Security & architecture
How the privacy promise is actually built.
Pulse claims your raw health data never leaves your phone. That is a strong claim, so this page says exactly what it means, which keys live where, what our servers hold, what we can still see, and how you can check any of it yourself.
The claim, stated precisely
Your heart rate, heart rate variability, sleep and movement are read from Apple Health on your iPhone, interpreted on that iPhone against your own rolling baseline, and turned into one sentence. The sentence is the only thing that travels. No measurement, no score, no chart and no history reaches our servers, because there is no code path that would send one.
That is a narrower promise than "we are private", and it is the one worth checking. The rest of this page is the checking.
Four things that follow from it
- We cannot show you your own health history from a web dashboard, because we do not have it.
- We cannot recover your chat if you lose your key and every device, because the key was never ours.
- We cannot build cloud features over your content, because our servers cannot read it.
- A subpoena served on us produces a pseudonymous identifier and a push token. There is nothing else to hand over.
The route a day takes
Four steps, and only the fourth one leaves the device.
-
01
Measured
Your Apple Watch, or a connected WHOOP band, writes measurements into Apple Health on your iPhone. Apple Health is a database on your phone, not a service of ours.
-
02
Read, with permission
Pulse reads the types you allowed in the iOS Health permission screen, and only those. Revoke one there and the app keeps working with what is left.
-
03
Interpreted on the device
Today is compared against your own recent weeks by code running on your iPhone. There is no server in this step and no model anywhere in it.
-
04
One sentence crosses
The resulting cue, a coarse mood label and the display name you chose sync to your partner through your own iCloud, in a zone shared with exactly one person.
Every piece of data, and where it sits
Three lists, because there are exactly three places data can be: your device, the space you share with your partner, and our server. Nothing is in a fourth place.
On your device, and nowhere else
Held in the iOS Keychain, readable only after the phone has been unlocked once since boot, and deliberately kept out of your iCloud backup.
-
Heart rate, resting heart rate, HRV, sleep, steps, exercise and stand time, respiratory rate, blood oxygen, mindful sessions
Read from Apple Health. A rolling 90-day history stays on the phone so the Insights tab can draw a trend.
-
Menstrual cycle data
Only if you turn on Rhythm Awareness, which is off by default. iCloud mirroring is disabled for it in code, so it never syncs and the phase name never leaves the device.
-
Unusual heart-signal windows
Noticed on the device. Nothing is shared until you approve that individual moment, and a filter strips numbers and cycle vocabulary from the wording before anything can leave.
-
Your chat identity private key
Generated on your device, stored in your iCloud Keychain so your own other devices can use it. Never uploaded to us.
-
WHOOP access and refresh tokens
Only if you connect a band. Kept in the app keychain, marked device-only so they never sync, and revoked with WHOOP on disconnect.
-
Your consent record, and the app's own notification list
A versioned, timestamped record of what you agreed to, withdrawable at any time. Withdrawing stops all health processing immediately.
What crosses to your partner
Through your own iCloud, in a private zone shared with one named participant. The zone is not public: a link to it is useless to anyone whose iCloud identity is not on the participant list.
| What | Protection |
|---|---|
| The daily cue, its suggested actions, a coarse mood label, your display name and photo | Shared zone, read-only. Name and photo are end-to-end encrypted. Cues expire at the end of the day. |
| Chat messages, photos, GIFs, gestures, requests, Our Story entries, calendar events | End-to-end encrypted on your device. Neither we nor Apple can read them. |
| Watchlist and wishlist entries: a title, a kind, a link, a cover, a status | Plain inside your shared zone, never health data. Comments, reactions and each partner's verdict are end-to-end encrypted. |
| The daily question and both answers | Shared zone only. Not additionally end-to-end encrypted the way chat is. See the limits below. |
| Typing markers, read receipts and the "hold, together" signal | Relayed live while the chat is open, stored nowhere. The hold signal is a single yes or no with no content at all. |
Everything our server holds
This is the complete list, not a summary of it. The app has no account system, so there is no profile, no message archive and no health record on our side to list.
| Record | Why it exists | Kept until |
|---|---|---|
| A pseudonymous iCloud identifier, a push token, the platform, and three notification on/off switches | So a notification can be routed to the right phone. | You delete your account in the app, or Apple reports the token dead. |
| A contact-form message: your name, email, optional country and what you wrote | So a person can answer you. | The conversation ends. It is emailed to our inbox; only the topic is logged. |
| Website session cookie and CSRF token | So the site works. Strictly necessary, no analytics and no advertising cookie exists. | The browser session ends. |
| Administrator accounts for this website | So we can publish these pages. Unrelated to the app, which has no login. | The account is deleted. |
What is deliberately absent: any health value, any message text, any name from the app, any location, any advertising identifier.
The encryption model
Named rather than gestured at, so it can be argued with.
- Key agreement
- Curve25519, through Apple's CryptoKit. Each partner generates an identity key pair on their own device and they agree on a shared secret directly. No key material passes through our servers at any point.
- Message encryption
- AES-GCM, through CryptoKit, which authenticates as well as encrypts: a modified ciphertext fails to open rather than decrypting into something else.
- Where the keys live
- Your private key sits in your iCloud Keychain, tied to your Apple ID and available to your own devices. We have no copy and no way to request one. Locally cached health readings sit in the device keychain under the device-only class, which keeps them out of your iCloud backup.
- Transport
- Encrypted payloads travel through Apple's CloudKit. While both of you have the chat open, the same already-encrypted bytes can also take a faster path over our own real-time relay. It signs and forwards, and stores nothing.
- Notifications
- Push notifications are content-free by design: a fixed title and body plus a type string, never the message. A request for something private is never spelled out on a Lock Screen where someone standing beside you can read it.
