Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains how PULSE ("we", "us"), operated by Zachary Alexander, collects and uses personal data. PULSE is an independent service and is not affiliated with Whatnot, Inc.

1. Data we collect

• Account data — the email address you provide at signup, and, if you set one, a password. Your password is stored only as a salted, memory-hard scrypt hash — never in readable form — and is used to sign you in.
• Sign-in security — when you sign in with a password from a device we don't recognize, we email you a one-time 6-digit code (stored only as a hash) to confirm it's you. If you choose to trust that device we keep a device-trust record — a hashed token, plus a salted hash of your IP address and your browser/device user-agent — so you don't need a code on that device again. These are deleted when you delete your account.
• Billing data — payments are processed by Stripe. We do not receive or store your full card number. We retain a Stripe customer ID, a subscription ID, and an opaque card fingerprint (a token Stripe derives from the card; never the card number, expiry, or CVC) which we use to prevent free-trial abuse.
• Approximate IP address — we store a salted, irreversible hash of your IP address (never the raw IP in our database — see the access-log note under Usage/diagnostics) — at signup, when you sign in, and on other abuse-relevant actions — to enforce per-network limits and detect abuse.
• Support chat — if you use the in-app support assistant, the messages you send are processed and may be logged to operate and improve support and to prevent abuse.
• Lead form — if you submit our no-signup interest form, we store the email address and (optional) Whatnot handle you enter, together with a salted, irreversible hash of your IP address, to follow up on your request and prevent abuse.
• Mobile app data — if you use the PULSE mobile app: an anonymous per-device identifier (a random identifier the app generates on first launch and keeps in the device keychain) that is sent with every request and is how your saved settings are stored while you are signed out; the Whatnot seller handle you claim and anything you save against it (watchlist and follows, goals, the categories you mark as your lanes); seller searches you type in the app; a push notification token, if you enable notifications (retained until the device unregisters or our push provider reports the token invalid), and the time zone you are in, so alerts respect your quiet hours; and in-app purchase entitlement data from our subscription provider. The app signs in with email and password (with the emailed-code step above for new devices); it does not use third-party or social sign-in. There is no advertising identifier and no cross-app or cross-site tracking of any kind.
• Crash reports — when the mobile app hits an error it sends us the error message, the technical stack trace, the app version and the platform, so we can fix it. These go only to our own servers — there is no third-party crash-reporting or analytics SDK in the app — and the device identifier is stored with them only as a salted, irreversible hash. Retained for 30 days.
• Usage/diagnostics — standard request metadata (e.g. timestamps, rate-limit counters, and the browser/device user-agent string associated with each sign-in session) used to keep the Service available and secure. Our web servers keep a short-lived access log of requests for security and troubleshooting. Our application's own log records a salted hash of the IP address rather than the address itself; the web server in front of it, like almost every web server, records the requesting IP. Both drop query strings, so tokens and email addresses do not reach them.
• Record of emails we send you — we keep a log of the transactional emails we send (recipient address, subject, kind, time and whether it was delivered) so we can answer "did my receipt go out?". We do not store the message body, and one-time sign-in codes are never recorded. Retained for up to 12 months, and deleted with your account.

2. Cookies and data stored in your browser

PULSE sets four first-party cookies. There are no third-party cookies, no advertising cookies, and no cross-site trackers:

• pulse_session — a session cookie (HttpOnly) that keeps you signed in to the dashboard after you log in. Lifetime: 30 days.
• pulse_did — a random per-device identifier we use in our own first-party analytics to count distinct visitors and conversions. Lifetime: 1 year. On our servers this identifier is kept only as a salted, irreversible hash — never in raw form — and it is not shared with any third-party advertising or analytics network.
• pulse_src — remembers the source that first brought you to the site (first-touch attribution), so we know which channels work. Lifetime: 30 days.
• pulse_td — set only if you choose "trust this device" when signing in, so we don't email you a 6-digit code every time. It holds an opaque token; on our servers only its hash is kept, alongside the device-trust record described in section 1. Deleted when you delete your account, and you can drop it by clearing your cookies.

