Privacy Policy

Pulsem8 ("we," "our," or "us") operates the Pulsem8 mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

1. Information We Collect

Account Information

• Email address
• Account credentials (password, hashed and salted)

Health & Biometric Data

• Heart rate data from Apple Watch, Fitbit, or Garmin via Apple HealthKit (iOS) and Health Connect (Android)
• Heart rate variability (HRV) metrics derived from the above

Trading Platform Data

• Trading platform credentials (investor/read-only passwords for MT4, MT5, cTrader, NinjaTrader) -- encrypted with AES-256 before storage
• Trade history (entries, exits, position sizes, P&L) retrieved via read-only API access through MetaApi and Tradovate APIs

Behavioral & Self-Report Data

• Emotional self-reports and journal entries
• Tilt detection events and coaching session logs
• User preferences and settings

Device & Technical Data

• Device type, operating system, and version
• App version and crash logs
• Anonymous usage analytics

2. How We Use Your Data

• Tilt Detection: Heart rate and trading data are correlated in real-time to detect emotional tilt states.
• AI Coaching: Your trading patterns, emotional logs, and biometric data are used to generate personalized coaching via Anthropic's Claude API.
• Voice Coaching: Coaching text is converted to speech via ElevenLabs TTS for audio delivery.
• Analytics & Improvement: Aggregated, anonymized data is used to improve tilt detection algorithms and app features.
• Subscription Management: Account and payment data is processed through RevenueCat and the respective app stores.

We do NOT sell your personal data to any third party. We do NOT use your data for targeted advertising.

3. Third-Party Services

We use the following third-party services to operate Pulsem8:

• Supabase (PostgreSQL) -- Database storage and authentication. Data stored with Row Level Security (RLS) policies.
• RevenueCat -- Subscription and in-app purchase management. Processes payment information through Apple App Store and Google Play.
• MetaApi -- Read-only connection to MT4/MT5/cTrader trading platforms to retrieve trade history.
• Tradovate API -- Read-only connection to NinjaTrader/Tradovate to retrieve trade history.
• Anthropic (Claude API) -- AI coaching engine. Trading and behavioral data is sent to generate coaching responses. Anthropic does not retain data for training purposes under our API agreement.
• ElevenLabs -- Text-to-speech for voice coaching. Only coaching text is sent; no personal identifiers are included.

Each third-party service is governed by its own privacy policy. We encourage you to review them.

4. Data Storage & Security

• Trading platform credentials are encrypted with AES-256 encryption before storage.
• All data in transit is protected with TLS 1.2+ encryption.
• Database access is controlled via Supabase Row Level Security (RLS) policies -- users can only access their own data.
• We follow industry-standard security practices including regular security audits, access controls, and monitoring.
• HealthKit and Health Connect data is never stored in unencrypted form on our servers.

5. HealthKit & Health Connect Data

The same protections apply to Google Health Connect data on Android.

6. Your Rights

You have the right to:

• Access your personal data -- request a copy of all data we hold about you.
• Delete your account and all associated data.
• Export your data in a machine-readable format.
• Correct inaccurate personal information.
• Withdraw consent for data processing at any time.

To exercise any of these rights, contact us at privacy@pulsem8.app.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• All personal data, trading history, health data, coaching logs, and self-reports are permanently deleted within 30 days.
• Anonymized, aggregated data that cannot be used to identify you may be retained for analytics purposes.
• Data required for legal or regulatory compliance may be retained for the applicable statutory period.

8. Children's Privacy

Pulsem8 is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a user under 18, we will promptly delete their account and all associated data.

9. GDPR Compliance (European Economic Area)

If you are located in the European Economic Area (EEA), the following additional rights and disclosures apply:

• Legal Basis: We process your data based on (a) your consent, (b) performance of a contract (providing the App services), and (c) legitimate interests (improving our services).
• Data Transfers: Your data may be transferred to and processed in the United States. We use appropriate safeguards (standard contractual clauses) to protect data transferred outside the EEA.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.
• Right to Restriction: You may request restriction of processing of your personal data.
• Right to Portability: You may request your data in a structured, commonly used, machine-readable format.
• Data Protection Officer: For GDPR-related inquiries, contact privacy@pulsem8.app.

10. CCPA Compliance (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: We do not sell personal information. No opt-out is necessary.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, email privacy@pulsem8.app with the subject line "CCPA Request."

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy in the App and updating the "Last updated" date. Your continued use of the App after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Email: privacy@pulsem8.app
Subject: Privacy Inquiry