Legal

Privacy policy

This policy explains what personal data Pulz8 handles when you use the website at pulz8.com, the web app at app.pulz8.com and the Pulz8 API behind it. It is written for gym owners, coaches, individual athletes, and the athletes whose heart rate is shown on a gym's board. Pulz8 was previously called Heartstream.

Who we are

Pulz8 is run by JurikTech s.r.o, Company ID (IČO) 56723326, Slovakia ("we", "us"). For data about your own account we are the data controller. Contact us about anything in this policy at [email protected].

Gyms, teams and their athletes

When a gym, studio or team (a "team account") adds athletes to Pulz8, the team decides whose data is entered and why. For that athlete data the team is the controller and we process it on the team's behalf, under the data processing terms in our Terms of service. If you train at a gym that uses Pulz8, ask the gym first about your data. We will help the gym answer you, and you can always contact us directly.

What we collect

Your account

Email address and, if you set one, a password. We store only an argon2id hash of the password, never the password itself.
Account type: a personal account ("Just me") or a team account.
For team accounts, the organization name and the address (slug) you choose.
Your role in the organization (owner or admin) and when the account was created and changed.

If you choose Continue with Google, Google sends us a signed ID token for the basic sign-in scopes (openid, email, profile). From it we read your Google account ID, email address, whether Google has verified that email, and your name. We store the Google account ID and email address to recognise you next time and to link the sign-in to an existing account with the same verified email. We do not receive your Google password, and we do not access your contacts, calendar, files, Gmail or any other Google data. See Google user data for the commitments that apply to it.

Athlete profiles

Each athlete on Pulz8 has a profile. On a personal account it is your own profile, created when you fill in About you. On a team account the team creates one per athlete. A profile holds:

name and email address,
date of birth, used to estimate maximum heart rate,
optionally gender and weight,
maximum and resting heart rate, and whether zones are based on maximum heart rate or heart-rate reserve.

Heart-rate sensors

When you pair a Bluetooth heart-rate strap, armband or watch, your browser gives the app an identifier for that device. We store that identifier and the athlete it is assigned to, so the sensor shows the right athlete next time. We do not collect the device's MAC address.

Live heart rate and recorded sessions

The live board reads heart rate directly from the sensors in your browser over Web Bluetooth. Live readings stay in your browser and are not sent to us unless a session is recorded.

When you press Start session and then End session, the app uploads one record per athlete: start and end time, an optional label, the sensor and athlete it belongs to, every heart-rate reading with its timestamp, and the figures we compute from them (duration, average and peak heart rate, time in each zone, and efforts and recovery times).

Health data

Heart rate, weight and the figures derived from them are data concerning health, a special category of personal data under the GDPR. We use them only to show live zones and session history to the account they belong to. We never use them for advertising or profiling, and we do not sell them or share them with anyone except the service providers listed below.

Data stored only in your browser

The app keeps a few preferences in your browser's local storage: theme, language, whether the sidebar is collapsed, whether you dismissed the install banner, whether session reminders are on, and your progress through the Getting started checklist. They never leave your device. Session reminders are shown locally by your browser; we run no push-notification server.

Cookies

The app sets two cookies when you sign in, both strictly necessary for staying signed in: access_token (valid for 60 minutes) and refresh_token (valid for 7 days). Both are httpOnly, so page scripts cannot read them, and are only sent over HTTPS. The app uses no advertising or analytics cookies.

The website

The English home page uses Google Analytics (Google Ireland Limited) to count visits and see which pages people use. It loads only if you choose Accept in the cookie notice; until then no analytics cookies are set. Google Analytics then sets the _ga and _ga_<id> cookies and processes your IP address, browser and device details, and the pages you view. Your choice is kept in your browser's local storage. To change it, use Cookie settings in the footer of the English home page; declining removes the analytics cookies. The Slovak and Czech pages, the blog and these legal pages do not load it.
The device check on the home page connects to a sensor in your browser to confirm it works. It sends nothing to us or anyone else.
If you book a demo, the booking form is run by Google Calendar, and we receive the name, email address and any notes you enter.
If you leave your email for Pulz8 news, we store the address, the page language, which form it came from and the time, and email it to ourselves through Resend so we see it. We use it only to write to you about Pulz8, at most a few times a year. Reply to any of those emails, or email us, and we delete it.

Email and support

If you ask for a password reset, we email you a single-use link through Resend. We store only a hash of the link's token, and it expires after 60 minutes. If you email us, we keep the conversation to answer you.

Connection diagnostics

When a session is saved, the app also sends how each sensor's Bluetooth connection behaved during it: the name the sensor broadcasts, how many readings arrived, how often and for how long the connection dropped, the browser's error messages, the times of these events, and the browser's name and version. We use it only to find and fix sensors and browsers that lose their connection.

