Privacy policy
Last updated 14 October 2026
PULSO is a coaching app. To plan your training it needs to know about your body, your health and your days, so this page says plainly what we collect, why, who helps us process it, and how you remove it.
Who is responsible
The controller of your data is Erik Pastor Ríos, a self-employed developer in Spain. For anything about your data, write to privacy@pulsocoach.com. We answer within one month.
What we collect
- Account: your email, or your Google name and email if you sign in with Google, and passkeys you add. Setup starts as a guest with no email.
- What you tell your coaches: chat messages, your goals, events, injuries and pain, habits, sleep schedule, places and kit, and answers to check-ins and tests.
- Health and training data: from the apps you connect (Garmin, WHOOP, Oura, Polar, Withings, Hevy, Intervals.icu, Concept2, Peak Health) and, in the phone app, Health Connect or Apple Health. This includes workouts, heart rate, HRV, sleep, weight and body composition. We only read what each app shares once you connect it.
- Files you upload: lab and test reports, photos and video clips.
- Calendar: if you connect Google Calendar, your free and busy times and the sessions we add.
- Payments: your plan and billing status from Stripe.
- Usage: pages viewed, taps, performance and errors, and your device and browser type.
Much of this is health data, a special category under the GDPR. We process it only because you ask us to coach you with it, and only for that.
Why we use it, and on what basis
- To coach you (plans, check-ins, reports, notifications): to perform our contract with you, and your explicit consent for health data (GDPR art. 6(1)(b) and 9(2)(a)).
- To bill you for the paid plan: contract, and legal duties to keep invoices (art. 6(1)(b) and (c)).
- To keep PULSO working and improve it (errors, analytics, checking the quality of coaches’ replies): our legitimate interest in a safe, working product (art. 6(1)(f)).
Your coaches are AI. They draft plans and replies automatically, but nothing they decide has legal effects on you, and you can always change or ignore a plan. We do not sell your data, show ads, or use it to train AI models.
Who processes it for us
These companies process data on our behalf, under data processing agreements, only to run PULSO.
| Company | What for | Where |
|---|---|---|
| Supabase | Accounts, sign-in and the database and files behind everything you see | United States |
| Vercel | Hosting the app, and the AI Gateway that routes model calls | United States, EU |
| Anthropic | The Claude models your coaches run on, and web searches they make | United States |
| OpenAI | Turning speech in your clips into text, and text search over coaching notes | United States |
| TypeSafe | A small model that checks messages for pain and approves routine calendar changes | United States |
| PostHog | Product analytics, errors and records of model calls, including their content | EU (Germany) |
| Stripe | Payments for the paid plan. We never see your card number | United States, EU |
| Open-Meteo | Weather for where you train | EU |
| Push services (Google, Apple, Mozilla, Expo) | Delivering the notifications you turn on | United States, EU |
The apps you connect (Garmin, Google Calendar and the rest) are not our processors. Each one shares data with us under its own terms, and we write to them only what you ask, such as a workout or a calendar event.
Transfers outside the EU
Our database and several of the companies above are in the United States. Those transfers rely on the EU–US Data Privacy Framework where the company is certified, and on the European Commission’s Standard Contractual Clauses otherwise.
How long we keep it
- Your data stays while you have an account, and goes when you delete it.
- A guest who never saves their progress is deleted after 7 days.
- Photo and clip files are deleted 30 days after you send them. What your coaches learned from them stays.
- Billing records are kept as long as tax law requires.
Your rights
You can access, correct, export or delete your data, object to or restrict how we use it, and withdraw consent at any time. Withdrawing consent means we stop coaching with your health data.
- Delete everything: in the app, You › Settings › Delete all removes your account, your files and every record at once.
- Disconnect an app: in You › Apps. We stop reading from it straight away.
- Anything else: write to privacy@pulsocoach.com.
You can also complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos.
Google user data
If you connect Google Calendar, PULSO reads your calendar to find time for sessions and adds the sessions you agree to. If you sign in with Google, we receive your name and email. We use Google data only to provide those features, never for ads, and never to train AI models. PULSO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and storage
We use cookies to keep you signed in. Our analytics (PostHog) stores an identifier in your browser to count visits and link errors to sessions. We do not record your screen.
Children
PULSO is not for children under 14. If you are under 18, your coaches do not set weight-loss goals for you.
Security
Data travels encrypted, and only you can read your own records. Tokens for connected apps are kept on the server and never reach your browser.
Changes
If we change this policy in a way that matters, we tell you in the app before it applies.