PulsePom Privacy Policy

Your data, your focus

Last Updated: 9 November 2026

This Privacy Policy explains what information PulsePom ("we," "us," or "our") collects, how we use it, who we share it with, and the choices you have. It applies to the PulsePom web app at pulsepom.io and pulsepom.app, and to the PulsePom app for Windows and Android, including its Block section (together, the "Service") for the Android App.

The short version

You can use the Timer, Stats and Planner without an account. What you save then stays on your device and is not sent to us, until you sign in, when it moves into your account.
With an account, your profile, study history, planner and group activity are stored on servers we run.
The Android app's blocking features work on your phone. What they see about how you use it (which apps you open, what is on screen, the websites you visit, your notifications, your location for triggers) stays on your phone and is never sent to us.
A few features send specific information to specialist providers: PulsePom AI, payments, YouTube University and crash reports. Section 6 lists every provider and what it receives.
What you share in a group can be seen by that group's members.
We show no ads, use no advertising trackers and never sell your information.
You can delete your account in the app at any time.

1) Who we are

PulsePom is operated by NOBEL, who is responsible for your information under this policy.
Contact: pulsepom@gmail.com

2) Information you give us

Without an account: if you choose "Continue without an account", your subjects, sessions, planner, habits and settings are kept only in your browser's or the app's storage on your device and are not sent to us. When you sign in, they are moved into your account and this policy applies to them as account data. Clearing the browser's or app's data deletes them.
Account: your email address and password. Your password is stored only as a secure hash by our sign-in system, and we never see it. If you sign in with Google or Microsoft, we receive your email address and an account identifier from them.
Profile: your username (usernames are unique, so other users can check whether a name is taken), profile photo, status message, Studicon, study goal, and your timer and app settings.
Study history: your subjects (names and colours), your focus and break sessions (the subject, how long each lasted and when it ended), days off, streaks, totals and achievements.
Planner: tasks, lists, calendar items and habits, your habit check-ins, and the daily mood and motivation ratings you can record in the Habit Tracker.
Groups: the groups you create or join and what you post in them (messages, replies, reactions, polls, pinned and scheduled messages, files and images), messages you report, and wake-up nudges you send.
PulsePom AI: the questions you ask, any photos you attach, the answers, and any feedback you give on them. Chats are saved so you can reopen them.
Premium: if you subscribe, your subscription status, plan, renewal and expiry dates, and the order and subscription identifiers our payment provider gives us. If you buy in the Android app, Google Play gives us the purchase's token, order number, product, and its renewal, expiry and refund status, and we give Google your PulsePom account ID with the purchase so it is linked to your account. We never receive your full card details.
First-time tour: which steps of the welcome tour you have completed or skipped.
Messages to us: what you send when you email us.

3) Information collected automatically

Country: the first time you sign in, our server looks up & save your country name from your IP address on the database for the analytics purpose and We don't collect your precise location on the webapp/app.
Activity status: whether you are studying right now and when you were last active, so your groups can see who is focusing.
Analytics: we run our own copy of Umami, a privacy-focused analytics tool, on pulsepom.io (including inside the Android app). It records which pages are viewed, the referring site, browser, operating system, device type, language and country. It doesn't use cookies, doesn't store your IP address and isn't linked to your account, and we remove sign-in links and account IDs from page addresses before they are recorded.
Server logs: our servers record technical details of each request, such as IP address, browser and time, to keep the Service secure and working. These logs are kept for a limited time.
Push notifications: if you allow them in your browser, we save the push subscription (an address and keys from your browser's push service) so we can send you timer alerts, group messages and wake-up nudges. In the Android app, we save a token from Firebase Cloud Messaging instead, so we can send you group messages and wake-up nudges. It is deleted when you sign out.
On your device: the web app keeps your sign-in session, preferences and a copy of recent data in your browser's storage and offline cache, so it opens quickly and works offline. This stays on your device.

