Pulse Privacy Policy

Effective: May 20, 2026

This Privacy Policy explains how Hiroto Horikawa, a sole proprietor doing business as TsukuLogic ("Pulse," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with the Pulse desktop application, the website at tsukulogic.com/pulse, and related services (collectively, the "Service").

This English version is provided for the convenience of non-Japanese-speaking users. The Japanese version is the binding original; in the event of any discrepancy, the Japanese version prevails.

1. Local-First Principle (Most Important)

Pulse is designed as a local-first application. Your creation logs, screenshots, time-lapse data, and other Work data never leave your device unless you explicitly choose to share them. We do not track, transmit, or store your local creative content on our servers.

This is a core design commitment, not a marketing claim. Sections 2 through 8 below describe in detail what we do and do not collect.

2. Information We Collect

2.1 Information you provide

• Purchase information (via Lemon Squeezy): your email address, billing name, billing country, and order details. Lemon Squeezy is our merchant of record and processes payment card details directly; we do not see or store your full card number, CVC, or expiration date.

• Support correspondence: if you email us, we receive and store your message and any information you choose to include.

• Discord account information (optional): if you link Pulse with our Discord community, your Discord username and user ID become visible to us in connection with community participation.

2.2 Information generated by your use of the Service

• OpenTimestamps submissions: when you create a proof, Pulse computes a SHA-256 hash of your file on your device and submits that hash to public OTS calendar servers. Only the cryptographic hash is submitted; your original file is never transmitted by Pulse to OTS. A hash cannot be reversed to your original content.

• Blockstream Explorer API queries (verification only): when you verify an OTS proof, Pulse queries the Blockstream Explorer API (https://blockstream.info/api/) with the relevant Bitcoin transaction ID to confirm on-chain anchoring. Only the transaction ID — a public identifier that already exists on the Bitcoin blockchain — is transmitted. No personal information is sent to Blockstream.

• Public Page Add-on (opt-in only): if you opt in to publish a verification page, we receive and store on Cloudflare Workers + KV the verification URL, the hash, and any optional metadata you choose to include. You select a time-to-live (TTL) between 1 and 365 days, after which the entry is automatically deleted.

• Aggregate verification page traffic: for verification pages you publish, we collect aggregate viewer counts (no individual viewer identification, no IP-level tracking beyond what Cloudflare requires for abuse prevention).

• App telemetry: anonymous crash reports and basic usage counters (opt-out available in settings). We do not collect file names, file contents, or identifiers tied to your creative work.

2.3 Information collected automatically on the website

When you visit tsukulogic.com/pulse, we may collect standard server logs (IP address, user agent, referrer, request paths) for security and performance purposes. See Section 9 for cookie and external-transmission disclosures.

3. How We Use Information

We use the information described in Section 2 only for the following purposes:

• to provide and operate the Service, including generating cryptographic proofs and hosting verification pages you have opted to publish;

• to process purchases, refunds, and renewals (via Lemon Squeezy);

• to respond to your support inquiries;

• to detect and prevent fraud, abuse, and unauthorized access;

• to communicate with you about service changes, security advisories, and (with your separate consent) product updates;

• to comply with applicable law and respond to lawful requests from public authorities.

We do not engage in profiling that produces legal effects on you or similarly significant effects.

4. Information We Do NOT Collect

We do not collect:

• the contents of your local files, screenshots, time-lapse recordings, or Work data, unless you explicitly publish a verification page or send them to us in support correspondence;

• biometric data, location data beyond country-level billing inference, or device fingerprints used for advertising;

• credit card numbers, CVCs, or full payment card details (these are handled directly by Lemon Squeezy);

• behavioral data for cross-site advertising or retargeting.

5. Bitcoin OpenTimestamps Submissions

When you generate a proof, Pulse submits a one-way cryptographic hash to public OTS calendar servers. These hashes are then aggregated by OTS and anchored into the Bitcoin blockchain. The Bitcoin blockchain is a public, append-only ledger; once a hash is anchored, it cannot be removed. This is an inherent property of blockchain technology and is necessary for the verifiability of your proofs.

Because hashes are not personal information that can be reversed to identify you or your content, this submission does not, by itself, constitute a transfer of your personal information. However, if you choose to publish a verification page that links a hash to your identity (for example, your name or pen name), the connection between hash and identity is information you have voluntarily disclosed.

Blockstream Explorer API: to verify that a proof has been anchored on the Bitcoin blockchain, Pulse queries the Blockstream Explorer API (https://blockstream.info) with the relevant Bitcoin transaction ID. This transaction ID is a public blockchain identifier and does not constitute personal information. Blockstream's privacy policy is available at https://blockstream.com/legal/privacy/.

