HearthboardUpdated: 25 September 2026
Hearthboard (月涌星-生活看板) is operated by 杭州月涌星科技有限公司. This policy covers our app and public website and the information processing involved in our current services. Availability depends on your app version. We do not sell personal information and currently use no advertising SDK.
1. Accounts, profiles and security
- Registration, sign-in, binding and recovery process your chosen phone number and country or region, email address, verification results and sign-in identity. Passwords are stored as BCrypt hashes, not plaintext.
- Sign in with Apple uses your Apple account identifier (sub) and verified email, which may be a private relay address. Apple does not provide your avatar, and Apple sign-in does not require a phone number.
- Your display name, optional gender, avatar, member relationship and household membership support profiles and collaboration. Gender and relationships may determine family-role labels. Members can see collaboration profiles, but do not receive your password or verification codes.
- App device identifiers, session credentials, app and OS versions, language, installation events and version heartbeats support sessions, compatibility and operations. These device identifiers serve the app, rather than advertising identification.
- Changing phone or email, unlinking Apple and deleting an account require the applicable identity checks. Changing an email/password account's email also changes its login email, without changing its Apple identity.
2. Household collaboration and personal content
- Family calendar: titles, notes, typed locations, start and end times, time zones, all-day settings, colors and selected participants support shared schedules and editing. Typed locations are not GPS collection. We currently do not read or synchronize system calendars.
- Chores and tasks: content, assignments, recurrence rules and completion status support collaboration. Task notices process the related task, event time and read status.
- Family contacts: names, phone numbers, notes and emergency flags you enter are shared with current household members for viewing and management. We do not automatically import device contacts. An emergency flag does not place calls or send messages. Enter another person’s contact details only with appropriate authorization.
- Shopping lists: items you add and their completion status support shared household shopping.
- Financial records: amounts, income/expense type, dates, notes and personal/household scope. Personal records are visible only to their author; household records are visible to current members. Author and household-role permissions control editing and deletion. This is not a complete budgeting, bank account or bank statement integration.
- Selected avatars, household logos and uploaded images or files are held in object storage for display. Home-layout preferences support account configuration synchronization. Avoid unnecessary sensitive information or uploading other people's information without permission.
- Feedback and contact information you submit support help requests. Operators access data under permissions for support, security and maintenance, rather than as ordinary household participants.
Shared content is available to current household members. Check the selected household before submitting it. Leaving a household is not account deletion and does not automatically erase all shared history. Manage content you are authorized to delete, or contact us with a deletion request.
3. Weather and location
You can select a weather city manually. If you authorize location access, iOS obtains your location and uses Apple reverse geocoding to identify the city. Weather requests preferentially use a nearby catalog city's coordinates, or coordinates rounded to two decimal places. Apple reverse geocoding processes location coordinates; we do not retain raw precise GPS as location history. Your city selection stays on your device. The server temporarily caches weather rather than storing weather coordinates in the database. Configured providers may include Caiyun, Amap or Apple WeatherKit, as described in the sharing list.
4. Device permissions and local settings
- Location selects a weather city automatically. You can refuse and choose manually without losing account or household collaboration features.
- Photos are selected through the system image picker for avatars, household logos or other images. We upload selected pictures, not your entire photo library automatically.
- Camera access scans household invitation codes; manual code entry is an alternative.
- Notifications support implemented local task reminders. Refusing permission does not prevent viewing tasks and notices in the app. A complete remote push service is not currently available.
- Face ID is an optional local lock handled by the operating system. We do not receive or store face images or biometric templates. Local language and theme settings are not used for advertising profiles.
You can manage permissions in system settings. Revocation stops subsequent access but does not automatically delete submitted content. Live family location, background tracking, family chat, file messages and WeChat sign-in are not currently available. New processing will be explained and required consent obtained before applicable future features are enabled.
5. Subscriptions, service security and website access
Apple handles App Store payments. We process transaction identifiers, subscription status and entitlement verification, not payment card credentials. Removing the app or deleting your account does not cancel an Apple subscription; cancel it separately in Apple's subscription settings.
To investigate sign-in, message delivery, account support and payment issues, we record login method, outcome category, recent session activity, provider request identifiers, latency and payment notification results. Diagnostic records do not contain passwords, verification codes or sent message bodies. Authorized support access to bound phone numbers, account/login emails and Apple identifiers is audited. Manual recovery still requires proof of an existing bound identity and cannot bypass verification when proof is unavailable.
The website serves static pages. Network services process IP addresses, request paths and browser request information to deliver pages and maintain security. The website currently embeds no advertising or third-party analytics trackers. Language switching uses localized URLs and does not require tracking cookies.
6. Third-party services and disclosures
See our Third-Party Information Sharing List for Apple, Tencent Cloud, Amap and Caiyun. Integrations may use system interfaces, web components or server APIs; they are not all app SDKs.
Configured SMTP services process recipient addresses and verification or security message contents. Only enabled operational subscriptions send registration or first-install events, relevant account/device identifiers, versions and language to WeCom or configured webhook recipients, without household content. Actual email providers and other webhook recipients must be identified before enabling them. This policy is not blanket authorization to disclose information to arbitrary recipients. Adding providers does not replace legally required notice or separate consent.
7. Retention, security and deletion
Account and collaboration data are retained as needed to provide the relevant service or meet legal requirements. Operational diagnostics and account security events have a 90-day retention period; closed identity-recovery support cases and administrator audit records have a 365-day period. Scheduled jobs perform expiry cleanup. Account deletion clears identity-linked diagnostics and sensitive support-case information; necessary audit facts are retained in de-identified form.
We use authentication, household/account access controls, encrypted transport, password hashing and restricted operational access. Business services use Tencent Cloud infrastructure and object storage. Apple and map providers may process information outside China under their policies, so not all processing can be described as exclusively domestic. Cross-border provision requires applicable notices, consent and legal conditions. Backups and legal retention mean deletion does not imply instantaneous removal of every media copy. Contact us about retention or deletion of specific data.
8. Your rights and minors
Manage profiles and bound identities in profile/account-security settings, and edit or delete content where you have permission. Use Settings → Account Security → Delete Account to verify identity and confirm deletion. Personal financial and historical records are removed with account deletion. Shared content follows deletion-eligibility and household rules; review the in-app notice before confirming. You may contact us to request access, a copy, correction, deletion, withdrawal of consent or an explanation of processing. Withdrawal does not affect prior lawful processing. Stopping necessary processing may make related features unavailable.
Minors should use the service under a guardian's guidance. Processing information about children under fourteen requires guardian consent. Family roles and relationship labels do not establish verified guardianship authorization. Guardians can contact us to investigate and address information submitted without consent.
9. Updates and contact
We will update this policy and notify you through in-app notices or other appropriate means of material changes, obtaining renewed consent where required.
Operator: 杭州月涌星科技有限公司. Privacy, account and support requests: support@lunastar.top. Describe your request without sending passwords or verification codes. We may need to verify your identity to protect your account.