Privacy Policy — PulsCalm

Effective: April 18, 2026 · Last updated: April 18, 2026

This Privacy Policy explains how PulsCalm collects, uses, and shares information.

1. Information We Collect

1.1 You provide

Account: email or Apple ID identifier
Session logs and notes

1.2 HealthKit data (with your permission)

Heart rate
Heart rate variability (HRV)
Resting heart rate
Related HealthKit types needed for stress detection and recovery scoring

HealthKit data is read on-device. Raw HealthKit samples are not uploaded to our servers; only derived session metadata (e.g., session start/end, duration, derived stress/recovery score) may be stored in your account for display.

1.3 Automatically collected

Subscription state via RevenueCat
Crash reports (Apple-level, opt-in)

1.4 Not collected

Camera/photos, microphone/audio, location, contacts, IDFA, browsing history

2. How We Use Information

Detect stress patterns and generate recovery sessions
Display your history and trends
Process subscription purchases

3. AI and Automated Analysis

Derived session summaries (e.g., "HRV below baseline for 3 sessions") may be sent to Anthropic's Claude API to generate insights. No personal identifiers and no raw HealthKit samples are shared with Anthropic.

4. Third-Party Services

Service	Purpose	Data shared
Supabase	Backend, auth, database	Account, session metadata
RevenueCat	Subscription management	Hashed Apple ID, entitlement
Anthropic (Claude)	AI insight generation	Aggregated session summaries (no identifiers, no raw health data)
Apple	Sign in with Apple, IAP, HealthKit	Apple ID identifier, receipt, HealthKit permissions

We do not sell your data. HealthKit data is not shared with advertising networks or used for marketing.

5. Security

TLS in transit, encryption at rest
Row-level security for user data isolation
Raw HealthKit samples remain on-device

6. Retention

Retained while your account is active. Upon deletion, session data is removed within 30 days.

7. Your Rights

Access, correction, deletion, export. Email [email protected].

8. HealthKit Disclosures

HealthKit data is used only for the app's stated features.
HealthKit data is not used for advertising.
HealthKit data is not disclosed to third parties for their marketing purposes.
You may revoke HealthKit permissions at any time in iOS Settings → Privacy & Security → Health.

9. Children's Privacy

Not directed to children under 16.

10. International Transfers

Data may be processed in the United States via Supabase, RevenueCat, and Anthropic.

11. Cookies and Tracking

No cookies. No IDFA. No ad networks.

12. Changes

Material changes announced via in-app notice or email at least 7 days before taking effect.

13. Contact

Email: [email protected]