MFA enrollment and verification, password changes from Account Security, and related account-security controls
• Provide, operate, personalize, and improve overlays, alerts, hubs, Studio, analytics, desktop features, and related tooling
• Process LIVE events and apply the rules, alerts, and automations you configure
• Remember settings across browsers and devices that share your account
• Connect optional services you authorize and keep those connections working (including token refresh where supported)
• Process Creator subscriptions, show billing status and invoice history, handle cancellations or resumptions, and enforce plan entitlements and quotas
• Store optional backups, recordings, or media objects you choose to upload
• Diagnose failures, monitor reliability, prevent fraud and abuse, and secure the service
• Communicate about account, billing, security, or material product changes when needed
• Comply with law, enforce our Terms, and respond to lawful requests

We do not sell your personal information. We do not use your content to build advertising profiles for third-party ad networks as part of the core Lunar Studios product described in this Policy. Marketing pages are not designed around advertising cookies.

If you are in a jurisdiction that requires a legal basis for processing (for example the EEA or UK), we generally rely on one or more of the following, depending on the activity:

• Contract: processing needed to provide the service you request (account, overlays, LIVE tools, Studio, billing fulfillment)
• Legitimate interests: securing the service, preventing abuse, understanding reliability, and improving features in ways that do not override your rights
• Consent: where we ask for consent, such as optional connections or optional features that require it under local law
• Legal obligation: when we must retain or disclose information to comply with law

Where processing is based on consent, you may withdraw consent by disconnecting the feature or account connection, subject to technical limits and any records we must keep for security, billing, or legal reasons.

We use cookies and similar technologies for essential product operation and local functionality.

8.1 Session and authentication cookies. We use a session cookie (or equivalent sealed cookie) so we can recognize signed-in users across page loads. Without this, dashboard and account features cannot work normally. During MFA setup or an MFA sign-in challenge, we may also set a short-lived httpOnly cookie to complete that security step, then clear it when the step finishes or expires.

8.2 Local storage, IndexedDB, and OPFS. Studio and some dashboard features use browser storage to keep projects, media, caches, or client preferences on the device. Clearing site data can delete local Studio projects and related files.

8.3 Preference and continuity storage. We may store small client-side values that remember UI state (for example last selected tab) to improve usability.

8.4 Analytics and advertising cookies. Marketing pages do not rely on advertising cookies. If we add optional analytics tools in the future that use non-essential cookies, we will update this Policy and provide notices or controls where required.

You can control cookies through your browser settings. Blocking essential cookies may prevent sign-in or break core features.

Overlay and widget URLs are designed to be loaded as browser sources in OBS or similar tools. Treat those URLs like credentials for your stream widgets. Anyone who has the URL may be able to load the widget and see information the widget is configured to display.

Do not post private overlay URLs in public chats or social posts unless you intend that surface to be public. If an overlay URL is exposed, rotate or regenerate it where the product allows, and update OBS.

Some overlay pages are intentionally reachable without a dashboard login so OBS can load them. Access control is primarily URL secrecy plus any token or room binding the product implements. This is different from your signed-in workspace, which requires authentication.

We share personal information only as described below, not for sale.

10.1 Service providers. We use vendors to operate Lunar Studios. Categories include:

• Hosting and databases (for example Supabase / Postgres infrastructure used for accounts and product data)
• Authentication (Supabase Auth for email and password accounts)
• Payments (Stripe for Creator checkout, subscriptions, invoices, and payment webhooks)
• Object storage and edge delivery (for example Cloudflare R2 or Workers for desktop downloads, VOD objects, or similar assets where enabled)
• Application hosting and networking providers that serve the website, APIs, and overlays

Service providers are permitted to process information to perform services for us, not to use it for their own unrelated marketing.

