Privacy Policy
The short version. Lunra has no account and no login. Your transactions live in a database file on your Mac and are never uploaded. The app does talk to us: it registers itself when it launches, and it reports anonymous usage events made of counts and fixed labels with no content in them. Nothing from inside your statements is sent unless you import one.
When you do import one, the text of that statement is sent to an AI model to be read, because the model runs on a server rather than on your Mac. The PDF file itself is never uploaded. Identifying details are stripped from the text first — what exactly, and what is missed, is spelled out below.
What stays on your Mac
All of the following is written to Lunra's application data folder on your Mac and is never sent anywhere by the app:
- Your transactions, categories, budgets and rules. A plain SQLite database. It is a standard, readable format — you can open it with any SQLite tool, and Time Machine backs it up like any other file.
- The full text of every statement you import. Retained in that same database alongside each statement, so the app can show you the raw line behind a parsed transaction.
- Your statement PDFs and receipt images. Read in place from wherever you keep them. Lunra records the file path but never copies or uploads the file.
- Your settings and preferences. Including your chosen model and base currency.
There is no Lunra account, so none of this is associated with an identity we hold. We cannot read any of it, and we have no ability to recover it for you if you lose it.
Where your API key is stored
If you add your own Anthropic API key, it is stored in Lunra's application data on your Mac and sent only to Anthropic, as the credential for your own import requests. We never receive it.
It is not yet stored in the macOS Keychain. Moving it there is planned but not done. Today it sits in Lunra's local application data, which means any program running under your macOS user account, or anyone with access to your unlocked Mac, could read it.
Treat it as you would any other file on your machine. We recommend setting a monthly spend cap on the key in the Anthropic console, and revoking it there if your Mac is ever lost or shared.
What leaves your Mac
Lunra makes network requests to exactly three destinations. There are no others.
| Goes to | What is sent | When |
|---|---|---|
| Anthropic | The redacted text of the statement you are importing, and the reply containing the structured transactions. | Only when you import a file. |
| Lunra | On the free tier, the redacted statement text, relayed to Anthropic on our key. On every build: a generated device identifier, the platform (macOS) and the app version at registration, so the free monthly allowance can be counted; the same platform and app version once per launch, to learn whether a newer version of Lunra is available; the anonymous product events described below, which carry counts and fixed labels only; and, if you send feedback or a bug report from the sidebar, the text you wrote, an email address if you chose to give one, the platform, the app version and the same device identifier. Nothing from your transactions is included in a report. | Statement text only when you import a file without your own key. Registration and events whenever the app is open and in use, and the update check once at launch. Feedback only when you press Send. |
| Frankfurter (exchange rates) |
A currency pair and a date — for example CAD, USD, 2026-07-15. No transaction, amount or personal data is included. |
When converting a foreign-currency transaction. |
If you use your own API key
Requests go straight from your Mac to Anthropic. Lunra is not in the path, we see nothing, and we receive no device identifier for those imports. You pay Anthropic directly at their rates.
If you use the free tier
Your first three statements each month are parsed on our key, which means the redacted text passes through our service on its way to Anthropic. We keep it only for as long as the request takes and do not store it afterwards. The device identifier is random and is not linked to your name, email or any account, because there is no account — it exists solely to count the three-per-month allowance.
What the model provider does with it
The model is Claude, made by Anthropic. Anthropic's API terms state that API inputs are not used to train their models. Their handling is governed by their own privacy policy, not this one, and you should read it if that matters to you: anthropic.com/legal/privacy.
What is removed before text is sent
Statement text is put through a redaction step before it leaves your Mac. It replaces:
- Card and account numbers, keeping only the last four digits, which the app needs to tell your accounts apart
- Labelled routing, transit and ABA numbers, on the same last-four basis
- Social security numbers
- Account-holder names, where the statement labels them — "Account Holder", "Cardholder", "Name on Account" and similar
- Postal addresses in US format
Be clear about what this does not cover. Redaction is pattern-based, so it catches common statement layouts and will miss unusual ones. In particular it does not remove your balances, and its address matching recognises US ZIP codes but not Canadian or other postal-code formats.
By design it also does not remove the things the product exists to read: merchant names, transaction descriptions, amounts and dates. Those are the transactions themselves. If a statement contains something you would rather not send, do not import it.
What Lunra does not do
- No crash reporter, and no analytics that watches you use the app. Lunra reports a small, fixed set of anonymous usage events — which parts of the app get used, and how imports go — and nothing that records a session, a screen or an interaction. What they contain, and what they deliberately do not, is in Product events from the app below.
- No bank credentials. Lunra never asks for, and cannot use, your online banking login. There is no aggregator and no bank connection.
- No ads in the app, and nothing from it sold or shared. Nothing you import, and nothing the app records, is sold, rented or handed to anyone for their own purposes. This site carries an advertising pixel, described under This website; it sees this site and never the app.
- No account, no profile, no email list. Unless you join the waitlist on this site, in which case we hold your email address and nothing else.
