Privacy Policy

1.Introduction#

This Privacy Policy explains how OnePulse ("we," "us," "our," or "Company") collects, uses, discloses, and safeguards information when you use our mobile application (available on iOS and Android) and related services (collectively, the "Service").

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, do not use the Service.

For details about website cookies and similar technologies, see our Cookie Policy at cookie-policy.html.

2.Information we collect#

2.1 Information you provide directly

2.1.1 Account registration

When you create a OnePulse account, we collect:

• Email address (required)
• Password (securely hashed and managed by our authentication provider, Supabase)
• First name and last name
• Username (unique identifier)
• Display name
• Phone number (optional)

2.1.2 Profile information

To help you connect with the Christian community, we collect:

• Bio/about section
• Spiritual testimony
• Favorite Bible verse
• Religious denomination
• Spiritual gifts
• Baptism date
• Salvation date
• Date of birth
• Gender identity
• Avatar image (profile picture)
• Cover image

2.1.3 Location information

• Country, state/province, and city (user-provided)
• Precise GPS coordinates (latitude/longitude), which are optional and used to connect you with nearby churches and community groups
• Timezone

2.1.4 User-generated content

We collect and store:

• Posts and comments you publish
• Reactions (likes, prayers, etc.) to other users' content
• Prayer requests and their specified privacy levels
• Prayer journal entries
• Bible notes and highlights
• Bookmarks of favorite content
• Direct messages between users
• Circle and hub participation and activity
• Media attachments (images, videos)

2.1.5 Communication data

We retain records of:

• Messages you send via our in-app messaging service
• Support inquiries and correspondence
• Feedback, suggestions, or complaints you submit

2.2 Information collected automatically

2.2.1 Device information

Through our error monitoring service (Sentry), we automatically collect:

• Device model and manufacturer
• Operating system version
• App version
• Device identifiers (for crash tracking purposes only)
• Crash reports and stack traces

2.2.2 Usage analytics

Through Mixpanel, we may collect:

• Features used and frequency
• Time spent in the app
• Session duration
• User interactions with interface elements
• App performance metrics

2.2.3 Push notification data

Through OneSignal, we collect and store:

• Device token (for delivering push notifications)
• Notification preferences and opt-out settings
• Notification engagement data (opened, dismissed)

2.2.4 Server log data

Our servers automatically log:

• IP address
• Request type and timestamp
• Pages or features accessed
• Error messages
• Approximate location (derived from IP)

2.3 Information from third parties

We may receive information about you from:

• Apple App Store or Google Play Store when you download our app (basic app analytics)
• Third-party sign-in providers if you use alternative authentication methods
• Other users who mention you in content
• Service providers and business partners with your consent

3.How we use your information#

We use the information we collect for these purposes:

3.1 Core service delivery

• Creating and maintaining your account
• Processing your registration and authentication
• Storing and displaying your profile information
• Delivering our messaging, prayer request, journal, and community features
• Connecting you with other users and communities
• Processing transactions and providing customer support

3.2 Location-based services

• Showing nearby churches, prayer groups, and community events in your area
• Connecting you with users in your geographic region (if you opt in)
• Improving local community recommendations

3.3 Communication

• Sending service-related announcements and updates
• Responding to your inquiries and support requests
• Sending push notifications about prayer requests, messages, and community activity (respecting your notification preferences)
• Sending email confirmations and account security notifications

3.4 Safety and security

• Detecting, preventing, and addressing fraud, abuse, and security incidents
• Protecting against malicious, deceptive, or illegal activity
• Enforcing our Terms of Service and other legal agreements
• Complying with legal obligations and law enforcement requests

3.5 Analytics and improvement

• Analyzing how users interact with our Service
• Identifying and fixing technical issues and bugs
• Understanding usage patterns to improve features and user experience
• Conducting research on community engagement and spiritual growth features
• Optimizing app performance and loading times

3.6 Personalization

• Customizing content recommendations based on your interests
• Tailoring notifications to your preferences
• Remembering your preferences and settings

