Privacy Policy

1. Who we are

Truth or Pulse ("we", "us") makes the Truth or Pulse iPhone app (the "App"). This policy explains what we collect when you use the App and this website, why, who can see it, how long we keep it, and what you can do about it.

Questions go to privacy@truthorpulse.com.

2. What we collect

Your account

• Phone number. Used to sign you in with a text-message code and, if you allow it, to let friends who have your number find you.
• Date of birth. Used to check that you are old enough to use the App and, for Featured Pulses, that you are 18 or older. Only you can see it.
• Display name, @username, profile photo and bio. These make up your profile.

Pulses

• The questions you write and send.
• The video you record when you answer, and a thumbnail image from it.
• Your heart-rate readings during the recording, with the time each question appeared. See section 3.
• Reactions, whether you archived or pinned a Pulse, and the status of any request to save or share it.

Your contacts, if you allow it

If you give the App access to your contacts, it reads the phone numbers in your address book, turns each one into a fixed-length code on your phone (a SHA-256 hash), and uploads those codes so we can tell you which of your contacts already use Truth or Pulse. Contact names never leave your phone.

Be aware that a hash is not encryption. Phone numbers are predictable enough that a hash could be matched back to the original number by someone with enough computing power. We store the codes against your account until you delete it, and they may include the numbers of people who have never used the App. If you want them removed sooner, email us.

Featured Pulses, if you submit one

If you choose to submit a Pulse to be featured on our social media accounts, we store the video you submitted (with its heart-rate overlay) and, if you enter one, your social media handle. See section 5.

Device and technical information

• Push notification tokens, so we can send you notifications, and Live Activity tokens, so a Pulse you sent can update on your Lock Screen.
• Crash reports: what went wrong, your device model, iOS version and App version, linked to your account ID.

How you use the App

We record a small set of events linked to your account ID: which screens you open, signing up, logging in and out, sending, opening, answering and watching a Pulse (with that Pulse's ID), sending and accepting friend requests, how many contacts you imported and how many matched, sharing or saving a video, and the steps of submitting a Featured Pulse. We use this to understand which parts of the App work and which don't. These events never contain your heart rate or anything worked out from it.

What we don't collect

• Your email address (unless you email us).
• Your location.
• Your advertising identifier. We don't ask to track you, and we don't track you across other companies' apps or websites.
• The names in your contacts.

3. Heart rate

Heart rate is the point of the game, so we want to be exact about it.

• Where it comes from. With your permission, the App reads heart rate from Apple Health while you record an answer. To get a reading every few seconds from your Apple Watch or AirPods, the App starts a short workout session when you record and discards it afterwards, so it isn't saved to your workout history. Your device may still store the heart-rate readings in Apple Health, as it normally does.
• What we store. The readings from the recording (each one's value and time), your highest reading, and whether no heart rate came through at all ("flatline"). These are kept with the Pulse.
• Who sees it. The person who sent you the Pulse, live while you record and afterwards. Section 4 lists everywhere it can appear.
• What we work out from it. The App labels a recording from the heart-rate pattern alone, with verdicts like "nervous" or "ice cold". These are a joke. They are not a lie detector and not a medical reading.
• What we never do. Sell it, use it for advertising, send it to analytics, use it for any medical or research purpose, or use it to decide anything about you.

You can answer without heart rate by denying the Health permission. The Pulse is then recorded as a "flatline". Full details, including your rights over this data, are in our Consumer Health Data Privacy Policy.

4. Who can see what

If someone saves or shares a copy of a Pulse outside the App, we can't take it back from their phone or from other apps. Revoking permission only stops new copies.

5. Featured Pulses

If you are 18 or older, you can choose to submit a Pulse you answered to be posted on the official Truth or Pulse accounts on TikTok, Instagram and YouTube, and used in our own marketing. Nothing is submitted unless you do it yourself, one Pulse at a time, and tick the box agreeing to it.

• A posted Pulse shows your face, your voice and your heart rate. We don't name the person who sent the questions.
• We might not post it. You aren't paid for it.
• You can withdraw a submission in the App. If it has already been posted, we'll take our post down, but we can't recall copies other people have already saved or reposted.
• We keep the video you submitted until you delete your account, because it is the record of what you agreed to. You can email us to have it deleted sooner once it's no longer posted.
• If you delete your account while one of your Pulses is posted, we keep a note that the post has to come down, and we delete the note once it has.