Server logs

Our hosting provider records technical data for each request to the app and API: IP address, browser user agent, the address requested, time and response status. We use it to keep the service secure and fix errors. These logs are kept for a few days.

Why we use it and our legal basis

To provide Pulz8 (your account, sign-in, sensors, the live board, saving and showing sessions, password resets): performance of our contract with you (GDPR Art. 6(1)(b)).
Health data on a personal account: your explicit consent (Art. 9(2)(a)), which you give by entering your profile and choosing to record a session. You can withdraw it at any time by deleting the data, as described under Your rights. Withdrawal does not affect processing before it.
Athlete data on a team account: on the team's instructions. The team is responsible for having a legal basis, normally the athlete's explicit consent, and for informing its athletes.
Security, abuse prevention and server logs: our legitimate interest in keeping the service safe and working (Art. 6(1)(f)).
Connection diagnostics: our legitimate interest in keeping the live board and recordings working (Art. 6(1)(f)).
Website analytics: your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings on the English home page. Withdrawal does not affect processing before it.
Pulz8 news by email: your consent (Art. 6(1)(a)), given by leaving your email. You can withdraw it at any time by replying to any email or writing to us.
Billing for team plans and keeping invoices: contract and our legal obligations (Art. 6(1)(b) and (c)).
Answering your messages and demo bookings: steps you ask us to take before a contract, or our legitimate interest in replying (Art. 6(1)(b) and (f)).

We make no decisions about you by automated means that have legal or similarly significant effects.

Google user data

Pulz8's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use the Google account ID, email address, verification status and name only to sign you in, to create or link your Pulz8 account, and to show who is signed in.
We do not transfer this data to anyone except as needed to run the sign-in, to comply with the law, or as part of a merger or acquisition with notice to you.
We do not use it for advertising, we do not sell it, and we do not use it to build profiles or to train AI models.
No person at Pulz8 reads it unless you ask us to (for example in a support request), we need to for security, or the law requires it.

You can remove Pulz8's access at any time in your Google account settings. Your Pulz8 account stays; set a password with Forgot password? to keep signing in, or ask us to delete it.

Who processes data for us

We do not sell personal data. We share it only with these service providers, each of which processes it on our behalf under a data processing agreement:

Cloudflare, Inc. hosts the website, the app, the API and the database (Cloudflare Pages, Workers and D1), and records the server logs.
Resend (Plus Five Five, Inc.) sends the app's emails (password resets, invites, billing notices) and tells us about emails left for Pulz8 news.
Google provides Sign in with Google, Google Analytics on the English home page, and the demo booking calendar.

We also disclose data when the law requires it, or to protect our rights or someone's safety.

International transfers

Cloudflare, Resend and Google may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses.

How long we keep it

Account, athlete profiles, sensors and sessions: for as long as the account exists. When an account is deleted, we delete its data within 30 days, and it leaves our database backups within a further 30 days.
Athlete profiles you delete in the app are removed straight away. Sessions already recorded for that athlete stay in the account's history until you ask us to delete them.
Password reset links: they expire after 60 minutes; the hashed token is deleted with the account.
Server logs: a few days.
Connection diagnostics: 90 days, then they are deleted automatically.
Invoices and billing records for team plans: as long as tax law requires, normally 10 years in Slovakia.
Emails and demo bookings: as long as needed to deal with your request, and no longer than 2 years after our last contact.
An email left for Pulz8 news: until you ask us to stop, and no longer than 2 years after you left it or we last wrote to you, whichever is later.

Your rights

Under the GDPR you can ask us to:

give you a copy of your data (access),
correct it (rectification),
delete it (erasure),
limit how we use it (restriction),
give it to you or another provider in a machine-readable format (portability),
stop using it where we rely on legitimate interest (objection),
and, where we rely on consent, you can withdraw it at any time.

You can edit your profile and delete athlete profiles in the app. To export your data, delete recorded sessions or delete your whole account, email [email protected] from the address on the account. We reply within one month. For athlete data on a team account, we forward the request to the team and help it respond.

You can also complain to a data protection authority, in particular in the EU country where you live or work. In Slovakia it is the Office for Personal Data Protection of the Slovak Republic.

Security

All traffic uses HTTPS. Passwords are hashed with argon2id, password reset tokens are stored only as hashes, and sign-in cookies cannot be read by page scripts. Every request is checked against the account's organization, so one account cannot see another's athletes or sessions. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Children

Pulz8 is not meant for children under 16 to use on their own. A team that records athletes under 16 must get consent from a parent or guardian first.

Not medical advice

Pulz8 shows heart-rate zones for training. It is not a medical device and does not diagnose, treat or monitor any condition.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your data in a significant way, we tell account owners by email or in the app before it takes effect.

Contact

JurikTech s.r.o, Company ID (IČO) 56723326, Slovakia. Email: [email protected].