3.7 Legal and compliance

• Complying with applicable laws, regulations, and legal processes
• Establishing, exercising, or defending legal claims
• Protecting the rights, property, and safety of OnePulse, our users, and the public

4.Data sharing and disclosure#

4.1 Information we do not share

• We do not sell your personal data to advertisers, marketing companies, or other third parties
• We do not share prayer requests, journal entries, or direct messages with third parties (except as required by law or with your explicit consent), except a photo of a handwritten page that you explicitly choose to send for transcription (see 4.2.2)
• We do not share passwords or authentication credentials with anyone

4.2 Information we share

4.2.1 With other users

Depending on your privacy settings:

• Your public profile information (username, avatar, bio, denomination)
• Your public posts and comments
• Prayer requests you mark as "public"
• Your participation in public circles and hubs
• Your reactions to others' content

Private content: Your prayer journal entries, private prayer requests, and direct messages are shared only with their intended recipients or remain completely private. A photo of a handwritten page you choose to scan is sent to a transcription provider to read it (see 4.2.2); the words it returns stay in your journal.

4.2.2 Service providers

To operate the Service, we share the necessary information with these third-party service providers:

Supabase (supabase.com)

• Email address, hashed password, profile data, user-generated content
• Purpose: User authentication, database hosting, and data storage
• Data location: EU/US (varies by Supabase data center)
• GDPR Data Processing Agreement: Yes

Cloudinary (cloudinary.com)

• Profile images, avatars, cover images, user-uploaded media
• Purpose: Image hosting, optimization, and CDN delivery
• Data location: AWS data centers (varies)
• Privacy Policy: https://cloudinary.com/privacy

Sentry (sentry.io)

• Device information, crash reports, stack traces
• Email (only if you provide feedback about a crash)
• Purpose: Error monitoring, crash reporting, performance tracking
• Your account id and, in production builds, standard request details such as IP address
• A screen recording of the moments before an error, with text and images masked
• Data location: US
• Privacy Policy: https://sentry.io/privacy/

AI transcription providers (Anthropic, Google, xAI)

• The photo of a handwritten page that you choose to scan, and nothing else
• Purpose: converting your handwriting to text so it can be placed in your journal entry
• Not used to train models. OnePulse does not store the photo. Under our zero-data-retention arrangement with each provider, the provider deletes the photo once it is read, except where the provider's safety systems flag it (kept for up to two years) or the law requires
• Privacy policies: https://www.anthropic.com/legal/privacy, https://cloud.google.com/terms/cloud-privacy-notice, https://x.ai/legal/privacy-policy

Mixpanel (mixpanel.com) (analytics)

• Usage patterns, feature interactions, session data
• Identified by your account id. Your name, email, and phone number are removed before data is sent
• Purpose: Usage analytics and app improvement
• Data location: US
• Privacy Policy: https://mixpanel.com/legal/privacy-policy/

OneSignal (onesignal.com)

• Device tokens, notification preferences
• Purpose: Delivering push notifications
• Data location: US/EU (configurable)
• Privacy Policy: https://onesignal.com/privacy_policy

Railway (railway.com)

• Backend application data and server logs
• Purpose: Application hosting
• Privacy Policy: https://railway.com/legal/privacy

AWS (aws.amazon.com)

• Requests to our website, onepulse.community
• Purpose: Website hosting and delivery
• Data location: Global (content delivery network)
• Privacy Policy: https://aws.amazon.com/privacy/

Cloudflare (cloudflare.com)

• Page-view counts for our website, without cookies
• Purpose: Website analytics
• Privacy Policy: https://www.cloudflare.com/privacypolicy/

4.2.3 Legal requirements

We may disclose your information when required by law or if we believe in good faith that disclosure is necessary to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service and other agreements
• Protect the safety, rights, and property of OnePulse, our users, or the public
• Detect, prevent, or address fraud or security issues

4.2.4 Business transfers

If OnePulse is involved in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

4.2.5 With your consent

With your explicit consent, we may share your information for purposes other than those listed above.