- The WHOOP sign-in
- Your phone talks to WHOOP directly. Our server performs only the token exchange, because WHOOP requires a client secret and a secret shipped inside an app is readable by anyone who downloads it. Nothing from that exchange is stored: no token, no WHOOP user id, no row. The redirect lands on a domain this app has claimed through Associated Domains, so the authorisation code cannot be intercepted by another app on the device.
Who else receives anything
The full list, with what each one actually gets. Several of these only exist for people who use a particular feature.
| Recipient | What they receive | When |
|---|---|---|
| Apple | Encrypted payloads and cues inside your own iCloud, and push delivery. | Always. This is where your shared space lives. |
| Google (Firebase Cloud Messaging) | A push token and a content-free notification title, body and type. Firebase analytics and ads are disabled in the build; only the core and messaging components are linked. | When a notification is sent to you. |
| GIPHY | Your GIF search terms. The GIF you actually send travels end-to-end encrypted like any message. | Only while you have the GIF picker open. Never open it and nothing is sent. |
| WHOOP | Your own sign-in and your own measurements, read by your phone directly from WHOOP. | Only if you connect a band. |
| Fastmail | The contact message you wrote us. | Only if you write to us. |
Verified absent from both codebases
- No analytics SDK of any kind
- No advertising or attribution SDK
- No advertising identifier, and no tracking permission prompt, because there is nothing to track
- No third-party crash reporter; diagnostics use Apple's on-device framework only
- No payment or subscription processor
- No language model, in the app or on the server
- No cross-app tracking, and no tracking domains in the privacy manifest
What this does not protect you from
The part most pages leave out. None of the following is a bug report; all of it is either a deliberate trade or a known limit we would rather you hear from us.
-
We can see metadata, and encryption does not remove it
We can see that an account exists, that two accounts are linked, that a message of a certain size moved between them at a certain time, and the token Apple needs to deliver a push. We keep as little as we can and sell none of it, but "we cannot read your messages" and "we know nothing about you" are different sentences, and only the first is true of anyone.
-
The daily question is not end-to-end encrypted
Your answer and your partner's travel inside your shared iCloud zone like a cue, rather than being separately encrypted the way chat is. They expire from the shared space within 48 hours and are kept at most seven days on each device. We state this plainly because it is the one property a reader would otherwise reasonably assume.
-
Some shared entries are plain, on purpose
Watchlist and wishlist entries, a title, a kind, a link, a status, sync as plain records inside your shared zone, because they flow before the key exchange that protects chat. They never contain health data. The comments and reactions on them are encrypted.
-
Pairing leaves a brief public trace
While an invite is open, a record holding a pseudonymous iCloud identifier, your chosen display name and a short code is readable by other signed-in users of the app's iCloud container. Codes expire after 48 hours and the records are scrubbed on acceptance, on disconnect and on account deletion. The shared zone itself is not exposed this way: it is scoped to your partner's iCloud identity, so a harvested link opens nothing.
-
The notification endpoint is guarded by a key that ships in the app
That means it is not a real secret. The worst case is that someone could cause a content-free notification to appear on a phone whose pseudonymous identifier they already know; the endpoint returns a delivery count and discloses nothing about the person. It is rate-limited, and hardening it with per-device attestation is on the list rather than done.
-
Your own devices, and the people near them
Anyone who can unlock your phone can read your messages, which is true of every messaging app. Turn on the in-app Face ID lock if that matters to you. Equally, end-to-end encryption protects the wire, not the person you chose to send something to.
-
No independent audit yet
The review this page is built from was done by us, against our own code, on the dates listed below. That is more than an intention and less than an external audit, and calling it anything else would be the first dishonest sentence on the page. An independent review is something we intend to commission, and we will date it here when it happens.
How to check this yourself
You should not have to take our word for it, and on iOS you largely do not have to.
-
01
Turn on App Privacy Report
In iOS Settings, under Privacy & Security, App Privacy Report records which domains each app contacts and which sensors it touches. Use Pulse for a week and read what it lists. You are looking for the absence of analytics and advertising domains.
-
02
Read the Health permission screen
Settings, then Health, then Data Access & Devices, then Pulse. It shows every type the app can read and write. Revoke anything there and watch the app keep working with less.
-
03
Check the App Store privacy label
Apple requires the label to match the code, and ours declares a name, a pseudonymous user identifier and a device token, all marked as app functionality, none marked as tracking.
-
04
Watch the traffic yourself
If you are the sort of person who owns a proxy, point one at the app. What you will see is iCloud, our push endpoint and, if you connected a band, WHOOP. What you will not see is a measurement.
-
05
Ask us something specific
Vague privacy questions get vague answers everywhere. A specific one about a particular flow gets a specific answer from us, and if the answer is uncomfortable it still gets answered.
When this was last checked
Each entry is a review of the shipped code against what the site and the policy claim, with what was found and fixed.
-
2 July 2026
Full review of both repositories. Found and fixed: an undisclosed recipient list, a "we store nothing" claim that was untrue of the push record, and an account deletion that did not remove that record. The App Store privacy label was corrected at the same time.
-
24 July 2026
Reviewed the real-time relay and two new features. Disclosed the relay as an additional transmission path, and stated plainly that the daily question is not end-to-end encrypted like chat.
-
29 August 2026
Reviewed the shared watchlist and the WHOOP import. Added WHOOP as a named recipient for the people who connect a band, and documented that link previews and cover art are fetched by the sender's device only.
Found something?
Responsible disclosure is welcomed and credited. Write to [email protected] with enough detail to reproduce, and give us a reasonable window before publishing. We do not run a paid bounty, we are too small for that to be honest, but we will not send a lawyer at you either.
Read the rest of it.
The privacy policy carries the legal version of everything above, including your rights and how to exercise them.
