Privacy Policy

1. Who we are

Pulsu (pulsu.app) is provided by Giffi OÜ (registry code 12483222), Erna põik 12, Suurupi 76907 Harjumaa, Eesti, Estonia. Contact: pulsuapp@gmail.com.

2. Your health data stays on your device

Your blood pressure readings, notes, tags, name and settings are stored only in the browser on your own device. We never receive them. They are not sent to our servers, nor to any analytics or advertising service.

You alone decide whether to share a report (PDF, spreadsheet or link) with your doctor. In a shared link the readings are in the part after the "#" sign, which browsers never send to any server.

3. Analytics and advertising (only with your consent)

If you allow it in the cookie banner, we use Google Analytics 4 (through Google Tag Manager) to count visits and actions in the app, for example "reading added" or "report shared" — never the readings themselves, tags, notes or your name.

If you also allow marketing cookies, Google and Meta (Facebook, Instagram) may use this to show Pulsu ads to people who have visited the site (remarketing).

The doctor's report page never loads these services. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time via "Cookie settings".

4. Who processes data

Hosting: Netlify, which keeps technical server logs (such as IP address) for security for a short time.

Only with your consent: Google (Analytics, Tag Manager, Ads) and Meta Platforms Ireland (Pixel). This may involve transfer to the USA under the EU–US Data Privacy Framework.

Only if you connect it yourself (Settings → Your data): Google Sheets backup. Your readings, tags, notes, name and reminder settings are then copied to a spreadsheet in your own Google account, which only you and Pulsu (limited to this one file) can access. Google processes this data under your Google account terms. We do not receive it. So that the backup works without signing in again, Google gives a permission key that is kept on your device; our server function exchanges it with Google for a short-lived access key. The function does not see your readings and stores nothing. You can disconnect at any time and delete the spreadsheet in Google Drive.

The "Buy me a coffee" button opens buymeacoffee.com, which has its own privacy policy. We do not sell personal data.

5. How long we keep data

We do not store your health data at all. Analytics data is kept according to the Google Analytics settings (up to 14 months). Your cookie choice is kept for 180 days.

6. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can delete your readings yourself in Settings → Your data.

For anything else, write to pulsuapp@gmail.com. You can also complain to the Estonian Data Protection Inspectorate (www.aki.ee).

7. Changes

We may update this policy. The current version is always on this page.