Privacy policy

Who is responsible

Lunaway is published by AxiomTeam, the controller of the processing described here. For a question, or to exercise your rights: contact@lunaway.net. The publisher's postal address is in the legal notice.

This policy covers the Lunaway app (Android, and the web version at lunaway.net/app), this site, and our servers: api.lunaway.net for data and photos, tiles.lunaway.net for the basemap.

On your device

The app keeps its data in its own storage, which other apps cannot read:

• The places, copied from our server for the whole of France, so that the map, the search and the place pages work without a network, with the photos and the first page of reviews of the places you opened.
• Your own data: your favourite lists, your settings (language, filters, theme, preferred navigation app) and your vehicle profile (type, trailer, height, width, length, weight).
• An approximate position, rounded to a tenth of a degree (about ten kilometres), so that the light or dark theme follows sunset from the next launch.
• Your account's private key, if you have an account, in the protected storage the system provides (the Android Keystore, for instance). It never leaves the device.

On Android, your device backup, which goes to your Google account, may contain your favourites, settings and vehicle, and nothing else from Lunaway. The app allows it only when that backup is end-to-end encrypted, which Android offers from version 9 when the screen is locked; Android 7 and 8 do not know this condition and follow their own backup settings. A transfer to a new phone carries the same data. On a computer, your backups may also contain the app's data, depending on their settings.

In the web app, this data sits in the storage your browser keeps for lunaway.net. Uninstalling the app, or clearing the site's data in the browser, erases all of it.

What goes through our servers

The app connects only to our servers, always over HTTPS. It embeds no third-party service: no advertising, no audience measurement, no crash reporting service, no basemap or font loaded from elsewhere. Only the links you choose to open (OpenStreetMap, your navigation app, the source code) lead to other sites.

With or without an account:

• Syncing places asks for the changes of a whole region, France today. It says nothing about where you are.
• Opening a place asks for its reviews and photos. The content of these requests is neither stored nor logged; the access log keeps the address of the photo files downloaded (see Logs).
• The basemap comes from tiles.lunaway.net. Each piece of map shown covers an area: the log keeps only its zoom level, never the area.
• Directions, a feature in preparation: the start, the destination, the stops and the vehicle's dimensions travel in the body of the request. Our own engine computes the route on our server, and neither the request nor the route is stored or logged.
• Roadworks and road closures, a feature in preparation: during guidance, the app downloads the changes for the whole of France every three minutes. The request contains no location.
• Search for places and towns runs on the device. When the web app asks our server instead, the text searched and the centre of the map, used to rank the results, travel in the body of the request, and are neither stored nor logged.
• Search for shops and services asks our server: the text searched and the centre of the map, rounded to about 5 km to rank the results, travel in the body of the request, and are neither stored nor logged. Your position is not part of it: the distances shown are computed on the device.

Your account, without email

Browsing the map needs no account. The app creates one the first time you contribute (a rating, a review, a photo, a confirmation, a report, a place) or choose to sync your favourites, which are then imported into it.

The account rests on a key pair created on your device. Our server keeps:

• the public key of each device linked to the account, with the dates it was created and last used;
• a randomly drawn pseudonym, such as "Curious Hedgehog of the Vercors", which you can change and which is public;
• your sessions: a random token of which we keep only a fingerprint (SHA-256), valid for 60 days after its last use, erased within the hour after it expires;
• the fingerprint of your recovery code (argon2id), if you created one. The code is shown only once, on your device, and we cannot recover it;
• your trust level, from 0 to 4, computed from the account's age, the number of days it was used, its published contributions and the removals decided by moderators, as well as the sponsorships given or received;
• your synced favourite lists and the authors you chose to mute.

If an account is banned for abuse, the reason for the ban is recorded with it.

What you publish

The places, with their additions and edits, form an open database under the ODbL 1.0, like OpenStreetMap, whose data it includes. Reviews and photos are published under CC BY 4.0, credited to your pseudonym. For each new place or edit, our server also keeps a revision that links it to your account; it is not public.

Photos. A photo travels to our server as it is on your device, with its metadata, including the GPS position if the device recorded one. The server decodes it, then re-encodes it from the pixels alone into two WebP files (2048 and 512 pixels on the long side): no metadata survives, no position, no date, no camera model. The original is not kept.

Road reports. A report stores, linked to your account, the place reported, your direction of travel, the kind of event, the height or width given and the time. These records are not public. They decide whether the event blocks everyone's routes, which takes two accounts of level 1 or more, and serve moderation. They are deleted after 14 days, or with your account. Put side by side, one account's reports would show where it has been: the published event therefore carries neither your name, nor the exact place, nor the exact time.