5.Data security#

5.1 Security measures

We use these security measures to protect your information:

• Encryption in transit: All data transmitted between your device and our servers uses TLS 1.2+ encryption (HTTPS)
• Authentication security: Supabase Auth hashes passwords with industry-standard algorithms. We never store plaintext passwords
• Access controls: Only the OnePulse team can access production systems, and only when there is a business need
• Network protection: Our website is served through AWS CloudFront, which includes DDoS protection
• Security checks: Every code change is scanned automatically for known vulnerabilities in the software we depend on
• Incident response plan: We have procedures for responding to data breaches

5.2 Limitations

We use strong security measures, but no system is 100% secure. We cannot guarantee absolute security of your information. Any transmission of data is at your own risk. You are responsible for maintaining the confidentiality of your password.

5.3 Data retention

• Active account data: We retain your account information as long as your account is active
• Account deletion: 14 days after you ask us to delete your account, we remove your authentication records, profile data, and user-generated content (see Section 8 for details)
• Handwriting scans: Photos you scan for handwriting transcription are not stored by OnePulse at all.
• Server logs: We keep server logs for up to 30 days for security and troubleshooting
• Backup data: Deleted data may remain in backups for up to 90 days before it is permanently deleted
• Analytics data: We may keep aggregated analytics data indefinitely. It cannot identify individuals

6.Children's privacy (COPPA compliance)#

6.1 Age restriction

OnePulse is for users 13 years of age and older. We comply with the Children's Online Privacy Protection Act (COPPA) in the United States and similar children's privacy laws worldwide.

6.2 Children under 13

• We do not knowingly collect personal information from children under 13 without parental consent
• If we learn that we have collected information from a child under 13, we will promptly delete it and notify the parent or guardian
• Parents who believe their child has provided information to OnePulse can contact us at support@onepulse.community

6.3 Children 13-18

• Parents may request access to, or deletion of, a minor's account
• We do not sell personal information of minors
• OnePulse shows no ads to anyone, including minors

7.Your privacy rights#

7.1 GDPR rights (EU users)

If you are in the European Union, you have these rights under the General Data Protection Regulation (GDPR):

Right of access: You have the right to request a copy of your personal data that we hold, in a structured, commonly used, machine-readable format.

Right to rectification: You have the right to correct inaccurate personal data.

Right to erasure (right to be forgotten): You have the right to request deletion of your personal data, subject to certain exceptions.

Right to data portability: You have the right to receive your personal data in a portable format and to transmit it to another controller.

Right to restrict processing: You have the right to request that we limit processing of your personal data.

Right to object: You have the right to object to processing of your personal data for direct marketing, profiling, or other purposes.

Rights related to automated decision-making: You have rights related to automated decision-making and profiling.

To exercise these rights, contact us at support@onepulse.community with "GDPR Request" in the subject line.

7.2 CCPA rights (California users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

Right to know: You have the right to request what personal information we collect, use, share, and sell.

Right to delete: You have the right to request deletion of personal information we have collected from you.

Right to opt out of sale: You have the right to opt out of the sale or sharing of your personal information (Note: OnePulse does not sell personal information).

Right to correct: You have the right to request correction of inaccurate personal information.

Right to limit use and disclosure: You have the right to limit our use and disclosure of sensitive personal information.

Right to non-discrimination: You will not receive discriminatory treatment for exercising your privacy rights.

To submit a CCPA request, email support@onepulse.community with "CCPA Request" in the subject line,.

7.3 LGPD rights (Brazil)

If you are in Brazil, the General Data Protection Law (LGPD) gives you these rights:

• Right of access to your personal data
• Right to correction of inaccurate data
• Right to deletion of data
• Right to data portability
• Right to object to processing
• Right to obtain information about the purpose and use of your data

To exercise these rights, contact support@onepulse.community with "LGPD Request" in the subject line.

7.4 PIPEDA rights (Canada)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you these rights:

• Right of access to your personal information
• Right to request correction of inaccurate information
• Right to request deletion of your information
• Right to understand how your information is being used
• Right to withdraw consent for processing

Contact us at support@onepulse.community to exercise these rights.