10.2 Connected platforms you authorize. When you connect Discord, TikTok, Twitch, Spotify, or similar services, we exchange data with those platforms as needed to complete OAuth, refresh tokens, read permitted profile fields, join or process LIVE rooms you enable, or control playback features you request. Their policies govern their handling of data.

10.3 Destinations you configure. Webhooks, Discord webhook posts, IFTTT, Streamer.bot, and similar outbound integrations send data to endpoints you provide. You are responsible for those destinations and for any personal information included in the payloads your rules send.

10.4 Legal and safety disclosures. We may disclose information if we believe in good faith that disclosure is reasonably necessary to:

• Comply with law, regulation, legal process, or governmental request
• Enforce our Terms or investigate potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of Lunar Studios, our users, or the public

10.5 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to continuing confidentiality and privacy commitments where required.

10.6 With your direction. We may share information when you ask us to or when a feature you use requires a specific disclosure to complete your request.

Creator billing uses Stripe Checkout, Payment Element, subscription APIs, customer objects, invoices, and webhooks. Stripe may collect identity, payment method, and transaction details directly from you. We receive confirmation events and store subscription and invoice references needed to unlock features and show billing history.

For Stripe's practices, review Stripe's privacy documentation on stripe.com. Tax invoices, receipts, and payment method updates may also be available through Stripe-hosted invoice or receipt pages linked from your Lunar billing history.

Studio is designed so project media and timeline state can live primarily on your device. Optional cloud backup features, when you use them, upload project or image documents associated with your account so you can restore later. Backups may include project structure and referenced assets depending on the feature implementation.

We do not claim ownership of your creative projects. You are responsible for having rights to media you import, edit, back up, or export. Deleted local projects may remain in cloud backups until you delete those backups where the product provides controls, or until retention processes remove them.

The desktop app is an Electron (or similar) shell over Lunar Studios web surfaces, plus local helpers for features such as OBS bridging, local device detection, installer updates, or VOD upload where enabled. Sign-in uses the same Lunar account model. OAuth may complete in the desktop window or via a handoff flow that sets a session cookie for the desktop WebView.

Auto-update checks may contact our download or release endpoints and can include version metadata for your installed app. Installers may be hosted on object storage with a public download URL.

Lunar Studios may be operated from the United States and may use infrastructure and vendors in the United States or other countries. If you access the service from outside the country where our servers or vendors are located, your information may be processed in a country that has different data protection laws than your home country.

Where required, we use appropriate transfer mechanisms offered by our providers (such as standard contractual clauses or equivalent safeguards) for cross-border processing.

We retain information for as long as needed to provide the service, maintain secure accounts, satisfy billing and accounting needs, resolve disputes, and comply with legal obligations. Practical retention patterns include:

• Account and configuration data: kept while your account remains active and for a reasonable period afterward if needed for security, abuse prevention, or legal claims
• Connected account tokens: kept while the connection remains enabled or until refresh fails and the connection is marked broken; disconnecting removes or invalidates tokens where technically feasible
• LIVE session and analytics history: retained according to product and plan limits (Free plans may show shorter windows than Creator)
• Billing records: retained as needed for subscription lifecycle, invoices, taxes, and bookkeeping
• Local Studio data: retained on your device until you delete it or clear site storage
• Cloud backups and VOD objects: retained while associated with your account or until you delete them / until operational cleanup removes orphaned objects
• Logs: typically retained for shorter operational windows unless needed for security investigations

When we no longer need personal information, we delete it or de-identify it, except where retention is required by law or needed for legitimate security or dispute purposes.

We implement administrative, technical, and organizational measures designed to protect personal information, such as encrypted transport (HTTPS), access-controlled servers, session cookies, hashed passwords via our auth provider, optional authenticator MFA (TOTP), MFA checks for sensitive actions like password changes when MFA is enabled, and encryption of certain sensitive token fields where implemented.

