Privacy Policy

Effective 5 September 2026 · getnaluno.com

This Privacy Policy explains what Naluno collects, why, who can see it, and how long it stays. It is written in ordinary language on purpose. If a sentence here does not match what the app actually does, the app is wrong — not this page — and we will correct the app.

1. Who we are

Naluno is the service at getnaluno.com. It is a place to be reachable without handing over a phone number. This policy applies to the website, the installable web app, and the Android shell of the same app.

2. What this app is not

Naluno does not ask for a phone number or a SIM card. It does not sell your personal information. Contribution points inside the app are not money and are not a payment. Creator Support is not live: nothing is charged today.

3. The account you create

To use Naluno you create a Callsign. That can be a handle and password (no email required), with an optional recovery email; Google sign-in; or an email and password. Sign-in is provided by Google Firebase Authentication. We store your user id, display name, handle, tagline, avatar, colour, and the settings you choose. We do not receive your Google password.

4. People you connect with

Frequencies are connections you make on purpose — search a handle, accept a request, or Spark in person. We store those connections so both of you can see each other, message, and call. We do not scrape your phone’s address book.

5. Messages

Wireline (one-to-one) uses end-to-end encryption. The chat database lives on this phone (IndexedDB — the browser’s equivalent of SQLite). The server holds an encrypted drop only until the other phone copies it, then that drop is deleted. Naluno can still see that a conversation exists, who the two people are, and roughly when something last moved — not the words. A new phone starts empty unless a copy is opened from Chat backup on Wireline. Photos that are too large for the drop are parked on Cloudflare R2 so the other phone can fetch them; that file is a holding tray, not the archive. Band is unchanged: a room, wiped about 2 hours after it is empty.

Band is a shared room. While people are in the square, messages and clips are stored so everyone there can see them. When the last person leaves, the gathering is deleted after 2 hours. After that wipe, those messages are removed and are not readable.

6. Video and photos you publish

Signal is a short clip meant to fade — about a day, then removed. Broadcast stays until you delete it. Live video is a real-time call between devices; Naluno does not keep a copy of the live picture as a file unless you publish a Broadcast. Media files are stored on Cloudflare R2 through Naluno’s own upload workers. Copyright in what you create stays with you.

7. Calls

A call uses WebRTC between the two phones. The picture and sound of the call are not stored by Naluno. Incoming-call alerts use Firebase Cloud Messaging if you allow notifications.

8. Location

Location is off unless you turn it on. Find Naluno is only for your devices on your account. Weather uses this phone’s place so the reading matches where you are. We do not build a location history for weather.

9. Compass

Compass is a private notebook plus an assistant. Messages you type there are stored on your account. You can lock Compass with a password on the device. The people who run Naluno cannot read that notebook. If you use Write to Naluno or Ask to delete my account, that one request is sent to them — not the rest of the conversation.

10. Diagnostics

The app keeps a short error log on this device so a break can be copied and sent. That log does not upload by itself.

11. Who we share with (processors)

Google Firebase (accounts, database, push), Cloudflare (file storage and edge workers), Open-Meteo (weather), a reverse-geocoder for place names, and a TURN/STUN provider so a call can connect. We do not sell lists of people.

12. How long we keep it

• Account and Callsign — until you delete the account.
• Wireline — on this phone after delivery. Encrypted drops on the server last until the other phone takes them, or about 7 days, whichever is first.
• Band — deleted about 2 hours after the room is empty.
• Signal media — about 25 hours.
• Broadcast — until you delete it.
• Find Naluno pings — replaced by the next ping.

13. Your choices

You can edit Callsign, remove a photo, turn Find Naluno off, hide the weather strip, lock Compass, refuse notifications, and sign out. You can ask us to delete an account from Compass (Ask to delete my account) or from the contact form on getnaluno.com. That request is read by a person. The account is then closed by hand — it is not instant.

14. Children

Naluno is not for children under 13. If you are 13–17, use it only with a parent or guardian’s permission where your country requires that.

15. Security

We use HTTPS, Firebase rules, and encryption on Wireline. Protect your password. If you use Google sign-in, write down the recovery code for encrypted messages — we cannot reset that for you.

16. Outside your country

Firebase, Cloudflare, and the weather services may process data in the United States or other countries.

17. Changes

If this policy changes in a way that matters, we will update the date at the top and, when the change is large, show a notice in the app.

18. How to reach us

Use the contact form on getnaluno.com, or Compass after you sign in (Write to Naluno). Say that your message is about privacy so it is treated as one. The mailbox itself is not published on the website.