Privacy Policy

Pulsar is a personal-research tool for market analysis and signal tracking. This page explains what data it collects, why, and what you can do about it. It's written to describe what the app actually does, not generic legal boilerplate.

What we collect

If you create a Pulsar account, we store:

• Email and name — for login and account recovery.
• Password — never stored in plain text; only a salted bcrypt hash. If you sign up with Google, there is no password at all unless you later choose to set one.
• Google account identifier — only if you sign in with Google. Google gives Pulsar your name, your email address, and a stable account ID so it can recognise you next time. That is all Pulsar receives: no access to your Google account, contacts, Drive, or anything else, and it never sees your Google password. The ID is stored so your Pulsar account stays linked to your Google account even if you change the email on it. Deleting your Pulsar account removes it.
• Watchlist, portfolio, and alert data you enter — symbols, quantities, and cost basis you type in yourself, self-reported for your own tracking.
• Exchange API credentials — only if you choose to link a Binance account. This is optional, off by default, and reversible at any time. Both the API key and the secret are encrypted before they are written to the database, and are decryptable only server-side with a key that lives in the server environment — never in the database, never in our source code. The secret is never displayed again after you save it and is never returned by any part of the app; only the last four characters of the API key are kept in readable form, purely so the app can show you a masked identifier of which key is linked. Pulsar asks for read-only keys, and every request it makes to Binance is a read — there is no code path in Pulsar that can place an order, transfer, or withdraw, even if you linked a key that had those permissions. Unlinking deletes both stored values immediately.
• Telegram chat ID — only if you choose to link Telegram for alerts or the bot. Linking is optional and reversible.
• Messages you send the AI assistant (Telegram or in-app, where enabled) — sent to a third-party AI provider to generate a reply, see below.

Page visits — when you load the homepage, About, or this page, Pulsar logs your IP address, coarse country-level location (derived from IP, not GPS), the page you loaded, and a timestamp. This isn't an analytics/ad-tracking script (see "What we don't do" below) — it's a first-party log used for basic traffic visibility and to identify and block abusive traffic. It isn't linked to your Pulsar account even if you're logged in, isn't shared with any third party, and is automatically deleted after 90 days.

What we don't do

• No ad tracking, no analytics scripts, no third-party trackers on this site.
• We never sell or rent your data to anyone.
• We never ask for wallet keys, seed phrases, or payment details — Pulsar has no payment functionality and never touches a wallet.
• Pulsar never places a real trade. Demo trading is simulated with fake money, and a linked exchange account is read-only, as described above — nothing you see in Pulsar can move real funds.

Third parties involved in running Pulsar

Certain features necessarily route data through outside services to work at all:

• Market data (prices, candles) comes from public exchange and market-data APIs — no personal data is sent to them, only the asset symbols you're looking up.
• News headlines come from a third-party news API, queried by asset symbol only.
• Email delivery (alerts, verification codes) is handled by a transactional email provider (Brevo) — it sees your email address and the message content, nothing else.
• Sign in with Google, if you choose it, is provided by Google under Google's own privacy policy. Google learns that you signed in to Pulsar; Pulsar learns only what is listed under "What we collect" above.
• Telegram delivers bot messages and alerts if you link your account; a Cloudflare Worker relays messages between Pulsar and Telegram's servers.
• AI features (natural-language Q&A, photo/document analysis) send your message — and, if you send one, an image or document — to a third-party AI provider (Groq, Google Gemini, or OpenAI, depending on configuration) to generate a response. Only what you actually send is transmitted; Pulsar doesn't share your account or portfolio data with the AI provider unless you ask it a question that references it. Pulsar currently uses Gemini's free API tier, under which Google's own terms allow it to use submitted messages (and any generated reply) to improve Google's products, including human review of a copy disconnected from your identity — this differs from Google's paid API tier, which carries no such use. Avoid sending anything sensitive to the AI assistant.

Your data, your control

You can delete your account at any time from your profile — this permanently removes your account, watchlist, portfolio, alerts, demo-trading history, signal subscription, Telegram link, and any stored exchange API credentials from Pulsar's database. It doesn't retract messages already sent to third parties (e.g. an email already delivered, or a past AI conversation already processed by the AI provider), since those aren't Pulsar's to erase after the fact. Deleting your account covers the exact steps and what is and isn't removed.

Session login uses a secure, HttpOnly cookie — it isn't readable by page scripts and isn't shared with any third party.

Children

Pulsar isn't directed at children and isn't knowingly used by anyone under 13.

Changes to this policy

If what Pulsar collects or how it's used changes meaningfully, this page will be updated and the date above will change accordingly.

Contact

Questions about your data, or a request to access/delete it outside the in-app option above? Reach out at alerts@pulsaralert.com.