Privacy

Short version: what you put in an onion is for the person you send it to. Not for us, not for anyone else.

What Lụa collects

Nothing about you. Lụa has no accounts, no analytics, no ads and no tracking. We don't know who makes onions or who receives them.

How an onion travels

When you send an onion, your phone locks it with a new random key before it leaves the device. The locked onion is stored in Apple's iCloud (CloudKit) so the recipient can download it. The key travels only inside the link you share, in the part after the #, which browsers never send to any server. Without the link, the stored onion can't be read, by us or by Apple.

If you set a magic word, the question at the heart is locked a second time with that word, and stays locked on the recipient's phone until they type it.

How long it's kept

Your app deletes the stored onion 30 days after sending, or sooner if you tap Stop sharing. Once the recipient opens the link, their onion lives only on their phone, and is deleted when they delete it or the app.

Photos, microphone, notifications

Lụa asks for photos and the microphone only when you add a photo, video or voice note to a layer, and uses them only for that. Reminders that a new layer is ready are scheduled on the recipient's phone. Nothing is sent to us.

Songs

When you paste a song link, Lụa fetches the song's public title and artwork from that service so the card can show them. Opening the song takes you to the music app.

This website

luaonion.app is hosted on Cloudflare, which keeps standard server logs, such as IP addresses, for security. The site uses no cookies or analytics, and the key in an onion link never reaches it.

Contact

Questions: hello@luaonion.app

Last updated October 14, 2026.