Privacy.

The apps

Every Cosmicore app runs on your own device. There is no sign-up and no login, no account of any kind, and no server on the other end. An app sends nothing anywhere: no telemetry, no analytics, no crash reports, no update pings, no advertising or tracking code of any sort. We cannot see, access, hand over, sell, or lose your files, because they never reach us. The one thing that can leave a phone is described under permissions: Dictate hands your voice to the phone’s own speech recognition, which is the phone maker’s service, not ours.

Your work is ordinary files in ordinary formats on your own disk. LunaLog keeps its records as JSON — in your Documents folder on desktop, in the app’s own private storage on a phone — and your photos as ordinary image files; Novelisha keeps one JSON file per book. You can open them in a text editor, copy them to another computer, or read them in twenty years without this software.

The sensitive parts. LunaLog is a cycle tracker with a password vault in it, so this page names what it holds. It holds period dates and predictions, symptoms, moods, intimacy, and a pregnancy log; in its logins tab, site names, usernames, and passwords; and in its address book, other people’s names, email addresses, phone numbers, postal addresses and birthdays — which are their details, not yours. All of it sits in the plain JSON described above, and LunaLog does not encrypt any of it. Nothing is transmitted, so none of it reaches us and there is no store of it here to be breached or handed over. The real risk is local: whoever can open that folder — or a backup, or a copy synced to another machine — can read what is in it. If you keep passwords or cycle records in LunaLog, note that there are two plain copies of them on your disk. The folder in Documents is the mirror LunaLog writes so your entries survive a reinstall; the working copy lives in the app’s own data folder — %APPDATA%\LunaLog on Windows, ~/Library/Application Support/LunaLog on macOS, ~/.config/LunaLog on Linux. Encrypting the Documents folder alone leaves the second one readable. What covers both is encrypting the whole disk or the whole user account, which your operating system can do and this app does not attempt. That is the desktop case. On the Android and iPhone apps there is no such folder to move: the files sit in the app’s own private storage, which other apps on the device cannot read, and the phone encrypts its own storage once you have a screen lock set. A backup you export yourself is an ordinary file wherever you put it, so it deserves the same care as the desktop folder above.

Some apps also write a plain-text diagnostic log into their own folder, so that when something goes wrong there is something to read. It stays on your disk, it is never sent anywhere, the app keeps about two weeks of it and deletes the rest itself, and you can delete the lot whenever you like.

Because it all lives on your device, backups are yours to keep. Deleting a phone app takes its storage with it. These apps go further than most: they are kept out of the phone’s own backup and out of device-to-device transfer, so nothing about them is copied to a cloud or carried to a new handset. That is on purpose, and it means the copy on the phone is the only copy — export a book, or a journal, before you change phones. On desktop the files stay where they are, in your Documents folder, until you delete them yourself, so uninstalling never deletes your work.

The app lock is a PIN, not encryption

Where an app offers a lock, it is a PIN or your device’s own unlock, and what it does is keep the app closed. It does not encrypt your files, and we never describe it as encryption. Anyone with the device and a file browser can open them. If you want the files themselves protected, use your operating system’s disk encryption, which does that properly.

This matters most for the logins tab in LunaLog. A PIN in front of a file of plain-text passwords keeps the app closed. It does not protect the file. Keep that in mind when you decide what to store there.

Permissions the phone apps ask for

This list is what the builds actually request, app by app, rather than a catch-all list. Most of them are asked for the first time you tap the feature that needs one, and you can decline or revoke those in your device settings with the rest of the app still working. A few are granted at install with no prompt and cannot be revoked; those are named at the end rather than left out. Whatever any of them reaches stays on the device.

The microphone. Each phone app asks, and only if you record a short voice note or use Dictate. Recordings are never uploaded and never analysed, and they leave the device only if you export a file and send it somewhere yourself.

Dictation. LunaLog and Novelisha on a phone have a Dictate button beside the keyboard. It hands what you say to the speech recognition built into the phone — Google’s on Android, Apple’s on iPhone — and types the words back into the field. Depending on the device, the language and its settings, that recognition runs on the phone itself or on the maker’s servers, under the maker’s own privacy policy; the app receives only the words, keeps no audio, and sends nothing itself. It runs only while you have tapped the button on, and not at all if you never use it. On iPhone the app asks for speech recognition permission the first time; on Android the microphone permission covers it. On a computer, the Dictate button only tells you where your operating system’s own dictation is — the desktop apps have no speech recognition of their own.

Photos. On iPhone, LunaLog and Novelisha ask for your photo library — to put a picture into a journal entry, a note or a scene, and to save one back — because that is how iOS hands an app a picture. On Android they ask for nothing at all: the system photo picker hands over the one file you chose and no access to the rest.