7.5 Other jurisdictions

Elsewhere, local data protection laws may give you similar rights. We respect your privacy rights wherever you are.

8.Account deletion and data removal#

8.1 How to delete your account

You can delete your OnePulse account through the app settings:

1. Open OnePulse
2. Go to Settings → Privacy & Security → Delete your account
3. Follow the confirmation prompts
4. Enter your password to confirm the deletion request

Or email support@onepulse.community with "Account Deletion Request" in the subject line.

8.2 What happens when you delete your account

When you request account deletion, you are signed out on every device and we email you the date your account will be deleted. That date is 14 days later. Until then you can sign in and tap Cancel Deletion to keep your account.

Deleted when the 14 days end:

• Your authentication credentials and login access
• Your personal profile information (name, email, phone, date of birth, etc.)
• Your profile avatar and cover image
• Your bio, testimony, spiritual information
• Your private settings and preferences
• Your user-generated content (posts, comments, journal entries)
• Prayer templates, reading plans and journeys you made that nobody else has used
• Your direct messages (from your account; recipients may retain copies)
• Your prayer requests
• Your bookmarks and saved items
• Your circle and hub memberships and activity
• Your likes and reactions on other users' content

Handled separately:

• Circles you created: Passed to another member of the circle
• Hubs you run: If you are a hub's only admin, it is passed to another member of the hub
• Posts you made as a hub: They belong to the hub and stay there, shown as posted by the hub, with their comments and reactions
• Prayer templates, reading plans and journeys you made: If someone else has used, saved or joined one, it stays for them without your name
• Bible plans and prayers you shared with friends: Ended for everyone; your friends keep their own progress
• Chat history: If another user has a copy of your direct messages in their chat history, they may keep it
• Your photos: Photos in your posts and journal entries are deleted with them. Photos in posts you made as a hub, and screenshots you sent with feedback, stay with those

8.3 Third-party data removal

When the 14 days end:

• Supabase: Your database records and your sign-in account are deleted
• Cloudinary: Your profile photo, your cover image, and the photos in your posts and journal entries are deleted
• OneSignal, Sentry, and Mixpanel: Data they hold is kept under each provider's retention settings. Email support@onepulse.community to ask us to have it deleted

8.4 Data retention after deletion

Some data may be retained for limited periods:

• Server backups: up to 90 days
• Legal holds: indefinitely (if required by law)
• Aggregated/anonymized data: retained indefinitely (cannot identify you)
• Law enforcement requests: until fulfilled

9.Your privacy choices#

9.1 Location services

• You can disable precise location access through your device settings
• The app will continue to work without precise location, but location-based features (nearby churches, community discovery) will be limited

9.2 Push notifications

• You can customize notification preferences within the app (Settings → Notifications)
• You can disable all notifications through your device settings
• Disabling notifications will not affect your ability to use OnePulse

9.3 Analytics and crash reporting

• Sentry (crash reporting): On for everyone, to help us find and fix bugs. Reports carry your account id, not your name or email, and screen recordings mask text and images.
• Mixpanel (usage analytics): On for everyone. Data is tied to your account id, with your name, email, and phone number removed. The app has no setting to turn it off; email support@onepulse.community to ask about your analytics data.

9.4 Email communications

• You can unsubscribe from non-essential emails using the unsubscribe link in each email
• Service-related emails (password resets, security alerts) cannot be disabled

9.5 Prayer request privacy levels

You control who sees your prayer requests by choosing one of these levels:

• Public: Anyone can see it, including people who open a link to it on our website
• Anonymous: Anyone can see it, without your name or photo
• Connections: Only your connections
• Hub members or circle members: Only members of that hub or circle
• Private: Only you

10.Contact us about privacy#

If you have questions about this Privacy Policy or our privacy practices:

Email:
support@onepulse.community

Mailing address:
We provide it for verified legal, regulatory, and privacy requests. Email support@onepulse.community with the subject "Mailing Address Request".

