How the privacy promise is actually built.

Every piece of data, and where it sits

Three lists: what stays on your device, what crosses into the space you share with your partner, and what our application stores. Each entry says what protects it, and where that protection stops.

• The daily cue is derived from your health data, and it does leave your phone

  It has to. It is written for your partner. It travels inside your shared iCloud zone alongside the mood label, and it is not separately end-to-end encrypted the way chat is, so Apple is technically able to read it. We say this plainly because "interpreted on your device" is easy to hear as "nothing about your health ever leaves", and only the first of those is true. What does not travel is the measurement behind the sentence: no heart rate, no HRV, no sleep hours. The one health figure that can travel on its own is the cycle calendar, which is a separate switch, off by default, with its own row in the table above.

• We can see metadata, and encryption does not remove it

  We can see that an account exists, that two accounts are linked, that a message of a certain size moved between them at a certain time, and the token Apple needs to deliver a push. We keep as little as we can and sell none of it, but "we cannot read your messages" and "we know nothing about you" are different sentences, and only the first is true of anyone.

• Copies in a calendar are outside the encryption

  If you mirror your plans into a calendar, Pulse writes ordinary calendar entries: titles, times, places and notes, readable. A calendar that syncs to iCloud, Google or Outlook stores them with that service, and anyone you share it with can see them. Pulse asks before it writes to such a calendar, but once the copy is there, that calendar's rules apply, not ours. We state this plainly because the shared calendar itself is end-to-end encrypted, and a reader would otherwise reasonably assume the copy is too.

• Some shared entries are plain, on purpose

  Watchlist and wishlist entries, a title, a kind, a link, a status, and for a wish saved from a real place its address and map position, sync as plain records inside your shared zone, because they flow before the key exchange that protects chat. So does the day you count from. Apple can read them; they never contain health data. The comments and reactions on watchlist entries are encrypted.

• Apple is underneath all of this

  Your shared space is an iCloud zone, your keys sit in the iCloud Keychain, and your measurements live in Apple Health. The encrypted records are opaque to Apple exactly as they are to us. The rest of the shared zone is not, as the two rows above describe. Using Pulse means trusting Apple with that much, and an architecture that says otherwise would be describing a different app.

• We do not claim forward secrecy

  The chat key comes from a Curve25519 agreement between your two identity keys, not from the per-message ratchet a dedicated messenger uses. So we make no forward-secrecy claim: a private key taken off a device could open the messages it protected, rather than only the next one. We would rather name the limit than let the phrase "end-to-end encrypted" carry a property we have not built.

• Your keys depend on your Apple account

  Your private key lives in your iCloud Keychain so your own devices can reach it. That is what lets a new phone work without us ever holding a copy, and it is also a dependency: whoever controls your Apple account and can add a device to it is in a position we cannot help with, because there is no password of ours in the way. Keep two-factor authentication on that account.

• Pairing leaves a brief public trace

  While an invite is open, a record holding a pseudonymous iCloud identifier, your chosen display name and a short code is readable by other signed-in users of the app's iCloud container. Codes expire after 48 hours and the records are scrubbed on acceptance, on disconnect and on account deletion. The shared zone itself is not exposed this way: it is scoped to your partner's iCloud identity, so a harvested link opens nothing.

• The notification endpoint is guarded by a key that ships in the app

  That means it is not a real secret. The worst case is that someone could cause a content-free notification to appear on a phone whose pseudonymous identifier they already know; the endpoint returns a delivery count and discloses nothing about the person. It is rate-limited, and hardening it with per-device attestation is on the list rather than done.

• Your own devices, and the people near them

  Anyone who can unlock your phone can read your messages, which is true of every messaging app. Turn on the in-app Face ID lock if that matters to you. Equally, end-to-end encryption protects the wire, not the person you chose to send something to.

• A partner is not always a safe person

  Pulse is built for two people who chose each other, and nothing in it can tell the difference between a partner who is worried about you and one who is controlling you. If someone is pressing you to install it, to turn sharing back on, or to hand over your phone, that is not a problem encryption solves. Pause and disconnect are one tap away, pausing can be invisible, and you never owe anyone an explanation for using either.

• Pausing stops what comes next, not what already arrived

  Pause stops anything new from crossing, and can do it without telling your partner. It does not reach backwards: a cue or a message that already arrived is on their device, and no button of ours can take it back. Ending the connection removes the shared records for the same reason it cannot empty their phone. This is how every messenger behaves, and it is worth knowing before the day you need it.

• No independent audit yet

  The review this page is built from was done by us, against our own code, on the dates listed below. That is more than an intention and less than an external audit, and calling it anything else would be the first dishonest sentence on the page. An independent review is something we intend to commission, and we will date it here when it happens.

• A connection can end without either of you ending it

  Pulse watches for your partner's shared space, because an explicit goodbye can be missed: they may end things while your phone is offline, and without this check a device would sit "connected" to nobody forever. So a shared space that stays unreachable is eventually treated as a connection that ended, keeping your data. We are naming it here because it is a decision the app makes on your behalf, and because we got it badly wrong once: an earlier version acted after three checks, about a minute, and since ending it on one phone removes what the other phone is watching for, a brief outage could disconnect both people within minutes of each other. It now takes seven continuous days, a single sighting resets the clock, and anything the app cannot determine, being offline among it, is not counted at all.

When this was last checked

Each entry is either a review of the shipped code against what this site and the policy claim, or a correction to those claims, with what was found and changed.

1. 2 July 2026

   Full review of both repositories. Found and fixed: an undisclosed recipient list, a "we store nothing" claim that was untrue of the push record, and an account deletion that did not remove that record. The App Store privacy label was corrected at the same time.

2. 24 July 2026

   Reviewed the real-time relay and two new features. Disclosed the relay as an additional transmission path, and stated plainly that the daily question is not end-to-end encrypted like chat.

3. 29 August 2026

   Reviewed the shared watchlist and the WHOOP import. Added WHOOP as a named recipient for the people who connect a band, and documented that link previews and cover art are fetched by the sender's device only.

4. 13 September 2026

   A copy review of the whole website rather than a new review of the code, so the date above is unchanged. Corrected claims that had grown broader than the architecture: the daily cue described as though it stayed on the device, the daily question described on the features page as end-to-end encrypted like chat, a server inventory called complete that omitted feature ideas and Live Activity tokens, and a subpoena answer that implied we hold nothing at all. Made Apple's view of the shared zone explicit, and added the forward-secrecy, Apple-account, coercion and pause limits below.