- No content in what phones home. The app contacts our service when it launches, to register the device, and again as you use it, to record those events. Every one of those requests carries counts and fixed labels and nothing else — never a merchant, an amount, a category name, an account name, a file name, or anything you typed.
Product events from the app
The app records a short, fixed list of anonymous events so we can tell which parts of it are actually used: that it was opened, that an import was started and how it ended, that a filter was changed, that a category was created, renamed or deleted, and which link took you from the dashboard to your transactions. That is the whole list, and it is written out in the source.
What those events carry is deliberately narrow. Counts — how many files were queued, how many transactions a statement produced, how many of them you kept, how many corrections you made before importing. Durations, rounded to the second. Labels drawn from a short fixed vocabulary we wrote, such as drag_drop, free_tier or date_preset. Nothing else.
They never carry a merchant name, an amount, a date from your statement, a category or account name, an institution, a file name, or anything you typed. If you use the search box, the event says that a search happened and roughly how long the query was — not what you searched for. If you filter to a category, it says how many categories you picked — not which ones.
The events go to our own service and are forwarded from there to Amplitude. Each one is attributed to the same random device identifier the free-tier allowance uses, described above. It is not linked to your name, email or any account, because there is no account.
The app also carries Amplitude’s own SDK, and from version 0.2.3 it sends each of those events a second time, directly, alongside the copy that goes through our service. Both carry one shared identifier, so the pair is counted once. The list of events does not change and neither does what they contain — what the direct copy adds is the context only a client can see: the session, the operating system and the app version, and the IP address the request arrives with, from which Amplitude derives an approximate location. It sets no cookies; what it keeps, it keeps in the app’s own storage.
Blocking api2.amplitude.com at your firewall stops the direct copy on its own. Nothing else in the app depends on it.
There is no switch to turn this off. It is a small set of events with no content in them, and keeping it on for everyone is what makes the numbers mean anything. If you would rather send nothing at all, blocking api.stackwire.app at your firewall stops it — the free statement allowance stops working too, and the app falls back to your own Anthropic key.
This website
This site records anonymous usage events — page views, how far down a page you read, which buttons get clicked, whether the waitlist form succeeded — through Amplitude, so we can tell which parts of the page are working. If the link that brought you here carries campaign tags (utm_ parameters), those are recorded with the events too; they describe the ad or link, not you.
Those events carry a random identifier that is created when you arrive and held in your browser’s session storage. It contains nothing that identifies you, and it is discarded when you close the tab, so a later visit is not linked to this one. Amplitude also receives the IP address and browser user-agent the request arrives with, derives an approximate location from the IP, and records the page you were on and the one that referred you. Your email address is never sent there.
The events are sent by Amplitude’s own script, which we serve from this domain rather than loading it from theirs. It asks Amplitude for its configuration once when the page loads, and sends events as they happen. Alongside the identifier above it keeps its own copies of the session and any campaign tags in session storage, which go when the tab does, and two items in local storage that outlive it: a cached copy of that configuration, and any event that failed to send, retried the next time you visit. Neither identifies you.
It also carries Reddit’s advertising pixel, so that when we pay for an ad there we can tell whether anyone who clicked it went on to download Lunra or join the waitlist. It is the one thing on this site that sets a cookie, and the one piece of code here that belongs to somebody else: it loads from Reddit and reports to Reddit, which is subject to their privacy policy, not this one. We tell it three things — that a page was viewed, that a download was taken, that the waitlist was joined — and nothing about who did it. Reddit offers to match visitors by email address, and we do not use it: the address you give the waitlist goes to us and stays there. Blocking redditstatic.com, or refusing third-party cookies, stops it without affecting anything else on the page.
The site is served from DigitalOcean Spaces, whose servers record standard access logs including IP addresses, as any web host does. Fonts are loaded from Google Fonts, which means your browser makes a request to Google when you load the page; that request is subject to Google’s privacy policy.
If you enter an email address in the waitlist form, we use it only to tell you when the beta build is ready and when it ships. We will not add you to anything else, and you can ask us to delete it at any time.
Retention and deletion
Because your data is on your machine, you control retention entirely. Deleting a statement or transaction in the app removes it from the local database. Deleting the app together with its application data folder removes every trace of it, and there is no account left behind to close.
You can export everything to CSV at any time, or take the SQLite file directly. Nothing is locked in.
On our side, the only things we hold are: the redacted statement text during a free-tier request, for the duration of that request; the device identifier and its monthly count, for as long as the device stays registered; the anonymous product events, attributed to that same device identifier; and your email address, if you gave us one, until you ask us to remove it.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete personal data an organisation holds about you, and to complain to a data-protection regulator. Since Lunra keeps your financial data on your own device rather than on our servers, most of those rights you exercise directly through the app. For the few things we do hold — a waitlist email address, a device identifier — write to us and we will action it.
Children
Lunra is not directed at children and is not intended for use by anyone under 16.
Changes to this policy
If we change how any of this works, we will update this page and move the date at the top. Material changes — a new destination that data is sent to, or a change to what is retained — will be called out in the app's release notes rather than quietly edited in here.
Contact
Questions, corrections, or a deletion request: [email protected].