Pulse
Privacy
Pulse exists to help two people support each other. Health data is the most personal information we will ever touch, so we built the app around one rule: your raw biometric data never leaves your device.
1. Who is responsible
We are the data controller for Pulse: Knightify FlexCo, Rauchgasse 28 Top 2, 1120 Vienna, Austria. Reach our privacy contact at [email protected].
2. What stays on your device
The following is read from Apple HealthKit, processed locally on your iPhone, and never transmitted to our servers or your partner:
- Resting heart rate, heart rate variability
- Sleep duration and sleep stages
- Steps, exercise minutes, standing hours
- Respiratory rate, blood oxygen, mindfulness sessions
- Menstrual cycle data (only if you enable Rhythm Awareness)
So Pulse can show you trends and patterns, it keeps these readings in a rolling 90-day history on your device, encrypted in the iOS Keychain. They are the same values listed above, just over time rather than only for today. They are never transmitted to our servers or your partner, and are deliberately not part of your iCloud backup. Ending the connection with erase, or deleting your account, deletes the history with it.
Pulse also keeps its own notification list on the device: a record of what the app has shown you (the same short, content-free lines that appear in iOS Notification Center), so you can catch up on anything you missed. It stays on your iPhone and is removed when a connection ends (whether you keep or erase your shared history, since nearly every line names your partner) or when you delete your account.
If you wear a WHOOP, you will be able to connect it in the app’s settings once that support ships. Your iPhone then signs in to WHOOP, reads your sleep, recovery and workouts directly from WHOOP, writes them into Apple Health on your device, and reads them back from there like any other signal. None of those values reach our servers. The only part we touch is the sign-in: our server exchanges WHOOP’s one-time code for an access token, because WHOOP requires a secret that cannot safely live inside an app. We keep nothing from that exchange; the tokens are held in your iPhone’s keychain. Disconnecting, or deleting your account, removes them and ends the access on WHOOP’s side too. What was already written stays in Apple Health, yours to keep or delete.
If you wear an Oura Ring, you will be able to connect it in the app’s settings once that support ships. Your iPhone then signs in to Oura and reads your own readiness, sleep, stress, activity and the other daily summaries you agree to share, directly from Oura. What it reads stays on your iPhone, in its encrypted keychain: it is not written to Apple Health (the Oura app can do that itself, and a second copy would count every night twice) and it never reaches our servers. Two things do involve our server. The sign-in: Oura requires a secret that cannot safely live inside an app, so our server exchanges Oura’s one-time code for an access token and keeps nothing from that exchange. And new-data wake-ups: so that fresh ring data arrives without the app constantly asking, our server keeps a keyed one-way fingerprint of your Oura account number next to your phone’s notification token. When Oura tells us that something in your account changed (it says only which kind of data, never the data itself), we send your phone a silent notification and your phone fetches the change from Oura. Your partner never sees an Oura score. Disconnecting, or deleting your account, deletes everything Pulse read from Oura and removes that fingerprint. Oura only shares data with other apps while your Oura Membership is active.
Two further permissions are entirely optional and are only requested when you use the feature they belong to. The camera is used only when you take a photo for your partner yourself; the photo then follows the same end-to-end encrypted path as any other chat message. If you take one from the Lock Screen action, it sits briefly unencrypted in a protected area of your device (readable only after first unlock) until the app encrypts and sends it the next time you open it, and it is discarded automatically after 48 hours. For the calendar, Pulse writes your shared events, confirmed dates and anniversaries into a calendar you choose yourself. iOS only lets an app update entries it wrote earlier with full calendar access, so that is what Pulse asks for; it only adds, updates and removes its own entries, never looks at your other events, and no calendar data is transmitted to us or to your partner. The copies are ordinary calendar entries, outside Pulse’s end-to-end encryption: if the calendar you choose syncs to iCloud, Google or Outlook, they are stored with that service too, and anyone you share that calendar with can see them. Pulse asks you before it writes to such a calendar.
3. What we send to your partner
Once your iPhone has interpreted your day against your own rolling baseline, it generates a single, human-readable cue, for example, “A calm evening might mean a lot today.” Only the cue and a small set of suggested actions are synced through Apple’s iCloud private/shared database to your partner. When you pair, the profile you choose to show your partner is shared: the first name or display name you pick and, if you set one, your profile photo. Both are end-to-end encrypted on your device with the same key as the chat, so only your partner can see them. A coarse mood label (for example “low energy”) may travel alongside a cue so your partner’s Home screen can gently take on the colour of your day; it is a broad category, never numbers. The cue and that label are health-derived, and unlike your name and photo they are <strong>not additionally end-to-end encrypted</strong>: they are protected by the sharing rules on your iCloud zone, which means Apple, as the operator of iCloud, is technically able to read them. Nothing else about your identity is sent.
