Privacy Policy

Lunar Buoy is an SEO attribution product: a change calendar that correlates site and content changes with search, traffic, and AI visibility signals. Controllers of personal data for the services described here are the operators of Lunar Buoy. Contact: privacy@lunarbuoy.com.

Project data you add or generate in Lunar Buoy — including verified domains, crawl snapshots and extracts, change history, notes, and metrics synced from connections you authorize — is your data. We process it only to provide, secure, and improve the service you asked for. We do not claim ownership of your content or analytics.

We will never sell your information — not personal data, not Google user data obtained via Google APIs, and not customer project data. We do not sell, rent, or trade it for money or other valuable consideration, and we do not use it for advertising or marketing lists.

Depending on how you use Lunar Buoy, we may process:

• Account data — name, email, and authentication identifiers from our identity provider (Clerk), including when you sign in with Google (OpenID profile/email).
• Workspace and billing data — membership, plan/entitlement metadata, and payment-related records processed by Stripe when billing is enabled.
• Project and crawl data — domains you register, crawl configuration, HTML snapshots and derived extracts/diffs, change calendar events, and related audit logs.
• Connected analytics data — when you connect Google Analytics 4 or Google Search Console, we store OAuth tokens (encrypted at rest) and pull read-only metrics such as sessions, users, impressions, clicks, and average position for properties you select.
• Marketing / waitlist data — email and related fields if you join a waitlist or contact us.
• Technical and security data — IP address, device/browser metadata, logs, and diagnostics (including error reporting via tools such as Sentry) needed to operate and secure the service.
• Cookies and similar technologies — see our Cookies page and Cookiebot consent banner on the marketing site.

Lunar Buoy can connect to Google user data through Google OAuth when you choose to link properties. We request only the scopes needed for the features you enable, including:

• Sign-in (via Clerk): openid, userinfo.email, userinfo.profile
• Google Analytics 4 (read-only): https://www.googleapis.com/auth/analytics.readonly
• Google Search Console (read-only): https://www.googleapis.com/auth/webmasters.readonly

We use Google Analytics and Search Console data solely to display metrics in your Lunar Buoy workspace, correlate them with your change calendar, and operate related product features you request (for example scheduled refresh of metrics). We do not use Google user data for serving advertisements, for creditworthiness decisions, or for unrelated AI/ML models that are not part of providing or improving Lunar Buoy’s user-facing features.

Google API Services User Data Policy — Limited Use. Lunar Buoy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You may disconnect Google Analytics or Search Console at any time in site settings. Disconnecting removes stored connection credentials and associated synced metrics for that connection as described in the product UI. You may also revoke Lunar Buoy’s access in your Google Account permissions.

• Provide, maintain, and improve the Lunar Buoy product
• Authenticate users and enforce workspace access controls
• Run crawls you authorize against verified project hosts
• Sync and display analytics you connect
• Process billing and prevent fraud/abuse when applicable
• Respond to support requests and communicate service notices
• Comply with law and protect the security of the service

We do not sell personal information. We share data only with:

• Service providers (subprocessors) that process data on our behalf under contractual obligations — for example hosting (such as Vercel), databases (such as Neon), object storage, background workers (such as DigitalOcean), authentication (Clerk), payments (Stripe), error monitoring (Sentry), and consent tooling (Cookiebot) on the marketing site.
• Google — when you authenticate or connect Google APIs; Google processes those requests under its own terms and policies.
• Legal / safety — if required by law, or to protect rights, safety, and integrity of users or the service.
• Business transfers — if we are involved in a merger, acquisition, or asset sale, data may transfer subject to continuing confidentiality and this Policy’s commitments (including no sale of Google user data for advertising).

Human access to customer content or Google user data is limited to personnel or contractors who need it for security, compliance, abuse investigation, or support — and, where applicable, with your explicit consent or request.

We retain account and project data while your workspace is active and as needed for backups, security, and legal obligations. When you delete a project, associated project data is removed according to our product delete cascade (including connection tokens and synced metrics for that project). Raw crawl HTML may be subject to shorter retention (TTL) even while a project remains active. You may request account deletion by contacting privacy@lunarbuoy.com.

We use industry-standard measures appropriate to the sensitivity of the data, including encryption in transit (HTTPS), access controls, workspace isolation, and encryption of Google OAuth refresh tokens at rest. No method of transmission or storage is 100% secure; we continuously improve controls described in our internal threat model.

We may process and store information in the United States and other countries where we or our subprocessors operate. Where required, we use appropriate safeguards for cross-border transfers.

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. Marketing-site cookie preferences can be managed via the Cookiebot controls. Product connections can be disconnected in-app. To exercise privacy rights, email privacy@lunarbuoy.com. Support: support@lunarbuoy.com.

Lunar Buoy is intended for business and professional use. We do not knowingly collect personal information from children under 16. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Material changes may also be communicated by email or in-product notice when appropriate.

Privacy: privacy@lunarbuoy.com
Legal: legal@lunarbuoy.com
Support: support@lunarbuoy.com

Related: Terms of Service · Cookies · Platform