Reminders and the lock — LunaLog only. LunaLog asks for permission to show notifications, so the reminders you set yourself can appear; and, if you switch the app lock on, for the fingerprint or face unlock your phone already has. The PIN stays available either way, and no biometric data is read or stored by us — the phone does the matching and answers yes or no. Novelisha has neither feature, so it asks for neither.

The camera. No Android build here holds the camera permission at all. Taking a photo hands off to the camera app your phone already has, and only the picture comes back. On iPhone, LunaLog and Novelisha do ask, because that is how iOS does it.

Granted at install, with no prompt, and not revocable. Android hands a few permissions over at install time rather than asking. Every Android app here lists two of them. Internet Is what lets the app load its own screens from inside itself; none of them opens a connection with it, and you can check that by running one in airplane mode. Adjust audio settings Is what lets a recording take over the audio route while it runs, so a voice note does not fight whatever else the phone is playing. LunaLog lists two more, both for reminders: Keep the phone awake Long enough to deliver one, and Start after a restart, without which every reminder you had set would vanish the next time the phone rebooted. None of the four reaches the network, your files, or anything you have typed in.

What happens when you pay

This is the one place any information about you exists, so here it is exactly.

Desktop checkout is run by Paddle, who are the merchant of record, which means the legal seller. Paddle collects what a seller has to collect: your name, email address, billing address and country, your payment details, and your IP address, which is how the right sales tax or VAT is worked out. Paddle keeps those transaction records for as long as tax law requires. Its privacy notice is at paddle.com/legal/privacy.

Cosmicore never sees your card. What reaches this end is Paddle’s order record — that a purchase happened, and the buyer’s email address, which sits in Paddle’s seller dashboard so an order can be matched to a person who writes in. No card number, no security code, nothing that could be used to charge you again. We do not email you the download: the installer link is on the download page Paddle sends you to, and that page is the only place the download and its updates come from, so bookmark it. There is no account to create, so there is nothing to log into. The one form on this site, Find my download, sends the email address and invoice number you type to Paddle to check them against the sale, and keeps neither.

Phone apps are bought from the App Store or Google Play instead. Those stores take the payment under their own privacy policies, and what Cosmicore receives from them is sales figures, not buyers.

The app itself never contacts Paddle, either store, or this site. Once the file is on your machine the transaction is over.

This website

cosmicore.net is an ordinary website on ordinary hosting, and it is a different thing from the apps. Nothing that happens on this site is ever fed back into an app.

There are no advertising networks here, no social pixels, and no third-party trackers. Apart from the analytics described below, the site loads nothing from anyone else’s server: no remote fonts, no CDN, no embedded video, no widgets. Apart from the find-my-download form described above there is no form here: no contact form, no comment section, and no mailing list, so email is the only other way to reach us.

Analytics. This site can run Google Analytics 4, and whether it does is a single setting. While that setting is empty, no analytics load, no consent strip appears, and this site sets no cookie at all. When it is filled in, a small strip at the bottom of the page asks first, and nothing loads until you press yes. Press no and Google Analytics is never loaded on any page. Either answer is remembered in one first-party cookie named cn_consent, which holds nothing but yes or no and expires after a year. If you have never been asked, nothing was ever loaded.

Say yes and Google sets its own analytics cookies as well — the usual _ga pair, which tell one browser from another and nothing more. Clearing your cookies clears them, and declining means they are never set. The tag is configured to anonymise addresses, and Google Analytics 4 does not store an IP address: it reads one to work out a rough location and discards it. What that produces is page counts and rough country, not who you are, and it is never joined to a purchase or to anything in an app.

Server logs. The web host records the usual request log — IP address, time, page, browser — the way every web server does, to keep the site running and defend it. That is the host’s ordinary operation rather than a Cosmicore analytics system, and it has nothing to do with the apps.

Checking it yourself

You can check the app claims on this page yourself. Put an app behind a firewall, pull the network cable, or run it on a machine that has never been online: it behaves exactly the same, because there is nothing on the other end for it to talk to. Watch it with any network monitor you like and it stays quiet. The one exception is Dictate on a phone, described above: while the button is on, the phone’s own speech recognition may talk to its maker’s servers. That is the phone doing it, not the app, and it stops when you tap the button off.

Your rights, and children

Rights like access, correction, and deletion apply to data a company holds about you. The apps produce none — no account, no profile, no database of users — so from the apps there is nothing to request and nothing to erase. One record does exist, and it is the purchase: your name and email address on the order, held by whoever sold it to you — Paddle for desktop, the App Store or Google Play for phone apps — for as long as tax law requires, each with its own process for asking about it. We can see the desktop one in Paddle’s dashboard and use it for nothing but answering you. Anything you email us is deleted on request.

The apps are not directed to children under 13 and knowingly collect nothing from anyone, children included.

Changes

If this page changes, the date below changes with it, and the new version replaces this one at this address.

Contact

Privacy questions go to hello@cosmicore.net. Mail sent here is kept like any mail, and nothing else happens to it.