6. Public Page Add-on (Cloudflare Workers + KV)

If you opt in to the Public Page Add-on:

• the verification URL, the hash, and metadata you choose to include are stored on Cloudflare Workers + KV;

• entries are automatically deleted after the TTL you select (between 1 and 365 days);

• aggregate viewer counts are collected for your own analytics; we do not link viewer activity to identifiable individuals;

• Cloudflare may collect security-related telemetry (IP address, user agent) for the purpose of abuse prevention.

You may delete a verification page at any time before its TTL expires through your Pulse client.

7. Payment Processing (Lemon Squeezy)

All payment processing is performed by Lemon Squeezy, our merchant of record. Lemon Squeezy receives your payment card details, billing address, and tax-relevant information directly. We receive only the order summary and your email address. Lemon Squeezy's privacy practices are governed by its own privacy policy, available at https://www.lemonsqueezy.com/privacy.

8. AI Training Prohibition

Your User Content is never used to train artificial-intelligence models — by us, by our partners, or by anyone else. We do not transfer your User Content to third parties for AI training purposes. This commitment applies to the extent of our control over User Content.

9. Cookies and External Transmission Disclosures

The tsukulogic.com/pulse website uses cookies and similar technologies for the following purposes:

In compliance with Article 27-12 of Japan's Telecommunications Business Act (the "External Transmission Rule"), we publish the above table to inform you, prior to your continued use of the website, of the information that may be transmitted from your device to third parties when you load our pages.

The desktop Pulse application does not use web cookies. However, it makes external API calls to Blockstream Explorer (https://blockstream.info/api/) when verifying OTS proofs. Only the Bitcoin transaction ID (a public blockchain identifier) is transmitted; no personal information is involved.

10. Data Subject Rights

We respect your rights under applicable privacy laws, including:

• Japan's Act on the Protection of Personal Information (APPI): rights to disclosure, correction, suspension of use, and complaint.

• EU/UK General Data Protection Regulation (GDPR): rights of access, rectification, erasure, restriction, portability, and objection.

• California Consumer Privacy Act (CCPA/CPRA): rights to know, delete, correct, and opt out of "sale" or "sharing" (we do not sell or share personal information for cross-context behavioral advertising).

To exercise any of these rights, contact us at pulse.contact@tsukulogic.com. We will respond within the timeframes required by applicable law (typically within one (1) month for GDPR, and within a reasonable period for APPI and CCPA). We may need to verify your identity before responding to substantive requests.

11. International Transfers

Operating Pulse necessarily involves transferring some personal information to service providers located outside Japan and outside your country of residence:

By using the Service and accepting these privacy practices when you sign up or purchase, you provide your consent under Article 28 of APPI to the cross-border transfer of personal information described in this section. You may withdraw your consent by ceasing to use the Service; for technical reasons, certain transfers (for example, hashes already anchored on Bitcoin) cannot be reversed.

12. Children's Privacy

The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction, whichever is higher). We do not knowingly collect personal information from children under that age. If you believe we have collected such information, please contact us and we will delete it.

13. Security Measures

We implement reasonable technical and organizational measures to protect personal information, including:

• TLS encryption for all communication with our servers;

• access controls limiting administrative access to authorized personnel;

• separation of payment data (handled exclusively by LS) from our own systems;

• regular review of third-party service provider security practices.

No system is perfectly secure. If we become aware of a data incident affecting your personal information, we will notify you and the applicable regulators in accordance with applicable law.

14. Data Retention

We retain personal information only as long as necessary for the purposes described in Section 3:

• Purchase records: retained for the period required by Japanese tax and commercial law (currently seven (7) years from the end of the relevant fiscal year).

• Support correspondence: retained for up to three (3) years after resolution.

• Verification page entries: automatically deleted after the TTL you select (1 to 365 days).

• Crash reports and telemetry: retained for up to twelve (12) months in identifiable form.

15. Operator Information (Pursuant to APPI Article 32)

• Personal information handler: Hiroto Horikawa, doing business as TsukuLogic (sole proprietor).

• Address: 〒220-0072 神奈川県横浜市西区浅間町1丁目4番3号ウィザードビル402

• Contact: pulse.contact@tsukulogic.com

• Person responsible for personal information protection: Hiroto Horikawa

• Complaint forwarding: complaints regarding our handling of personal information may also be submitted to the Personal Information Protection Commission of Japan (https://www.ppc.go.jp/).

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes (for example, a new category of personal information collected, or a new third-party recipient), we will provide at least thirty (30) days' advance notice by email and/or in-app notice. Non-material changes (clarifications, contact updates, formatting) take effect when posted.

17. Contact

For questions about this Privacy Policy or to exercise your rights:

• Email: pulse.contact@tsukulogic.com

• Operator information: see Notice under the Specified Commercial Transactions Act.