Luna collects nothing
The extension has no servers, no analytics, no telemetry and no update pings beyond the one Firefox itself makes to check for a new version. Nothing you type into it is transmitted anywhere by us.
What it stores
Your proxy address, port and — if you enter them — a username and password. These live in the browser’s local extension storage on your own machine, unencrypted, like any other extension’s data. Browser sync storage is deliberately not used, so they never leave the device.
What the proxy sees
This is the part that matters, and it is why Luna declares that it handles website activity. Luna routes every request through the proxy you configure. That proxy necessarily sees which hosts you connect to, and for plain http:// destinations it can read the traffic itself. We do not run that proxy and have no access to it — but Luna is the thing that sends your traffic there, and pretending otherwise would be dishonest.
If the proxy is not yours, treat it as you would any intermediary. Turning on HTTPS-Only Mode means no plaintext destination exists for it to read.
Credentials
Luna releases your proxy password only to the exact host and port you configured. If a different proxy asks for it — which happens when another extension has taken over the browser’s proxy setting — the credentials are withheld and the extension reports blocked.