What your contributions show. Your reviews and photos are public with your pseudonym, and a stable account identifier links them together. Put side by side, with their dates, they can show where you have been. The date of visit of a review is optional.

Moderation. Texts go through simple automatic rules (links, contact details, repetition, a word list). A text that trips them waits for a moderator before it is published. A review or a photo reported by three trusted accounts is hidden until a moderator decides. Moderators, the publisher and the contributors it appoints, read reported content and the notes attached to confirmations and reports.

You can delete each of your contributions, or your whole account: the Delete my account page details what goes and what stays.

Your location

If you allow it, the app reads the device's location to show where you are on the map, compute distances and follow sunset. These computations run on the device, which keeps only a position rounded to about ten kilometres. The app does not ask for background location access.

Your location leaves the device in two cases only. Directions asked from where you are carry it in that request alone, which is neither stored nor logged. A road report stores it, as described in What you publish. "Still there?" confirmations contain no location. You can withdraw the permission at any time in the system settings.

Logs and abuse limits

Like any web server, ours record the requests they receive, for security and troubleshooting:

• The access log records the date, the method, the path requested without its parameters, the response, and the headers sent by the app or the browser (its version, its language), with a truncated IP address: the first two numbers of an IPv4 address (203.0.113.7 becomes 203.0.0.0), the first 32 bits of an IPv6 address. It records no port, no cookie, no session token, no request content, and not the area of map pieces. It is erased after 14 days.
• The servers' system journal (starts, errors) truncates addresses the same way and is emptied after one month at most. Our API writes to it, for each request, only the method and the path.
• The abuse limits (numbers of requests, connections, account creations, recovery code attempts) count per IP address, or per block of addresses for IPv6, in the server's memory only: they are never written down, and a restart resets them.

Backups

So that the service can be brought back after a failure, the database is copied every night, and so is every new photo:

• on the main server for 7 days, and in the daily backup images of that server at Hetzner, kept for 7 days;
• encrypted with age, on a second server at Hetzner in Nuremberg for 14 days, then on a computer of the publisher, the only holder of the decryption key, for 29 days.

Data deleted from the database, or a deleted photo, thus leaves every backup within 30 days at most.

The deletion of an account is also noted, with the account's identifier and the time, in a journal kept outside the copies of the database for 45 days at most; an encrypted copy of it is made every hour and leaves every night with the backups, where it replaces the previous one (46 days at most). If a failure makes us bring a backup back into service, the account deletions made since its date are applied again before the service resumes. One failure escapes this: the loss of the server's data disk itself. The deletions made after the last copy collected away from that server (up to about 25 hours) would then come back with the backup.

Hosting and providers

• Hetzner Online GmbH (Germany) hosts our servers in its data centres in Falkenstein and Nuremberg: the API, the database, the photos, the basemap and this site.
• Infomaniak Network SA (Switzerland) receives the emails sent to contact@lunaway.net. Switzerland is covered by an adequacy decision of the European Commission.
• Cloudflare runs the domain names of lunaway.net, as DNS only: it gives the address of our servers, then the traffic goes straight to us, without passing through it.

The basemap is built by Protomaps from OpenStreetMap, then copied and served by our own server. Neither the app nor this site loads maps, fonts or scripts from another host. If you install Lunaway through Google Play or F-Droid, those services handle the download data under their own rules.

We do not sell, rent or share any data, for advertising or any other commercial use.

Retention

Legal bases

• Providing the service you ask for (article 6(1)(b) of the GDPR): syncing places, the account, your contributions, your synced favourites, directions.
• Our legitimate interest in protecting the service and its users (article 6(1)(f)): logs, abuse limits, moderation, backups.
• Your consent, given to the system, for reading the device's location (article 6(1)(a)): you can withdraw it at any time.

Your rights

The GDPR gives you the right to access your data, to have it corrected or erased, to restrict its use, to object to its processing and to receive it in a reusable format.

• In the app, your profile shows your pseudonym, which you can change, your level and your contributions, which you can delete one by one.
• You can delete your whole account in the app or with your recovery code.
• For any other request, write to contact@lunaway.net. We answer within one month.

Your account is linked to no email address: before answering a request, we must check that the account is yours, for instance by asking you to change your pseudonym in the app to a word we give you.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, online at cnil.fr or by post: CNIL, service des plaintes, 3 place de Fontenoy, 75007 Paris, France. You can also contact the authority of the EU country where you live.

Audience and changes

Lunaway is meant for adults.

When this policy changes, the new version appears on this page with its date. The page's history is public in the code repository, at infra/web/site/en/privacy.html.

Version of 6 October 2026.