Privacy
Privacy policy
Last updated 14 November 2026. Applies to the sol-lune apps for iPhone, iPad and Apple TV, and to this website.
The apps
sol-lune does not collect your data, because sol-lune has nowhere to put it. The apps are clients for a server that you own and operate. We run no service that your media, credentials or viewing habits ever reach.
The short version
- We operate no servers that receive data from the apps.
- There is no sol-lune account. You sign in to your own server, with credentials your server issues.
- There is no analytics, no telemetry, no crash reporting SDK, no advertising, and no third-party tracker in the apps.
- We do not sell, share, rent or disclose personal data. The apps send us none.
What the apps store, and where
Everything below stays on your device or on your own server. None of it is transmitted to us.
| Data | Where it lives | Why |
|---|---|---|
| Your server's address | On device | So the app can reconnect without asking again. |
| Authentication token | iOS Keychain, on device | To stay signed in to your server. Issued by your server, never by us. |
| Cached artwork and metadata | On device | So the library loads quickly and works offline. |
| Playback positions and preferences | On device and on your server | To resume where you left off across devices. |
| Media saved for offline playback | On device, in the app's private storage | Offline playback. Removed when you remove the saved copy or the app. |
| Photos you back up | Sent to your server only | Photo backup, when you turn it on and choose what to include. |
Permissions the apps request
Each is optional, requested only when the corresponding feature is used, and can be revoked at any time in iOS Settings. Declining one disables that feature and nothing else.
- Local Network — to discover your media server on your own network via Bonjour.
- Location (while in use) — iOS requires this permission for some local-network discovery. Your location is used for nothing else, is never stored, and never leaves the device.
- Camera — to scan the pairing QR code shown on your server's setup screen, so you don't have to type an address.
- Photo Library — to back up photos and videos you choose to your own server, and to save media from your server to your device.
- Face ID / Touch ID — to unlock the app and the private vault. Biometric data never leaves the Secure Enclave and is never seen by the app.
- HomeKit — to trigger your own scenes when playback starts or stops. Handled entirely on device by Apple's framework.
- Apple Music / Media Library — to play the music library hosted on your own server.
The private vault
The apps include a vault: a locked area for photos and videos you would rather were not visible to anyone who picks up your phone. It is protected by Face ID, Touch ID or a passcode, its contents are excluded from the main library views, and — like everything else — it lives on your own server and your own device. We cannot see inside it, recover it, or unlock it for you or for anyone else.
Third parties
The apps contain no third-party SDKs that collect data. Your server may, at your instruction, contact metadata providers (for example TMDB or MusicBrainz) to enrich your library. Those requests originate from your server, under your configuration, and are governed by those providers' own policies. The apps never contact them directly.
Children
The apps are not directed at children under 13 and we knowingly collect no information from anyone, of any age. Household accounts, per-profile permissions and parental controls are administered by whoever runs the server.
Security
Credentials are held in the iOS Keychain. Connections to your server use whatever transport you configure — we strongly recommend HTTPS with a valid certificate for any server reachable from outside your home network. Because we hold no data, there is no central store of user data to breach.
Your rights
Rights of access, correction, portability and erasure under the GDPR, the CCPA and similar laws are exercised against the party that holds your data. For sol-lune, that party is you: the data lives on your server and your devices, and you can inspect, export or destroy it directly. We hold nothing to hand over or delete. Deleting the app removes every cache, token and saved copy it created.
This website and the beta list
The short version
This website has no advertising, no analytics and no third-party trackers; the only outside script is the Turnstile check on the beta form. The only personal information we hold is what you type into the beta form.
What we collect
- Beta form. Your email address and, if you choose to give them, your name, server hardware and system, the media server you use today, your library size and whether you have a GPU.
- When you signed up. The date and time, and the date and time you confirmed your email.
- Spam protection. The form is protected by Cloudflare Turnstile, which checks that a person is filling it in. Cloudflare processes your IP address and browser details to do that. We also refuse more than a few sign-ups an hour from one network address; that count is held in memory and is not written to the list.
What we do with it
- We send one email asking you to confirm your address. Until you confirm, you are not on the list.
- We email confirmed members about the beta: builds, instructions and questions about how it is going.
- We use the setup details to decide which build suits you and to understand who is testing.
We do not sell this information or share it for marketing.
Who handles it
The website, the form and the list are on hardware we operate. Traffic reaches it through Cloudflare, which carries the request as a network provider and sees your network address. Email goes out through a mail relay acting on our instructions.
How long we keep it
Unconfirmed sign-ups are deleted after 30 days. Confirmed sign-ups are kept until the beta ends or you ask to leave, whichever comes first.
Your choices
You can leave the list, see what we hold about you, correct it or have it deleted. Every email we send has a link to leave, or write to the address at the foot of this page.
Cookies
This website sets no cookies of its own. Cloudflare Turnstile may set one that is strictly needed to check the form is not being abused.
Changes
If this policy changes, the revised version is posted here with a new date. Material changes to the apps' section are also noted in the apps' release notes.
Contact
Questions about this policy, or a request to see, correct or delete what the beta list holds about you: eric@fadelyfamily.com.