Security
Your journal can hold some of the most personal information there is, so security isn't an afterthought at Luma - it shapes how the app is built. Here's what we do, in plain language.
Protecting your data
- Encrypted in transit. All traffic between your device and Luma is encrypted with HTTPS.
- Encrypted at rest. The database where your journal lives encrypts data on disk.
- Accounts are isolated. Database-level security rules mean each account can only ever reach its own data - this is enforced by the database itself, not just the app.
- Passwords are hashed. We never store or see your actual password. At signup we also check (privately, without sending your password anywhere) that it hasn't appeared in known data breaches.
Protecting your account
- You can see where you're logged in. Your profile lists your active sessions, and you can end any of them remotely.
- Sessions expire. Login tokens are short-lived and refreshed automatically.
- Abuse protection. Rate limiting protects the service and your account from being hammered.
How we operate
- Minimal data sharing. A small set of providers each get only what they need - the full list is in our Privacy Policy.
- No outside trackers. No advertising or third-party analytics scripts run in the app. We keep our own private record of how the app is used - actions like opening a screen or finishing a check-in, never your journal content - and it stays in our own systems.
- Regular reviews. We run security reviews of the code and infrastructure and fix what we find.
- Modern browser protections. The app ships strict security headers, including a Content Security Policy, to defend against common web attacks.
Found a security issue?
We'd genuinely like to hear about it, and we appreciate responsible disclosure. Please tell us privately through the contact form with enough detail to reproduce the issue, and give us a reasonable chance to fix it before sharing it publicly.