When you’re connected, you can also send each other small gestures (a tap, a “thinking of you”) and direct messages. Those messages are end-to-end encrypted: they’re encrypted on your device with a key kept in your iCloud Keychain and tied to your Apple ID. Only the encrypted text travels through iCloud, neither we nor Apple can read it.
While your chat is open, the app also briefly connects to our own real-time channel (on our own server, not a third party) for “Hold to Feel” and a faster path for typing, read, and message signals. Press and hold the small heart in chat, and if your partner does the same at that moment, you both feel a “Connected” moment, a plain yes/no signal with no content at all. The same channel can also carry the already end-to-end encrypted text of a message as a faster extra path while you both have the chat open, alongside the reliable iCloud path, which continues unchanged. Our server only relays these signals live, it does not store them, and the connection ends the moment you close the chat.
If you send a GIF in chat, the GIF is downloaded to your device, encrypted with the same chat key, and delivered through iCloud like any other message. We cannot see it either. Your GIF search terms, however, are processed by GIPHY, Inc. the moment you open the GIF search (see section 10). If you never open the GIF search, nothing is sent to GIPHY.
A few more things can travel between the two of you, always inside your shared iCloud space and never to us. Memories you add to your shared “Our Story” timeline (a title, a note, an optional place and photo) are end-to-end encrypted like messages. The shared date wishlist syncs as small, plain entries that are not end-to-end encrypted (an idea’s title, category and status, plus the address and map position of a real place you saved from the nearby suggestions; never health data). The day you count from (“Together since”) also travels as a plain date, and so does the bare identifier of a memory one of you removed, so it disappears on both phones. A gentle “how are we?” signal carries only a fixed phrase key that your partner’s app renders in their own language. And so the chat feels alive, tiny delivery signals travel too: a short-lived “typing” marker and a read receipt, each just a timestamp, never content.
When you ask your partner for something (“a hug”, “to talk”, “closeness”), it travels as an end-to-end encrypted chat card, exactly like a message. Only a fixed key for the kind of request crosses the wire, which your partner’s app renders in their own language, plus the optional note you write yourself. Because some of these requests are very private, the notification on the lock screen never names the content: it says only that you asked for something. What it was appears in the app.
Events you create in your shared calendar (a title, a time, an optional place and note) sync end-to-end encrypted along the same path. If you mirror them into a calendar on your iPhone, those copies are ordinary calendar entries outside that encryption, and a calendar that syncs to iCloud, Google or Outlook stores them with that service, see section 2.
Your shared watchlist (the films, series, books and music you save for each other) syncs inside your shared iCloud space the way the date wishlist does: small, plain entries, a title, a kind, an optional link with a small cover image, and a watched state, never health data. Comments, reactions and each partner's quiet like or dislike on an entry are end-to-end encrypted like messages. If you attach a link (say, to IMDB or Spotify), its little preview is fetched by your own device directly from that site; and if you only type a title, your own device may look the cover art up in Apple's public media catalogue instead. Either way, your partner's device only shows what was synced and contacts nothing.
Your shared shopping list rides the same wire as the chat: an item one of you adds arrives as a card the other can approve, buy or set aside, and its title, optional link and status are end-to-end encrypted exactly like a message. Nothing about it is health data, and nothing about it reaches our servers.
Notes you keep together (plans, lists and checklists either of you can edit) are end-to-end encrypted on your device exactly like a message before they travel inside your shared iCloud space, so neither we nor Apple can read them. Each phone keeps a readable copy; every edit carries the whole note, and your two phones merge the title, the text and each checklist line separately, so you can both work on a note at once. Notes are included when you export your data. If you end the connection they leave with the rest of your shared life: erased if you choose to erase, or sealed in the encrypted archive of that relationship if you keep your history.