Response times:

• We will respond to your privacy inquiry within 15 business days
• For GDPR/CCPA requests, we aim to respond within 30-45 days as required by law

11.Data protection officer (DPO)#

For users in the EU and other jurisdictions requiring a Data Protection Officer:

DPO contact:
support@onepulse.community

12.Changes to this Privacy Policy#

12.1 Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

12.2 Posting changes

• Where changes appear: We post every change on this page and update the "Last Updated" date at the top
• Continued use: If you keep using OnePulse after changes, you accept the updated policy

12.3 Version control

• Effective Date: This policy is effective as of October 19, 2026
• Last Updated: October 19, 2026

13.International data transfers#

13.1 Cross-border transfers

OnePulse operates globally. Your information may be transferred to, stored in, and processed in countries other than the one you live in. Those countries may have data protection laws that differ from your home country's.

13.2 Adequacy and safeguards

For transfers from the EU to the US and other non-adequate jurisdictions, we rely on:

• Standard Contractual Clauses (SCC)
• Your explicit consent
• Necessary exceptions for contract performance or legal obligations

13.3 Your consent

By using OnePulse, you consent to the transfer of your information to countries outside your country of residence as described in this policy.

14.Dispute resolution#

14.1 Informal resolution

Please contact us first at support@onepulse.community to resolve any privacy concerns.

14.2 GDPR complaints

EU users may lodge a complaint with their local data protection authority:

• Italy: https://www.garanteprivacy.it/
• Spain: https://www.aepd.es/
• Germany: https://www.bfdi.bund.de/
• Full EU authority list: https://edpb.europa.eu/about-edpb/about-edpb/members_en

14.3 CCPA complaints

California residents may file a complaint with the California Attorney General:

• Website: https://oag.ca.gov/privacy
• Phone: 1-800-952-5225

15.Additional information for specific jurisdictions#

15.1 EU (GDPR)

• Lawful basis: We process your data based on: (a) contract performance, (b) your consent, (c) our legitimate interests, or (d) legal compliance
• Data processing agreement: Available upon request for business customers

15.2 California (CCPA/CPRA)

• Categories of personal information: See Section 2 of this policy
• Sale or sharing: OnePulse does not sell or share personal information
• Sensitive personal information: We limit collection and use of sensitive information (SSN, financial data, biometric data, etc.)
• Automated decision-making: We do not use automated decision-making for significant effects without human review

15.3 Brazil (LGPD)

• Data controller: OnePulse
• Legal basis for processing: Performance of contract, fulfillment of legal obligations, protection of rights, or legitimate interests
• Data protection officer: To be designated if required
• Transfer restrictions: International transfers may be restricted; we seek legal authorization before transfer

16.Prayer requests and sensitive data#

16.1 Special handling of prayer requests

Prayer requests may contain sensitive health, personal, or family information, so we add these safeguards:

• User control: You set the privacy level for each prayer request
• Encryption: Prayer requests are encrypted during transit and at rest
• Limited access: Only the OnePulse team can view content, and only when a support request or a report requires it
• No monetization: Prayer request data is never used for marketing or sold
• Respectful handling: We handle spiritual content with respect

16.2 Direct messages

• Direct messages are private communications between participants
• Messages are encrypted during transit
• We do not scan message content for ads or analytics
• Deleting your account removes message access from your account; message recipients may retain copies in their own chat history

16.3 Journal entries

• Prayer journal entries are accessible only by you
• Not shared with other users
• A page you choose to scan is sent to a transcription provider to read your handwriting (see 4.2.2). The photo is not kept by OnePulse.
• Protected with the same encryption as other personal data
• Not used for targeting or profiling

17.Third-party links and services#

Our app may contain links to third-party websites and services (churches, Christian resources, etc.). This Privacy Policy does not apply to them, and we are not responsible for their privacy practices. Please read their privacy policies before giving them any information.

18.Accessibility#

This Privacy Policy is available in English. If you need this policy in an alternative format (large print, audio, etc.), please contact support@onepulse.community.