Cookie Policy

Last updated: August 19, 2026  |  한국어

This Cookie Policy explains how LunaRabbit ("we", "us", or "our") uses cookies and similar technologies when you use our Services — LunaRabbit Chat (web and mobile AI chat) and LunaRabbit Office (Microsoft Office™ & Google Workspace™ productivity tools).

1. What Are Cookies?

Cookies are small text files stored on your device by your web browser. Similar technologies include local storage and session storage, which allow websites to store data in your browser. These technologies help websites remember your preferences and maintain your session.

2. How We Use Browser Storage

We use browser storage technologies to provide and improve our Services. Here is what we use and why:

Essential Storage (Required)

These are necessary for the Services to function and cannot be disabled:

• Authentication token (localStorage and sessionStorage) — Keeps you signed in. The sessionStorage copy is cleared when you close the browser tab.
• User identifier (localStorage) — Associates your browser with your account for session continuity
• Platform context (sessionStorage) — Identifies which Office application you are using (Microsoft Excel™, Microsoft PowerPoint™, Microsoft Word™, Google Sheets™)
• Google Workspace™ tokens (sessionStorage) — Temporary authentication tokens for Google Workspace™ integration, cleared on tab close

Chat-Specific Storage (Essential)

When using LunaRabbit Chat:

• lr_session (httpOnly cookie, 7-day expiry, domain: .lunarabbit.ai) — Maintains your login session across LunaRabbit products (Chat, Office). Contains a signed session token, which the httpOnly and Secure flags keep out of reach of scripts. Automatically renewed via the refresh token mechanism.
• lr_refresh (httpOnly cookie, 30-day expiry, path: /api/auth/refresh) — Enables automatic session renewal so you stay signed in without repeatedly entering your credentials. Contains a single-use refresh token that is consumed and replaced on each renewal.
• lr_csrf (cookie, 30-day expiry) — Prevents cross-site request forgery attacks. Required for all POST/PUT/DELETE requests.

Consent & Preference Storage (Essential)

• Consent record (cookie: lr_consent, 1-year expiry, domain: .lunarabbit.ai) — Records your consent choices: (a) that you have acknowledged our use of essential cookies, and (b) whether you have opted in to AI-training use of your content while signed out. When you are signed out this cookie is the only place that choice can live, and we read it when a conversation turn is stored to decide whether that turn is training-eligible. The default is opt-out. When you are signed in, your account setting governs instead. See “Anonymized Pattern Use” in the Privacy Policy.
• Disclaimer acceptance (@lr_disclaimer_accepted, localStorage) — Records your acceptance of the service disclaimer. Without it, the disclaimer would appear on every visit.
• Language preference (lr-locale, localStorage) — Your chosen display language.
• Theme preference (localStorage) — Your chosen color scheme (dark/light).

3. Third-Party Cookies

We do not use third-party tracking cookies. We do not use any advertising cookies, analytics cookies from third parties, or cross-site tracking technologies. Your browsing activity on our Services is not shared with advertisers or data brokers.

4. Google Workspace™ Add-on Context

When you use LunaRabbit Office as a Google Workspace™ add-on, the add-on runs within Google's iframe environment. Google may set its own cookies to manage the add-on lifecycle and authentication. These cookies are governed by Google's Privacy Policy, not ours.

5. Microsoft Office™ Add-in Context

When you use LunaRabbit Office as a Microsoft Office™ add-in, the add-in runs within Microsoft's webview environment. Microsoft may set its own cookies for Microsoft Office™ authentication and add-in management. These cookies are governed by Microsoft's Privacy Statement, not ours.

6. Third-Party Content Loaded in Artifact Previews

When you preview an artifact (a generated web page, chart, or code sample), that preview runs in an isolated sandbox and may load scripts, stylesheets, fonts, or images from public content delivery networks that distribute open-source libraries, as well as from any image host the artifact itself references.

What those hosts can see: the ordinary information any web request carries — your IP address, browser and operating system, and which file was requested. What they cannot see: your conversation content, your account, or your cookies. The preview is isolated from your session, and code running inside it is blocked from sending data anywhere. These hosts are not our sub-processors and receive no personal data from us; the request comes from your browser, not from our servers.

If you would rather not contact those hosts at all, do not open artifact previews.

7. Cookie Consent Banner

When you first visit our Services, a brief notice informs you that we use essential cookies for authentication and preferences. Since we only use essential cookies (no analytics, advertising, or tracking cookies), a single acknowledgment button is provided. Your acknowledgment is remembered via the lr_consent cookie so the notice does not reappear. You can reset this at any time by clearing cookies for our domain.

8. Managing Browser Storage

You can manage or delete browser storage through your browser settings:

• Google Chrome™: Settings > Privacy and security > Clear browsing data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Privacy, search, and services > Clear browsing data

Please note that clearing essential storage will sign you out and you will need to log in again.

9. Changes to This Policy

We may update this Cookie Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Services after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Cookie Policy, contact us at:

• Email: [email protected]
• Website: https://lunarabbit.ai
• Operator: LunaRabbit Inc., a Delaware corporation
• Mailing address: LunaRabbit Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States