Lunar runs almost entirely on your device. The only exception is a small notification server that wakes your alarm up even while your phone is locked — it only ever sees your alarm times and a notification address, never your Spotify data. If you connect Spotify, your device talks directly to Spotify — Lunar's server never sees or stores that.
Two separate data flows exist. First, if you connect Spotify, your device authenticates directly with Spotify (OAuth) and calls Spotify's Web API directly to read your playlists and pick a song for your alarm — this goes straight from your device to Spotify, Lunar's server never sees it. See Spotify's Privacy Policy for how they handle it. Second, if you allow background wake-up notifications, your device sends only your alarm times and a browser-generated push subscription address to Lunar's own minimal notification server (used solely to trigger the wake-up alert at the right time) — no Spotify data ever passes through it. Without a Spotify connection and without notifications enabled, there is no data transmission at all.
Alarms and your Spotify connection are stored locally and can be deleted by you at any time (e.g., by removing individual alarms, disconnecting Spotify, or reinstalling the app). If you enabled background notifications, your alarm times and push address are also held on Lunar's notification server under a randomly generated device ID — turning off all alarms or notifications removes them there too.
Questions about data privacy: matti.muenger@gmx.ch