PulseWatchPrivacy policy
In short
- PulseWatch reads a minimal set of your Google Health data, read-only, to send you notifications.
- It stores one summary value per metric per day for up to 120 days, and nothing minute-by-minute.
- It does not sell data, show adverts, run analytics or use your data to train AI models.
- You can revoke its access at any time from your Google Account.
1. Who operates PulseWatch
PulseWatch is a personal, non-commercial project built and operated by its developer (GitHub: @usmanmateen), referred to below as “the operator”. It is not offered as a public or commercial service; the operator is its only user. PulseWatch is not a medical device.
2. Information PulseWatch accesses
PulseWatch uses the Google Health API with the following read-only permissions, granted through Google's OAuth consent screen. It never writes, edits or deletes anything in Google Health.
| Permission (scope) | Information read |
|---|---|
googlehealth.health_metrics_and_measurements.readonly |
The timestamp of the most recent heart-rate sample; for each 5-minute window of the last few hours, the average heart rate, used only to tell whether the tracker was being worn in that window and never stored; daily resting heart rate, heart-rate variability (RMSSD) and respiratory rate. |
googlehealth.activity_and_fitness.readonly |
Step totals for each 5-minute window of the last few hours, and total steps per day. |
googlehealth.sleep.readonly |
For each sleep session: start and end time, minutes asleep, time in bed, whether it is the main sleep or a nap, and whether Google has finished processing it. |
googlehealth.settings.readonly |
For each paired device: device type, model name, last sync time, battery level and battery status. |
Requests are limited to the fields above. PulseWatch does not request individual heart-rate readings, sleep stages, device hardware addresses, location, or any other data type.
3. How the information is used
Only to provide PulseWatch's features to the person who granted access:
- reminders when the tracker appears to be off the wrist, not syncing, or out of battery;
- movement nudges after a long still period during waking hours;
- short-sleep notices and a morning summary of sleep and recovery metrics;
- notices when resting heart rate or heart-rate variability has been outside the user's own recent range for several consecutive days (a comparison with the user's own history).
All decisions are made by fixed, documented rules and simple statistics. PulseWatch does not use machine-learning models, profiling for any other purpose, or automated decisions with legal or similarly significant effects.
4. What is stored, where, and for how long
PulseWatch runs on Cloudflare Workers and stores data in a Cloudflare D1 database in the operator's Cloudflare account. Retention is enforced automatically.
| Data | Purpose | Kept for |
|---|---|---|
| Daily summaries: one value per day for resting heart rate, heart-rate variability, respiratory rate, minutes asleep, bedtime, wake time and steps | Personal baselines, trend notices, morning brief | 120 days |
| Baseline statistics per metric (median, spread, number of days) | Comparisons in the morning brief | Replaced daily |
| Rule state, e.g. whether the tracker is currently considered off the wrist and when a reminder was last sent | Avoiding duplicate or repeated reminders | Current state only |
| Notification records: identifier, type, delivery status and timestamps. The message text is kept only until the notification is delivered, finally fails or expires | Reliable, non-duplicated delivery | 30 days |
| Operational status: times of the last check and last successful sync, counters and error codes, and the tracker's last sync time, battery status and model | Monitoring whether PulseWatch itself is working | Current values only (overwritten) |
| Records of each scheduled check: time, outcome, number of API calls and error codes (no health values) | Reliability and troubleshooting | 14 days |
| Service logs: event names, identifiers, states and error codes (no health values or credentials) | Troubleshooting | Up to 7 days (Cloudflare Workers Logs) |
Not stored: minute-by-minute or raw readings, sleep stages, and Google passwords. OAuth credentials (the Google refresh token and client secret) are kept as encrypted Cloudflare Worker secrets, never in the database; short-lived access tokens exist only in memory while a check runs.
5. Sharing and disclosure
PulseWatch does not sell, rent or trade Google user data and does not use it for advertising. It is shared only with the service providers needed to run PulseWatch:
- Cloudflare — hosting, database, message queue and service logs, as described above.
- ntfy.sh (the public server of the open-source ntfy project) — delivers notifications to the operator's phone. A notification's title and text — for example, how long ago heart-rate data was last recorded, or last night's sleep duration in the morning brief — pass through ntfy's servers over encrypted connections and may be cached there for up to 12 hours so the phone can receive them. Notifications are sent to a private, randomly generated topic.
- Google — the source of the data, under Google's own privacy policy.
These providers may process data in countries other than the operator's. Information may also be disclosed if required by law. It is not shared with anyone else, and nobody other than the operator reads it.
6. Google API Services User Data Policy
PulseWatch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, information received from Google APIs:
- is used only to provide or improve the user-facing features described in this policy;
- is transferred to others only as necessary to provide those features (the providers listed above), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
- is never used to serve advertisements, including personalised, retargeted or interest-based ads;
- is never sold, and never used to determine creditworthiness or for lending purposes;
- is not read by humans, except with the user's affirmative agreement, where necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations where the data has been aggregated and anonymised;
- is never used to develop, improve or train generalised or non-personalised AI or machine-learning models.
7. Security
- Read-only permissions, and only the fields each feature needs.
- Authorisation uses Google's OAuth 2.0 authorisation-code flow with PKCE; credentials are stored only as encrypted Cloudflare secrets and never written to logs.
- All connections to Google, Cloudflare and ntfy use HTTPS.
- Detailed operational interfaces require authentication; no operational interface exposes health information.
- Stored data is deleted automatically according to the retention periods above.
8. Your choices and controls
- Revoke access at any time at myaccount.google.com/permissions → PulseWatch → Remove access. PulseWatch can then no longer read any data.
- Delete stored data: everything described in section 4 can be deleted by the operator at any time, and otherwise expires automatically.
- Stop notifications by unsubscribing from the topic in the ntfy app.
9. This website
These pages are static files hosted on GitHub Pages. They set no cookies, run no scripts, and load no analytics, fonts or other third-party resources. GitHub may process technical information such as IP addresses to serve the pages; see the GitHub Privacy Statement.
10. Children
PulseWatch is not directed at children and is not used to collect information from them.
11. Changes to this policy
Changes will be published on this page with a new effective date. Material changes to how Google user data is used will be made only with renewed consent where required.
12. Contact
Questions about this policy can be raised by opening an issue at github.com/usmanmateen/pulsewatch/issues (please do not include personal or health information), or by using the support email shown on PulseWatch's Google consent screen.