6. How we use your information

• To run the game: sign you in, deliver Pulses, show heart rate, send notifications.
• To help you find and add friends.
• To keep the App safe: enforce age limits, blocks and our Terms, and respond to reports.
• To fix crashes and improve the App, using the crash reports and usage events above.
• To post Featured Pulses you have submitted.
• To reply when you contact us.

If you're in the European Economic Area or the UK, the legal bases we rely on are: running the service you asked for (your account, Pulses, friends, notifications); your consent (heart rate, contacts, Featured Pulses, notifications, all of which you can withdraw); and our legitimate interest in keeping the App working and safe (crash reports, usage events, security).

7. Companies that process data for us

We don't sell your personal information, and we don't share it with advertisers or data brokers. We use these companies to run the App. They process data on our behalf, not for their own purposes:

• Google (Firebase and Google Cloud): sign-in, database, video and photo storage, server code, push notifications, crash reports (Crashlytics) and usage events (Google Analytics for Firebase). Data is stored in the United States. Firebase privacy information.
• Apple: delivers push notifications and Live Activity updates. Live Activity updates pass through Apple's servers on the way to the sender's phone and include the responder's live heart rate. Apple Health and HealthKit stay on your device.
• TikTok, Instagram and YouTube: only for Featured Pulses you submitted and we posted. Once posted, those platforms' own policies apply to the post.

We may also disclose information if the law requires it, or where it's needed to protect someone's safety.

8. How long we keep it

• Account and profile: until you delete your account.
• Pulses, including video and heart rate: until either person deletes that Pulse, or either person deletes their account.
• Contact codes: until you delete your account.
• Push tokens: until you sign out.
• Featured Pulse submissions: see section 5.
• Usage events: kept by Google for no more than 14 months.
• Crash reports: kept by Google for 90 days.
• Server logs: our servers log activity to diagnose problems, which can include account IDs, usernames and heart-rate values. These are deleted automatically after 30 days.

9. Deleting your account

In the App, go to Settings (the gear icon) → Danger Zone → Delete Account, type DELETE and confirm. Deletion happens straight away and can't be undone.

What gets deleted

• Your profile, phone number, date of birth, username, photo, friends list, blocked list, notifications and contact codes.
• Every Pulse you were part of, for both people. That includes Pulses you sent and the videos your friends recorded to answer them, so they lose those too.
• Friend requests, share links you made, and Featured Pulse submissions.

What remains

• Copies someone saved or shared with permission before you deleted your account.
• If another user blocked you, their block list keeps your username and photo link.
• If your number is in another user's contacts and they synced them, their contact code for your number stays with their account.
• Usage events, crash reports and server logs, until they expire as described in section 8.
• A note that a Featured Pulse must be taken down, if one was posted (section 5).

10. Your choices and rights

• Heart rate: turn it off any time in iPhone Settings → Privacy & Security → Health → Truth or Pulse.
• Contacts: turn off access in iPhone Settings → Privacy & Security → Contacts. This stops new uploads. Email us to delete the codes already uploaded.
• Notifications: in the App's Settings or in iPhone Settings.
• Who can find you and send you Pulses: in the App under Settings → Privacy.
• Blocking: blocking someone removes them as a friend and stops them sending you Pulses.

Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it by emailing privacy@truthorpulse.com. We'll reply within 30 days, and we may need to confirm the request comes from the phone number on the account.

Depending on where you live, the law gives you further rights, for example under the GDPR (EEA and UK), Canadian privacy law, or the laws of California, Washington and other US states. These include the right to object to or restrict processing, to data portability, to withdraw consent, and to complain to your local data protection authority. We don't sell or "share" personal information for targeted advertising, as California law defines those terms. We won't treat you differently for using any of these rights.

11. Age limits

Truth or Pulse is for people 16 and older, and Featured Pulses is for people 18 and older. If we learn that someone under 16 has an account, we'll delete it. If you think a child is using the App, tell us at privacy@truthorpulse.com.

12. Security

Data is encrypted in transit, and our database rules limit each piece of data to the people it belongs to, as described in section 4. Video files can only be reached by signed-in users who have that file's address. No system is perfectly secure, and we can't promise yours will never be exposed. If a breach affects you, we'll tell you as the law requires.

13. Where your data is stored

Our servers are in the United States. If you use the App from somewhere else, your information is transferred to and stored in the US, where privacy laws may differ from those where you live.

14. Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, for example collecting a new kind of data or sharing it with someone new, we'll tell you in the App before it takes effect, and ask for your consent again where the law requires it.

15. Contact us

Privacy questions and requests: privacy@truthorpulse.com
Everything else: support@truthorpulse.com