Know Us holds what each of you wrote about yourself: what you love, what helps on a hard day, what is better skipped, and what makes you feel loved. Every entry is typed by the person it describes, and Pulse never infers one from your health data, your messages or your behaviour. Your words are end-to-end encrypted on your device before they travel inside your shared iCloud space, and your partner sees them verbatim; only the chip you picked yourself (a topic, or a moment like "when I'm tired") is ever read by the app itself. Entries live in your device's keychain and are included when you export your data. If you end the connection, your partner's entries leave with the rest of their shared life, while what you wrote about yourself stays with you. If you later connect with someone new, those earlier entries stay private until you choose to share them with that person.
Unsaid is a private notebook before it is anything else. You write down something you have not managed to say, name the feeling from a fixed list (or, if you like, follow a few guided steps: what happened, how it felt, what you need, a small ask), and keep it; what you write stays in your device's keychain and never leaves your phone unless you decide to send that particular note. If you do, that one note is end-to-end encrypted on your device exactly like a chat message before it travels inside your shared iCloud space, and your partner is told only that something arrived: never the words, and nothing about the feeling unless you chose to say it with a mark (“no rush”, or, on a note written as “Grateful” or “Proud of you”, “marked as kind”). The words open only when they say they are here (a note you marked as kind opens as soon as they tap it, and you are told it was read); their answer (I am here, I need a moment with an optional return time, or let us talk in person) travels back carrying no words at all. If they then write back what they heard, or you tell them whether that was it, those few lines are end-to-end encrypted on the device in exactly the same way. Nothing you write here is ever read, scored or interpreted by us or by the app itself; the only parts the app reads are the ones you picked yourself from a fixed list: the feeling, and, if you name one, what you need. Your own notes are included when you export your data unless you turn that off, and the notes your partner shared with you are left out unless you include them; in Privacy & Safety you can also lock Unsaid behind Face ID or your iPhone’s passcode, checked on your device. A note from your partner is never exported before you opened it, and what they said back on your notes goes only where their notes go. A line you keep for yourself beside a note never leaves your phone, and if you mark a note “no rush”, or mark it as kind, that mark travels with it and the knock your partner sees says so, in your name; our server’s notification never carries it. If you ask Pulse to bring a note back later, your phone may also show a reminder that says nothing about the note. If your partner turns on timing suggestions, your screen may suggest waiting when their day looks heavy, using only what they already share with you; it is off unless they turn it on. If you end the connection, your partner's notes, together with anything they wrote back on yours, leave your Unsaid page with the rest of their shared life: erased if you choose to erase, or, if you keep your history, sealed with it in an encrypted archive only your devices can open, kept on your device and in your own private iCloud database, which comes back only if you reconnect with the same person. Everything you wrote stays with you.
Pulse also shows the two of you a shared “question of the day”. Your answer and your partner’s travel inside your shared iCloud space end-to-end encrypted, exactly like a chat message; only the date the answer belongs to travels in plain form. Your partner’s answer stays locked until you’ve answered yours; both answers expire from the shared space within 48 hours and are kept for at most seven days locally on each of your devices.
The optional home-screen widget shows your partner’s latest cue and mood from data already on your iPhone; the widget itself sends nothing.
Two separate switches decide what your partner learns about your cycle, and both stay off until you turn them on. The gentle one shares nothing about the cycle itself: it only lets a reading say that this may be a lower-energy stretch, in the same wording as any other cue. The second, “Share my period & cycle calendar”, shares a real calendar: your current phase, the days of this period, the days predicted for the next one, and the likely ovulation window, so your partner’s app can draw it. Symptoms and the notes you log never travel under either switch. Like the cues, and unlike chat, that calendar is protected by the sharing rules on your iCloud zone rather than additionally end-to-end encrypted, which means Apple, as the operator of iCloud, is technically able to read it. Turning the switch off removes it from your partner’s calendar straight away. It also stops, and is cleared, while you pause sharing or go invisible, after you withdraw consent, and when cycle tracking is off, and your partner’s device shows how old the copy it holds is.
If you turn on local time sharing, your time zone (for example “Europe/Berlin”) travels to your partner inside the same end-to-end encrypted profile record as your name and photo, so their app can show what time it is where you are: on their Home screen, in the chat header, on their widget and on their Apple Watch. It is a time zone, not a location: it says which clock you keep, never where you are. It stays off until you turn it on in Settings, it follows you if you travel, and turning it off clears it from their screen.
A few quieter things travel the same way, and only when you send or allow them: your social battery (every level you set is sent; your partner’s phone shows only the low ones), the evening reflection when you answer it, and the wordless gestures (a silent “I’m here”, a longing, a “miss you”, a held heart). Each one carries a fixed key or a coarse level that your partner’s app renders in their own language, never a number, a measurement or free text, apart from any note you write yourself.
