What end-to-end encryption means for a couples app
Every app claims your data is encrypted. Most mean encrypted on their server, with their key. Here is the difference, the questions that expose it, and what it costs to do properly.
"Your data is encrypted" is close to meaningless as a sentence. It is true of almost every app on your phone, including the ones whose business model is reading what you wrote. The word doing the work is not encrypted. It is who holds the key.
For a couples app this matters more than for most software, because the content is not preferences and receipts. It is the two of you at three in the morning.
Three arrangements, one word
Encrypted in transit. Your message is protected between your phone and the company's server. Everyone does this; it is table stakes and it protects you from the café wifi, not from the company.
Encrypted at rest. The message is also stored on disk encrypted. The server holds the key, because it has to be able to read the message to show it to you on the web, to index it, to moderate it. Your data is safe from someone stealing the hard drive. It is not private from the company, its staff, its future owner, or anyone who compels it legally.
End-to-end encrypted. The message is encrypted on one device with a key the server does not have, and decrypted on the other. The server carries it without being able to open it. It knows that a message went from you to your partner, and its size, and when. Not what it says.
Only the third one is a promise about what the company cannot do. The first two are promises about what it intends to do, which is a different kind of thing.
Four questions that settle it
If you are evaluating any app that holds private conversation, these are worth asking. The answers are usually in the privacy policy or the support pages, and the absence of an answer is itself an answer.
- Where is the key? If it is on the company's servers, the encryption is not end to end, whatever the marketing page says.
- Can I read my messages in a browser after logging in with a password? If yes, the server can decrypt them. There are exotic exceptions; assume there are not.
- What happens if I lose all my devices? Genuine end-to-end encryption has an uncomfortable answer here: some things are gone. An app that can always restore everything, from anywhere, with just a password, holds your key.
- What is in the backup? Plenty of apps encrypt in transit and then write a plaintext copy into a cloud backup, which quietly undoes the whole thing.
What it costs to do properly
This is the part rarely discussed, because it is the part that makes engineers argue.
If the server cannot read your content, the server cannot do anything clever with it. No search across your history performed in the cloud. No tidy summary of your year generated overnight on a big machine. No content moderation, no recommendation, no language model reading the conversation to suggest what to say next.
Every one of those features is possible; they just have to happen on the phone, where the key is, within the battery and memory of a device that is also doing twenty other things. Some are simply not worth building under that constraint, and the honest thing is to drop them rather than to quietly move the key to where the computation is convenient.
It also makes account recovery genuinely harder. If you lose the key and every device, nobody can hand it back. We think that is the correct trade for this specific content, and we would rather say it plainly than discover it in a support ticket.
How Pulse is built
Concretely, for the app we make:
- The chat between partners, Our Story, the daily question, the comments on a shared watchlist entry, all of it is encrypted on one phone and decrypted on the other. We carry it. We cannot read it.
- The key lives in your iCloud Keychain, on your own devices. It is never uploaded to us and we have no copy.
- Your raw health data, heart rate, HRV, sleep, movement, does not reach the servers at all. It is read and interpreted on your own device, and only the resulting sentence crosses to your partner.
- Notifications are deliberately content-free. A request for something private is never spelled out on a Lock Screen, where it can be read by whoever happens to be standing there.
- A new phone restores your history from your own encrypted iCloud backup, not from us. Health history deliberately does not travel with it, because it never left the old device.
There is no language model anywhere in the loop. The nudges the app makes are deterministic rules over things you typed about yourself, which is also what makes them explainable when you ask why a particular one appeared.
What we can still see
An honest account includes the limits. We can see that an account exists, that two accounts are linked, that a message of some size moved between them at a certain time, and the notification token Apple needs to deliver a push. That is metadata, and end-to-end encryption does not remove it.
We keep as little of it as we can and do not sell any of it, but "we cannot read your messages" and "we know nothing about you" are different claims, and only the first one is true of anybody.
If you want to check the specifics rather than take the summary, the privacy policy names what is processed and why, and the questions page answers the ones people actually send us.
About Pulse
Pulse is a couples wellness app for iPhone and Apple Watch. It turns your own body signals into one gentle daily cue for your partner, and never shows them a number.