4) The PulsePom app for Android

Sections 2 and 3 apply to the PulsePom android app too. It also adds what only a phone app can do: a timer notification with alarms, and a Block section that blocks distracting apps and websites. The Block section has no account of its own. Its settings and everything it learns stay on your phone, except where section 6 says otherwise. After you sign in, the app asks for Usage Access, Display over other apps and notifications, which it needs to block apps during focus, look after your timer and notify you; if you would rather not allow them, you can sign out. The other features are optional, and each asks for the permission it needs when you turn it on.

A) What the Block section processes on your phone

App usage (Usage Access): which apps you used and for how long, to show your screen time and scroll time, enforce usage and scroll limits, and decide when to block. With the Accessibility Service off, it is also how the app sees which app is open while a timer is running, so that it can block apps you haven't allowed and notice Android's uninstall dialog. Your screen time and scroll time appear on PulsePom's Timer in the app, but they are not sent to our servers.
Screen content (Accessibility Service): PulsePom uses Android's Accessibility Service for its core job: knowing which app or website is in front of you so it can block it. With this permission it reads which app is open, the address in your browser's address bar, whether a short-video feed (such as YouTube Shorts, Instagram Reels, TikTok or Facebook Reels) is on screen, and how much you scroll. It also closes split-screen and floating windows when you ask it to and, while a timer is running, notices Android's dialog for uninstalling PulsePom so that you can stop the timer first. This information is used the moment it is read and is not stored or sent anywhere, apart from the YouTube details described below. PulsePom does not use the Accessibility Service to read what you type, your passwords or the content of your messages.
Notifications (notification access): if you block notifications, PulsePom reads notifications as they arrive in order to silence the ones you chose. The app name, title and text of silenced notifications are kept on your phone so you can review them later. They are never uploaded.
YouTube University: to check whether a YouTube video is educational, PulsePom reads the title and channel name of the video playing in the YouTube app from YouTube's playback controls (this needs notification access). It also reads the titles, channel names and lengths on YouTube's video cards, to stop previews of other videos and, if you choose, blur their thumbnails. For a YouTube video opened in your browser, it reads the video's address. It then asks YouTube which category each video is filed under (section 6). What it learns about the videos and channels it checked is kept on your phone, so each is looked up only once. It also keeps a short log of its decisions, which never includes titles or channel names and whose entries are deleted after three days. Neither leaves your phone.
Location and Wi-Fi triggers (optional): the places you choose are stored on your phone, and Android tells the app when you arrive at or leave them, including in the background. Wi-Fi triggers read the name of the Wi-Fi network you're connected to. Neither your location nor your Wi-Fi network names are sent to us.
Installed apps: the apps on your phone that you can open, so you can choose which to block, and your home screen and keyboard apps, so they are never blocked.
Everything you set up: blocklists, blocked websites, exceptions, schedules, templates, Study Mode and Strict Mode settings, and your block history and reports.

B) Permissions and why the app asks for them

Accessibility Service: to detect the app, website or short-video feed on screen and block it.
Usage Access (asked for after you sign in): to see which app is open during a session, measure screen time and enforce usage limits.
Display over other apps (asked for after you sign in): to show the block screen over a blocked app, and to let your timer open by itself at the 7-hour limit and before an uninstall.
Notification access: to silence notifications from apps you block, and for YouTube University.
Location, including background location: only for the optional location triggers.
Nearby Wi-Fi devices and Wi-Fi state: for the optional Wi-Fi triggers.
Notifications (asked for after you sign in), alarms, run at startup and battery optimisation: for the timer notification and alarms, and to keep schedules and blocking running after a restart.

PulsePom doesn't use your camera or microphone. To attach a photo or file, you choose it yourself with your device's file picker.

5) How we use your information

To provide the Service: timers, stats, planner, groups, chat, PulsePom AI, blocking and Premium features
To sign you in and keep your account secure
To save your settings and keep your data in step across your devices
To show your statistics, streaks and leaderboards, and your activity to your groups
To send the notifications you asked for
To answer your questions in PulsePom AI
To process Premium purchases and check their status with our payment providers
To check uploads for malware and explicit content, and to prevent abuse, fraud and unauthorised access
To fix problems and improve reliability, using crash reports and aggregate analytics
To reply when you contact us, and to tell you about important changes

We don't use your information for advertising, and we don't build advertising profiles.