The morning after a cue about you has crossed, Pulse can ask you one question: did how your partner showed up help? You answer by picking one of four fixed options, and only that option travels back to them, inside your shared iCloud space and alongside the day it is about. It carries no measurement, no reason and no free text, it is not additionally end-to-end encrypted the way chat is, and it expires from the shared space within 48 hours. Your partner’s app credits it to whatever it suggested that day, so the next card leans toward what you said actually helped. Each of you keeps at most a fortnight of these answers on your own device; they are included in your data export, and they are cleared if you end the connection.
Pulse can also notice short windows of unusual heart signals and offer to share a soft, neutral hint, for example, “Something seems to have stirred them recently.” One rule applies: nothing is sent until you explicitly approve that individual event. You can change the suggested label or keep the moment entirely private. These labels are rough estimates, never diagnoses.
4. The full picture
5. What our server stores
To make push notifications work (“New message”, a tap from your partner), the app registers one small delivery record on our server (knightifypulse.com): your iCloud (CloudKit) user ID, your device’s push token, the platform (“ios”), and three on/off notification preferences. This record contains no name, no email, and no health data. The visible notification text is deliberately content-free and is written by our server, never by the sender. A chat message can additionally ride inside its push in sealed form: the same end-to-end encrypted text that travels through iCloud, which our server passes on without storing it and which neither we nor Google can read, so your phone can open it before you open the app. Everything else travels through iCloud. Delivery uses Google Firebase Cloud Messaging and Apple’s push service (see section 10). If you turn on the optional “Pulse Moments” feature (a brief Live Activity in the Dynamic Island when your partner sends a tap, for example), the app additionally registers Apple Live Activity push tokens under the same iCloud user ID. These pushes are content-free too. They carry only a kind (“tap”), a count, and a timestamp, never names, messages, or health data, and are delivered directly through Apple’s push service. Turning the feature off removes those tokens immediately. The whole record is deleted when you delete your account in the app. A token is also removed as soon as Google’s or Apple’s push service reports it as no longer valid, and any registration your phone has not refreshed for 180 days is deleted automatically. You can also request its deletion at any time by emailing [email protected].
Current versions of the app add two things to that record: whether the phone is paired, and a one-way fingerprint (SHA-256) of a key that only your phone and your partner’s phone can compute. It lets our server check that a notification really comes from your partner before delivering it, so nobody else who knows your iCloud user ID can make your phone light up. The key itself never reaches us, and the fingerprint cannot be turned back into it, or into anything that opens your messages. It changes when you connect with someone new and is removed when the connection ends.
If Pulse closes unexpectedly, the app may ask you on the next launch whether to send us a crash report. Nothing is sent unless you tap Send, and before you do, the app shows you exactly what the report contains: the app and iOS version, your device model, your language, the last tab you were on, how long the app had been open, and technical details of the failure. You can add a note in your own words. The report carries no iCloud ID, no name, no health data and no message content. If you tap “Not now”, the report is deleted on your phone.
For “Hold to Feel” and the faster typing/read/message signal path, we also run our own real-time relay (self-hosted, not a third party) on the same server. It is only active while both devices have the chat open, relays signals live only, and stores nothing from them permanently; no additional record is created on our side.
This website itself sets only strictly necessary cookies (see Cookies) and keeps short-lived technical server logs (IP address, requested page) for security and abuse prevention, as virtually every website does. If you create an account on this website (currently used only to administer the site, the app itself needs no such account), we additionally store your name, email address, a hashed password, optional passkeys/two-factor settings, and session records including IP address and browser type.
6. Your own iCloud backup
So a new iPhone or a reinstall does not erase your shared story, Pulse keeps a personal backup of your chat, your “Our Story” timeline, and your profile settings (names, photos, notification preferences) in your own private iCloud database. It is encrypted on your device before upload, with a key from your iCloud Keychain; we run no server for it and could not read it. Health data is deliberately never part of this backup. The one place health-related data can reach your iCloud is history you choose to keep when a connection ends: if your partner had shared their cycle calendar with you, that copy is sealed with the rest of that history, as described below, and opened only if you reconnect with them. After a reinstall the app offers to restore it; if you decline, the backup is erased. It is also erased when you delete your account, or when you end the connection and choose to erase everything.
