Privacy Policy

Who we are

Pulse is operated by John Park. You can contact us about privacy, safety, support, or account requests at pulse-support@pulsegroups.app.

Information we collect

Depending on how you use Pulse, we collect:

• Account and authentication data, including your phone number through Firebase authentication.
• Profile data, including name, username, bio, neighborhood, gender, date of birth, photos, tags, training status, social links, and profile songs.
• Activity data, including activity title, sport, description, date and time, host, participant list, RSVP history, invite/share links, route details, and meetup coordinates.
• Content you provide, including photos, videos, messages, reports, support emails, and community interactions.
• Contact information you choose to share for friend discovery. If you use Find Friends, phone numbers from your device’s contacts are sent to us solely to check whether they match existing Pulse accounts. We do not store your contacts, and we do not build profiles of people who are not Pulse users.
• Device and notification data, including push tokens, platform, app settings, and notification preferences.
• Location-related data, including foreground device location used for nearby activity filters and locations you choose for activities.
• Strava data you choose to bring in, read from Strava’s API with your authorization: your athlete ID and encrypted access tokens, the activities you pin as highlights (name, description, stats, map, photos and segments) and the routes you attach to activities. We hold it as a cache, not a copy: each piece is re-read from Strava daily. Unverified data is hidden within 48 hours and deleted after seven days. A highlight Strava no longer returns is deleted, and a route’s map is deleted seven days after its activity is over.
• The profile songs you pick from Deezer’s catalog and the labels you give them. A preview you play streams from Deezer.
• Race results you enter or import from public results providers such as Athlinks, UltraSignup, and UltraRunning.com, including event, date, distance, and finish time. A results page you paste by link is fetched for you; UltraRunning.com pages are read through Jina, a page-reading service that receives only the link, which names the runner.
• Usage, diagnostics, and security data, including server logs, crash reports, request metadata, and anti-abuse signals.
• Problem reports you send from the app: your note, the screens and steps just before it, your device model and app version, and a screenshot if you choose to add one, with its text and images blacked out when the app takes it. Reports go to Sentry with no account details attached.

How we use information

We use information to operate Pulse, including to:

• Create accounts, authenticate users, and prevent fraud or abuse.
• Show profiles, activities, RSVPs, messages, notifications, and share links.
• Help users discover nearby activities and open map directions.
• Match contacts you choose to share against existing accounts so you can find people you already know, and let you invite people who are not yet on Pulse.
• Process reports, enforce our Terms and Community Guidelines, and respond to safety issues.
• Maintain, debug, secure, and improve the app and web service.
• Provide customer support and respond to legal or privacy requests. Support tickets, reports, text flagged by screening, and deletion notes reach us as email through Resend; a support ticket carries the contact email you give so we can reply.

How we share information

We do not sell personal information. We share information with service providers that help us run Pulse, with other users as needed for the product, and when required for safety, legal compliance, or a business transfer.

Current service providers and integrations may include Firebase, Cloudinary, Mapbox, Google Maps, Apple Maps, Railway, Vercel, Neon, Sentry, Expo push notifications, Resend, Strava, Deezer, MET Norway, Apple, Google, OpenAI, Jina, and race-result providers such as Athlinks, UltraSignup, and UltraRunning.com.

Text you write in Pulse, such as messages, profile fields, and activity descriptions, may be screened automatically for harassment, threats, hate, and sexual content when it is posted, and a message that fails screening is removed. Profile photos and videos may be screened for sexual, violent, and self-harm content when you upload them, and one that fails can't be added to your profile. Screening sends only the content itself (a few still frames of a video), with no account details attached, to OpenAI, which does not use it to train its models and may keep it for up to 30 days to monitor for abuse before deleting it. A person reads text only when someone reports it or screening flags it. Text that came from Strava is not screened; a highlight you rename or describe in Pulse is.

Highlights you pin are shown on your profile to whoever your highlights visibility setting allows, and a Strava route you attach to an activity is shown to the people who can see where it meets. If you turn on “Planned with Pulse”, Pulse writes one line to the description of each of your Strava activities that matches a Pulse activity, naming the activity and its host. Strava collects usage data about Pulse’s access to its API under its own privacy policy.

Cookies and local storage

The Pulse website uses browser storage for essential functionality only: when you sign in on the web, Firebase keeps your login session in local storage so you stay signed in. We do not use advertising cookies or third-party analytics trackers.

Public and shared content

Profile information, activity details, photos, activity chats, direct messages, RSVPs, and share-link previews may be visible to other users depending on the feature, your settings, and the activity audience. Activity share pages show logged-out viewers a reduced preview: the start time, and for open public activities the location. Request-only and non-public activities show only the general area. The description and participant identities are withheld until an authorized RSVP.

Retention and deletion

We keep your information while your account is active and as needed to run the service. Server logs, diagnostics, and backups age out on a rolling basis.

Contacts you share for friend discovery are checked for matches and discarded within the same request. We hold no record of your address book.

Disconnecting Strava in Settings, removing Pulse from your Strava account, or deleting your Pulse account deletes everything we hold from Strava: the connection and its tokens, your highlights, and the Strava route maps you attached to activities. After a disconnect or a removal on Strava, we confirm the deletion in your app inbox; deleting your account deletes the inbox with it.

You can delete your account in the app. Deletion removes or scrubs your profile, photos and videos, devices, notification preferences, blocks, connected-service data, and the identifier used for phone-number discovery, and deletes your sign-in record so your phone number can be used again.

Some historical activity and message context may remain for other participants, but the deleted account is anonymized as "Deleted user". Media and account cleanup with our providers can take a short while.

Your choices and rights

You can edit profile fields, disconnect Strava, change notification settings, block users, leave activities, delete messages where the app permits it, and delete your account. Depending on where you live, you may also have rights to request access, deletion, correction, limitation, or information about how your personal information is used. Contact pulse-support@pulsegroups.app to make a request.

Contact matching only runs when you start it. Being findable by phone number is off unless you turn it on in your privacy settings, and you can turn it off again at any time. You can also revoke Pulse’s access to your contacts in your device settings.

Children

Pulse is not directed to children and is not available to anyone under 18. If you believe a minor has created an account, contact pulse-support@pulsegroups.app so we can review and remove the account where appropriate.

Security

Pulse uses technical and organizational safeguards such as HTTPS, authentication, rate limits, encrypted third-party tokens, provider access controls, and server monitoring. Where phone numbers are used for friend discovery, we store only a one-way keyed fingerprint of the number rather than the number itself. No system is perfectly secure, so report suspected security issues to pulse-support@pulsegroups.app.

Where data is processed

Pulse is operated from the United States, and your information is processed and stored on servers located there.

Changes to this policy

We may update this policy as Pulse changes. We will post updates here with a new "Last updated" date and, for material changes, notify you in the app.