6) Who we share it with

We do not sell or rent your information, and we don't share it with advertisers or data brokers. It is shared only as follows.

A) Other PulsePom users

Your public profile can be seen by other signed-in users, for example in groups, rankings and member lists: your username, profile photo, Studicon, country, status message, study totals and streak, when you were last active, and whether you're studying right now.
In each group you join, members can see your messages, files and images, reactions and polls, which messages you have read, and your study sessions in the group's stats and leaderboard (how long, when, and the subject's name), including your attendance. Group leaders can manage the group and its members, and members can send you wake-up nudges.
Files and images you upload are stored at a web address that anyone with the link can open.

B) Service providers

Each of these receives only what is described here, and handles it under its own privacy policy.

Hosting and Cloud Infrastructure Providers: hosts the servers we run, which hold our database and sign-in system, the web app and our file scanner. The account data in section 2 is stored there.
Content Delivery Networks (CDNs) and Security Services: stores the files and images you upload, including photos you send to PulsePom AI, delivers them from cdn.pulsepom.io, and passes uploads to our scanner.
AI Technology Providers: runs the AI model behind PulsePom AI. When you ask a question, it receives your message, the earlier messages in that chat, any photos you attach, and the PulsePom data needed to answer: your study sessions, subjects, tasks, lists, habits, and mood and motivation ratings.
Lemon Squeezy: our payment provider on the web, which sells Premium as the merchant of record. At checkout it receives your email address and account ID, and it handles your payment details itself.
Google Play: processes Premium bought in the Android app and handles your payment details itself. It receives your PulsePom account ID with each purchase, and our server asks it for the purchase's status. If you leave a review from the app, your rating and comment go straight to Google Play under its terms, and we see them only as reviews on the listing.
IP Geolocation Services: receives your IP address from our server to look up your country (section 3).
Google: signing in with Google (your Google account details during sign-in), and the web app's fonts (Google Fonts, which receives your IP address). In the Android app, it also shows the map and looks up place names when you set up a location trigger (the map area you view and the place you pick), and provides YouTube API Services for YouTube University (below).
Microsoft: signing in with Microsoft (your Microsoft account details during sign-in).
Sentry: crash reports from the Android app (section 7).
Push Notification Services run by your browser or operating system, these deliver the push notifications you allowed. In the Android app this is Google's Firebase Cloud Messaging, which receives the token and the text of each notification, such as the group's name, the sender's name and a preview of the message.
Avatar Generation Services draws default profile pictures. It receives the picture's seed, which for the default picture made when you sign up comes from the part of your email address before the @, and your IP address.
Public Content Networks and Asset Libraries serve some code libraries, fonts, and sounds. Like any web request, they receive your IP address and browser details.

C) YouTube University and YouTube API Services

YouTube University uses YouTube API Services to find out how YouTube categorises a video. It sends YouTube the video's title and channel name as the YouTube app shows them, or the video's ID for a video opened in your browser, and your phone's language. Like any web request, YouTube also receives your IP address. PulsePom doesn't sign in to YouTube and doesn't use your YouTube or Google account for this. By using YouTube University, you agree to be bound by the YouTube Terms of Service, and Google handles what it receives under the Google Privacy Policy. Turning YouTube University off stops the lookups. What it kept on your phone is removed when you clear the app's data or uninstall it.

D) Legal reasons and business transfers

We may disclose information if we must do so to comply with the law, a court order or a lawful request; to protect the rights, safety and security of our users, PulsePom or the public; or to investigate fraud, abuse or violations of our Terms. If PulsePom is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it, under this policy.