7. Lawful basis (GDPR / DSG)
We process data on the basis of your explicit consent (Art. 6(1)(a) GDPR, complemented by the Austrian DSG) for health-related signals, and on the basis of contract performance (Art. 6(1)(b)) for the app’s features: pairing with your partner, messages, the Hold to Feel signal, the daily question exchange, and the push delivery described in section 5. Because heart signals and cycle data count as special categories of personal data, we rely specifically on your explicit consent under Article 9(2)(a) GDPR for those. You can withdraw consent at any time in Settings → Privacy & Safety → How your data is used, and the app stops processing immediately. Technical server logs and website security rest on our legitimate interest in operating the service safely (Art. 6(1)(f)). Crash reports, including the copy that goes through Firebase Crashlytics (section 10), leave your phone only when you tap Send on the crash prompt, so they rest on your consent (Art. 6(1)(a)), given by that tap for that report: they carry no health data, no message content and nothing that names you. Cues are generated entirely on your device; no automated decision-making with legal or similarly significant effect within the meaning of Article 22 GDPR takes place. Pulse is intended for adults (18+) and is not directed at children.
8. Your rights
- Access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15 to 21 GDPR), just write to [email protected]; we respond within one month at the latest.
- Withdraw your consent to health-data processing at any time (Settings → Privacy & Safety → How your data is used); Pulse immediately stops reading and interpreting your Health data.
- Pause sharing instantly at any time, invisibly if you prefer, and resume whenever you choose.
- End the connection at any time: the shared records in iCloud are removed, and you choose whether the chat and story stay on your device just for you or are erased from your devices and your backup. As with any conversation, your partner keeps their own copy of messages already delivered to their device unless they choose to erase it; if they erase theirs, Pulse tells you and leaves the choice about your copy to you.
- Download your data as a single JSON file.
- Delete your account directly in the app (Settings → Privacy & Safety → “Delete my account”), or by email to [email protected].
- Lodge a complaint with a supervisory authority (DSB in Austria, your local DPA in the EU).
9. Retention
Pulse keeps no health accounts on servers of our own. The records at our end are: the push-delivery record and any Live Activity tokens described in section 5 (kept until you delete your account, a push service reports the token invalid, or your phone has not refreshed it for 180 days); crash reports you chose to send (90 days); a feature idea you sent from the features page (until it has been dealt with, or sooner if you ask); the administrator accounts of this website; technical server logs (deleted after 14 days); and a message you send us through the contact form, covered in section 11. Shared cues expire at the end of the calendar day and are removed from iCloud automatically. The encrypted transport copies of messages, GIFs, and shared memories clean themselves out of iCloud within about seven days of being sent (a memory your partner has not reacted to or commented on yet is re-sent every few days, for up to 45 days, so it still reaches a partner who was away); the readable copies live on your two devices (and in each partner’s own encrypted iCloud backup, section 6) until you delete them, end the connection with erase, or delete your account. Typing signals disappear after seconds, “how are we?” signals after twelve hours, answers to the “question of the day” after 48 hours from the shared space (at most seven days locally on your device after that), and Hold to Feel signals are not stored at all, they exist only for the moment they’re relayed. Requests clean themselves out of the shared space within seven days. Shared calendar events, date wishlist entries and shared notes are each synced as copies that expire within thirty days; your device quietly refreshes the ones still current (upcoming and yearly events, live wishes and notes, and recent removals) so they stay in the shared space while they matter, and the readable copies live on your two devices until you delete them. Watchlist entries stay in the shared space for as long as they are on your list (your own device quietly refreshes them, and each synced copy expires within thirty days), while the comments and reactions on them, which travel end-to-end encrypted, clean themselves out within about seven days; here as well, the readable copies live on your two devices until you delete them. On your own device, the 90-day readings history rolls over by itself (the ninety-first day pushes the oldest out), the in-app notification list keeps its most recent entries only, and a photo taken from the Lock Screen is discarded after 48 hours if it never got sent. Key and profile records renew themselves and expire within thirty days. Invite codes expire after 48 hours. The live “likely asleep” status, sent only while you share your local time, lives one hour and is not end-to-end encrypted. When your switches hold a reading back, a neutral “nothing new to share” cue is sent in its place and expires like any cue. Your partner’s mood labels are kept for 14 days on each device for “Our week”. Website sessions end automatically after a short period of inactivity. If you delete your account in the app, local data, the partner connection, all cues and messages synced to iCloud, your encrypted iCloud backup, and the push-delivery record on our server are removed immediately.