No method of transmission or storage is completely secure. You can help protect your account by using a strong unique password, enabling MFA in Account Security, signing out of shared devices, protecting overlay URLs, and limiting who can access your stream PC and OBS profiles. If you lose access to your authenticator device, contact us so we can help verify ownership and restore access where appropriate.

If we become aware of a security incident that requires notice under applicable law, we will provide notice as required.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of certain personal information, to object to or restrict certain processing, or to withdraw consent.

In-product controls. You can often:

• Update account profile details where editable
• Change your password and enable, verify, or disable authenticator MFA from Account Security
• Connect or disconnect Discord, TikTok, Twitch, Spotify, and similar
• Change or delete product configurations you own
• Cancel or resume Creator subscription from Billing (where available)
• View invoice history and Stripe-hosted invoice or PDF links
• Delete local Studio projects from the browser or clear site data
• Delete cloud backups where the product exposes delete controls

Requests to us.To request access or deletion of account data we hold, contact us using Section 24. We may need to verify your identity (for example by confirming control of the account email) before fulfilling a request. We may decline requests that are unlawful, repetitive, or would impair security, freeloading prevention, billing records we must keep, or other users' rights.

If you delete your account, residual copies may remain in encrypted backups or logs for a limited time until overwritten, and we may retain limited records as required for law, fraud prevention, or accounting.

If you are a resident of California or another US state with a comprehensive privacy law (for example Virginia, Colorado, Connecticut, Utah, or others as enacted), this section provides additional information.

Categories collected. Depending on your use, we may collect identifiers (email, account IDs, handles); commercial information (subscription status, invoice metadata); internet or electronic activity (usage logs, LIVE session metrics, product configs); approximate geolocation derived from IP; audiovisual media you upload to Studio or VOD features; and professional information you choose to include in creator settings.

Sources. You, your devices, connected platforms, and service providers.

Business or commercial purposes. The purposes in Section 6, including providing the service, security, billing, and debugging.

Sale and sharing. We do not sell personal information as that term is commonly understood, and we do not share personal information for cross-context behavioral advertising. If that changes, we will update this Policy and provide required opt-out mechanisms.

Sensitive personal information. We do not use sensitive personal information for purposes that require a right-to-limit control beyond what is necessary to provide the service you request.

Your requests. Eligible residents may request to know, access, correct, or delete certain personal information, and to appeal a denied request where state law provides an appeal. Contact us as described in Section 24. We will not discriminate against you for exercising privacy rights.

If European or UK data protection law applies to our processing of your personal data, you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. You may also have the right to withdraw consent where processing is consent-based.

Because Lunar Studios is creator tooling that can process viewer interaction data during your LIVE, you may have independent controller obligations to your audience under local law and under TikTok or other platform rules. Configure features thoughtfully and provide any disclosures your jurisdiction requires for stream tools.

Lunar Studios is aimed at creators who meet the minimum age requirements of Discord, TikTok, Twitch, Spotify, and any other platform they connect, and who are old enough to agree to our Terms where they live. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions that set a higher digital consent age for this type of service).

If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it where required.

Lunar Studios uses automated processing to run the features you configure (for example matching a gift to a sound alert, awarding points, or selecting a giveaway winner according to your rules). These automations are part of the product experience you enable. We do not use automated decision-making to determine legal eligibility for essential services outside the product rules you set and plan entitlements tied to billing status.

The product may link to third-party sites or open third-party checkout, invoice, OAuth, or documentation pages. We are not responsible for the content or privacy practices of those third parties. Review their policies before providing information to them.

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If changes are material, we may provide additional notice in the product or by email when appropriate. Continued use of Lunar Studios after an update means you accept the revised Policy, except where applicable law requires a different standard (such as explicit consent for certain changes).

Questions about your data or these terms? Sign in or create a Lunar Studios account with email and password.

For privacy requests, include the email on your Lunar account and a clear description of what you need (access, correction, deletion, or a question about processing). We may ask for additional verification before acting on account-data requests.

See also our Terms of Service and Pricing.