7) Upload checks and crash reports

Upload checks. Files and images you upload (in group chat, as a profile photo & group avatar) are checked automatically before they are stored: Files for Virus, Malware, Phishing, NSFW and other dangerous content, and Images for NSFW, PII, Self-harm, Threat, Weapons, Injury, Exam-Cheating. The checks use automated tools, including an AI image classifier, running on our own servers and on Cloudflare. A file that fails is refused and not stored. Repeatedly uploading explicit images can lead to your account being suspended (see our Terms)

Crash reports. If the Android app crashes or runs into an error, a technical report is sent to Sentry automatically. It says what went wrong and where in the app's code, and includes the app version, your phone's model and Android version, and technical events from shortly before the crash, such as which screen was open. It contains no account details, and we set Sentry not to record your IP address. Crash reports are used only to fix problems and are kept for no more than 90 days.

8) Legal bases (where applicable)

Contract: to provide the Service you signed up for, including your account, sync, groups, PulsePom AI and Premium.
Legitimate interests: to keep the Service secure and working, check uploads, prevent abuse, and improve the Service with crash reports and aggregate analytics.
Consent: for optional features that need your permission, such as push notifications and the Android app's permissions, and for your mood and motivation ratings. You can withdraw consent at any time by turning the feature off, deleting the data or revoking the permission.
Legal obligation: when the law requires it.

9) How long we keep information

Your account and its data: until you delete your account.
After you delete your account: it is kept for 7 days, in case you change your mind. Then it is deleted permanently: your profile, name, photo and status; every session, subject, streak and statistic; your planner tasks, lists, habits and days off; your group messages and memberships; groups you lead with fewer than 10 members, with their chat and challenges; and your PulsePom AI chats and photos. If you lead a group with 10 or more members, you'll be asked to hand it over first.
PulsePom AI chats: until you delete them or your account.
Uploaded files and images: deleted together with the message, chat or account they belong to.
Server logs and backups: kept for a limited time for security and recovery, then deleted or overwritten.
Crash reports: up to 90 days.
Data on your phone: until you delete it in the app, clear the app's data or uninstall the app. YouTube University's decision log is the exception: its entries are deleted after three days.
Payment records: we keep the record of your Google Play purchases while your account exists. Lemon Squeezy and Google Play keep their own records of your purchases, as the law requires.

10) Your choices and rights

A) In the app

You can edit your profile; edit or delete your sessions, subjects, tasks, habits and mood entries; delete your messages and PulsePom AI chats; and leave groups. You can turn off push notifications in your browser's settings. In the Android app, you can turn any blocking feature off and revoke its permission in Android's settings at any time.

B) Deleting your account

Open Profile & Settings and tap Delete Account. You have 7 days to sign in and recover the account before it is deleted permanently (section 9). If you can't sign in, follow the steps on our account deletion page or email pulsepom@gmail.com from the address on your account. Data the Android app keeps on your phone isn't affected: to remove it, clear the app's data or uninstall the app.

C) Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to receive a copy of it, to object to or restrict how we use it, and to withdraw your consent. To use these rights, email pulsepom@gmail.com. We'll reply quickly as much as possible. You may also complain to your local data protection authority.

11) Security

All communication between your device and our servers is encrypted with HTTPS. We use database level security, so each account can reach only the data it is allowed to see. Uploads are checked before they are stored, and sign-in tokens are kept in your browser's storage or in the Android app's private storage. No system is completely secure, so we can't guarantee absolute security, but we work to protect your information and keep what we collect to a minimum.

12) Children

PulsePom is not intended for children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we'll delete it.

13) International transfers

Our servers and service providers may be located outside your country, so your information may be processed in other countries. We take steps intended to make sure it stays protected as described in this policy.

14) No ads, no selling

PulsePom shows no ads. We don't use advertising IDs, advertising cookies or cross-site tracking, and we never sell or rent your information.

15) Governing law & jurisdiction

This Privacy Policy and any disputes related to your personal data or privacy are governed by the laws of The People's Republic of Bangladesh. Any legal action or proceeding relating to this Policy shall be brought exclusively in the courts located in Noakhali, Bangladesh.

16) Changes to this Privacy Policy

We may update this policy from time to time and will change the "Last Updated" date when we do. Continuing to use the Service after a change means you accept the updated policy.

17) Contact us

For questions or requests about privacy, contact:
Email: pulsepom@gmail.com