Crash reports you choose to send are kept on our server for 90 days and then deleted automatically.
Your shared time zone travels in the same profile record as your name and photo, so it lives exactly as long as that record and is replaced rather than accumulated: there is only ever one current value, and turning sharing off clears it from your partner’s app. The quiet signals are deliberately shorter-lived: a longing fades after an hour, a silent “I’m here” and a social battery after six hours, a held heart after twelve, a “miss you” count after a day, and an evening reflection after two. A shared cycle calendar is replaced rather than accumulated, so there is only ever one current copy, and it expires from the shared space within forty-five days if nothing renews it.
10. Service providers, processors & international transfers
- Apple (iCloud / CloudKit, push): sync & storage of shared cues and encrypted messages, inside your own iCloud account, plus delivery of notifications to your device. Apple acts as our processor; for EU users the data generally stays within the EU.
- Apple (Apple Maps and the iTunes Search API), only when you use them: when you search for a place (for a memory, a date plan, or the area you plan dates in), the text you type goes to Apple Maps, and so does that area when Pulse looks for venues nearby; Apple Maps returns places, map images and place details. Pulse does not use your device location for this. When you add a film, series, book or music to the watchlist without a link, your phone may look up a cover in Apple’s iTunes Search API, sending the title, its kind and your region. These requests go straight from your phone to Apple with ordinary technical request data such as your IP address; nothing passes through our server, and your partner’s phone contacts no one.
- Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging): delivers the push notifications. For that, Google receives your device’s push token and the content-free notification text, never health data. For a chat message, the push can also carry that message in sealed, end-to-end encrypted form, which Google cannot read. Analytics and advertising are disabled in our Firebase configuration.
- Google Ireland Ltd. / Google LLC (Firebase Crashlytics): only if the app asks you after a crash and you tap Send, the system’s crash log also goes to Crashlytics so we can fix it. Until then it stays on your phone, and “Not now” deletes it. It contains the stack trace, your device model, your iOS version and a random installation identifier that is not linked to your name or your iCloud account. It contains no health data, no message content and no contact details. Analytics and advertising stay disabled in our Firebase configuration.
- GIPHY, Inc. (GIF search): only when you open the GIF search in chat, GIPHY processes your search terms and standard technical request data (e.g. IP address) to return results. The GIF you send travels encrypted through iCloud, not through GIPHY.
- WHOOP, Inc. (only if you connect a band): your iPhone requests your own sleep, recovery and workout records from WHOOP directly, so WHOOP sees those requests and standard technical data (e.g. IP address), as it already does for its own app. Our server is involved only in the sign-in exchange described in section 2 and keeps nothing from it. If you never connect a WHOOP, nothing is ever sent to them.
- Oura Health Oy, Finland (only if you connect a ring): your iPhone requests your own daily summaries from Oura directly, so Oura sees those requests and standard technical data (e.g. IP address), as it already does for its own app. Oura also notifies our server when your data changes, naming only the account and the kind of data, as described in section 2. If you never connect an Oura Ring, nothing is ever sent to them.
- Fastmail (support email) and our web hosting provider (operating knightifypulse.com, including the real-time channel behind “Hold to Feel” and our internal queue infrastructure, all on the same server, not a separate third party).
Where these providers process data in the United States (Google, GIPHY, WHOOP, Fastmail), we rely on the EU adequacy decision for the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 44 et seq. GDPR). If Pulse introduces paid plans in the future, payment will run through the Apple App Store; payment data never reaches us. No advertising, analytics, or attribution providers, and we never sell data.
11. When you write to us
If you use the contact form, your message is delivered by email to our support inbox; we keep your name, email, optional country, and message there so a real person can reply. We use them only to answer you, on the basis of taking steps at your request and our interest in handling enquiries (Art. 6(1)(b) and (f) GDPR). We delete enquiries once the conversation is clearly finished, and you can ask us to erase yours sooner at [email protected].
If you send us a feature idea from the features page, that one is stored in a database on this website rather than only emailed: the title, and whatever else you chose to add, a description, a link, your name and your email. We keep it so a person can read it, answer you, and see what has already been suggested, on the basis of our legitimate interest in improving the app (Art. 6(1)(f) GDPR). Name and email are optional; an idea sent without them is anonymous to us. Write to [email protected] and we will delete yours.