PULSE also uses your browser's localStorage to remember functional preferences on your device. These stay in your browser; they are not sent to us and are not shared with anyone:

• pulse_key — your API key, if you have entered one for programmatic access, so you don't have to re-enter it. You set it yourself in the account panel; we never put it there from a link. It never leaves your browser except as the credential on your own API requests.
• pulse_theme — your light/dark theme preference.
• pulse_my_handle, pulse_my_lane, pulse_my_category — the Whatnot handle and category you tell the dashboard are yours, so it opens on your numbers.
• pulse_follows, pulse_compare_set — the sellers you follow or line up side by side on this browser.
• pulse_view, pulse_view_last, pulse_taxonomy_v, pulse_trialbanner_dismissed — which view you had open, a cached copy of the public category list, and whether you dismissed the trial banner.

Clearing your browser's cookies and site storage removes all of the above.

3. How we use data

• to provide and maintain the Service and your account;
• to process payments and send billing-related notices (trial-ending, receipts, failed-payment) via Stripe and email;
• to prevent fraud and abuse (duplicate trials, signup floods, card reuse);
• to respond to support requests.

We do not sell your personal data.

4. Service providers

We share the minimum necessary data with providers that operate the Service, including Stripe (payments), Apple (purchases made inside the iOS app are sold and processed by Apple), Expo (push notification delivery for the mobile app, which in turn hands the message to Apple's push service), RevenueCat (in-app subscription management — it receives your device identifier and, once you sign in, your email address as the account key), Resend (email delivery), Hetzner (hosting) and Cloudflare (CDN and DNS). They process data on our behalf under their own terms.

We also use an internal operations alerting channel (a chat webhook) that notifies us of events we must act on — a new support ticket, a failed payment, a delivery failure. Those notifications can contain your email address and the text of a support message you sent us, so that we can answer you. Nothing from the market data or your saved settings is sent there, and it is not used for analytics or advertising.

Where your data is processed. Our servers are located in Germany. If you are in the United States, your data is transferred to and processed in the EU; if you are in the EEA or UK, it stays there.

5. Data retention

Account and billing records are retained for as long as your account is active and as required for legal, tax, and accounting purposes. Raw market-data snapshots that power our analytics are retained for approximately 14 days and then compacted into anonymous aggregates; this market data is keyed to public shows and sellers, not to you. Other horizons we enforce automatically: support tickets are deleted 180 days after they are closed; interest-form leads and the record of emails we sent you, 12 months; first-party analytics (pageviews and funnel events), 90 days; mobile crash reports, 30 days. Support-chat logs are retained only as long as needed to operate and improve support and are then deleted or anonymized.

Free-trial fraud prevention. When a free trial is used we keep a non-reversible record that a trial was consumed — a salted, irreversible hash of the email address and the opaque card fingerprint Stripe derives (never the card number). This record is kept after an account is deleted, with the link to your account removed, so that deleting and re-creating an account cannot be used to take repeated free trials. It contains nothing readable and cannot be used to identify or contact you.

6. Your rights and deletion

You may request access to, correction of, or deletion of your personal data. You can delete your account (and the personal data associated with it) from within the Service, or by emailing us at [email protected]. Deletion removes your account and its personal data, including your password, sign-in sessions and trusted-device records. The one exception is the non-reversible free-trial-prevention record described in section 5, which is retained without any link to your identity. Deleting your account does not automatically cancel an active subscription — cancel via the Stripe billing portal to stop future charges. Depending on where you live (e.g. the EEA/UK), you may have additional rights under the GDPR or similar laws; contact us to exercise them.

7. Security

Passwords are stored only as salted, memory-hard scrypt hashes; API keys, session and device-trust tokens, and one-time sign-in codes are stored only as one-way hashes — never in readable form. The raw API key is shown once at creation and delivered to you by email. Payment details stay with Stripe, IP addresses are stored in our database only in salted, irreversibly hashed form, and transport is encrypted (HTTPS). No method of storage or transmission is perfectly secure, but we take reasonable measures to protect your data.

8. Children

The Service is intended for businesses and adults; it is not directed to children and we do not knowingly collect data from them.

9. Changes

We may update this Policy; the "Last updated" date above reflects the latest version.

10. Contact

Zachary Alexander · [email protected] · 2232 Dell Range Blvd, Suite 303 #1595, Cheyenne, WY 82009, United States