Terms of use
1. What Pulse is, and is not
Pulse is a wellness companion. It is not a medical device, diagnostic tool, or substitute for professional health advice. The cues Pulse generates are suggestions, not statements of fact, and use language like “might” and “could” for that reason.
2. Account & eligibility
You must be 18 or older to use Pulse. You are responsible for keeping your Apple ID and device secure. One account per person.
3. Pricing
Pulse is currently free. If we introduce a paid subscription later, it will run exclusively through the Apple App Store, announced clearly in advance, and you will be able to cancel at any time. Nothing you already share and see will be moved behind a paywall retroactively without asking you first.
4. Acceptable use
- Do not use Pulse to monitor someone without their continuous, informed consent.
- Do not attempt to reverse-engineer the on-device interpretation models.
- Do not use Pulse in any safety-critical or medical context.
5. Liability
To the extent permitted by Austrian law, Pulse is provided “as is”. We are not liable for relationship outcomes, missed cues, or decisions made based on a wellness suggestion. Our total liability is limited to the fees you paid in the previous twelve months. Nothing in these terms limits our liability for intent or gross negligence, for personal injury, or your mandatory statutory rights as a consumer.
6. Termination
You may delete your account at any time. We may suspend accounts that violate these terms, with notice where possible.
7. Ending a connection
Either of you can end a connection at any time, and you choose whether your shared history is kept on your own device or erased. History you keep is sealed with a key only your devices hold, which travels in your iCloud Keychain, and is stored on your device and in your own private iCloud database, so it survives reinstalling the app; nobody without that key can open it, us included. Chat photos, GIFs and timeline photos in it stay on the device only. It is opened again only if you pair with the same person; you can delete it at any time under Privacy & Safety → Saved connections, and deleting your account deletes it everywhere. Your partner's choices never erase it: if they end the connection and erase their own copy, yours is kept and Pulse asks you whether to keep or erase it. The day-by-day cards of the last two weeks (the question of the day, the mood chart, evening reflections) are cleared whenever a connection ends; your own health history is not. Pulse may also end a connection on its own, in one case only: when your partner's shared space has been continuously unreachable for seven days. That exists because an explicit goodbye can be missed, and a device would otherwise stay linked to an account that is gone. Your data is kept, never erased, when it happens this way. Reconnecting is always possible, by pairing again.
8. Jurisdiction
Austrian law applies. Exclusive place of jurisdiction is Vienna, Austria, without prejudice to mandatory consumer protection in your country of residence.
Cookies
This website stores exactly one thing in your browser, and only in your browser:
pulse.theme, your light / dark preference.- a strictly necessary session cookie and a CSRF security token (
XSRF-TOKEN) that the website’s framework sets for safe operation, they contain no profile, expire after a short time, and as strictly necessary cookies require no consent.
Your language lives in the address (/en, /de, /fa, /ar or /ru), nothing needs to be stored for that. No advertising cookies. No analytics. No third-party trackers.
Imprint
Provider information pursuant to § 5 ECG / § 14 UGB (Austrian law).
Provider
Knightify FlexCo
Rauchgasse 28 Top 2
1120 Vienna
Austria
Contact
E-Mail: [email protected]
Website: knightify.tech
Business purpose
Software product development and operation, as well as custom software engineering.
Legal form
FlexCo (Austrian Flexible Company).
Companies Register number
FN 666564 t
Companies Register court
Commercial Court Vienna
Management
Amirali Khoshneviszadeh
VAT identification number
to be added upon issuance.
Editorial responsibility
Responsible for content: Knightify FlexCo, Rauchgasse 28 Top 2, 1120 Vienna, Austria.
Content on this website is created with the utmost care. However, no guarantee can be given regarding accuracy, completeness, or timeliness.
Liability for links
This website contains links to external third-party websites whose content we cannot influence. The respective provider is always responsible for the contents of the linked pages.
Copyright
Content and works on this website created by Knightify FlexCo are subject to copyright. Any duplication or use beyond the limits of copyright law requires written consent.
Online dispute resolution (EU)
The EU’s former online dispute resolution platform was discontinued on 20 July 2025. Consumers can address complaints directly to us ([email protected]) or to the competent consumer-protection and supervisory authorities.
We are, however, not obliged and generally not willing to participate in dispute resolution proceedings before a consumer arbitration body.
One last thing
If you read this far, you are exactly the kind of person we built Pulse for. If anything here feels off, write to us, we will rewrite it.