PulseRest Privacy Policy

Last updated: October 6, 2026. Service operator: Hangzhou Shengli Technology Co., Ltd. (SunnyCreate). Contact: support@sunnycreate.com. This policy covers the current version with installation-bound AI sessions and a daily, local-midnight AI allowance. Earlier versions remain subject to the access and data-sharing rules disclosed for those versions; their previous daily AI allowances do not apply to this version.

On-device measurement

PulseRest uses your phone's motion sensors to record mechanical chest movement and estimate heart rate. Raw multi-axis motion recordings, full replay, measurement results and chat history are stored on your iPhone by default. The app does not use the camera, microphone, location, advertising identifier or HealthKit. It does not display advertising or track you across apps. No motion is collected during the preparation countdown; the measurement itself lasts 30 seconds.

The app marks its on-device database and waveform storage directories as excluded from system backups. This setting does not control files you export or copies made by you or other tools. It also does not guarantee that provider or server backups disappear when you delete content locally. Device protection and copies you manage remain subject to your system and storage settings.

Local measurement-access period

At first launch, the app stores one original start time in the device Keychain to calculate 7 × 24 consecutive hours of measurement access locally. This timestamp is not sent to the server. It is stored separately from measurements, conversations and ordinary preferences; Clear local data does not remove or restart it. An older installation with no verifiable start record records its first launch of the version with seven-day measurement access once, without inventing a past date. An unreadable record does not grant a new period. Preservation after device erasure or every reinstall scenario is not guaranteed.

This period includes heart-rate measurement, not AI replies. New measurements require an active subscription after it ends. AI always requires an active subscription verified on your device by Apple StoreKit. Existing records, replay, individual PDF export, deletion and past conversations remain available.

AI only after explicit consent and an active send action

Opening Analysis attaches context locally without sending health-related content. After sharing consent and an explicit Send or question-starter action, the selected estimate, availability and units, recording time to the minute, 30-second duration, chest-motion method, random record ID, language, your question and budgeted recent complete conversation turns pass through our servers to generate wellness information. Purchasing, restoring a subscription or changing tabs does not itself send a question.

The first active request in a new measurement-linked conversation additionally includes the recording's processed, sampled chest-motion waveform when trusted replay is available locally: at most 1200 points, relative seconds, g units, 40 Hz sampling information and gap markers. This is not raw multi-axis IMU data or an ECG. After the first complete reply is saved, follow-ups include results and budgeted chat without repeating waveform arrays. Reopening a conversation does not reset its first-send state. Retrying an unsuccessful, cancelled or not-yet-saved initial reply, or failing over among consented routes, may transmit the same initial context again. Missing or untrusted waveform is not invented; only results are shared. Upgrading an old conversation does not automatically send a waveform to fill in prior context.

The automatic measurement attachment does not include full raw multi-axis sensor samples, device or posture details, signal quality, other measurement records, your name or the full PDF. Its recording time is limited to the minute, not second-level or finer absolute precision. Text you type and the included conversation history are transmitted as described above, including any identifying information you put in them. The sampled waveform does not enable AI to re-measure you, verify accuracy, diagnose or estimate blood pressure. Omitting it from a follow-up does not mean providers have deleted previously received data. Local deletion or an app upgrade cannot retract shared content. Do not enter identity document numbers, contact details or another person's health information. If you voluntarily provide allergy, dietary-restriction or medication information, that text is chat content shared with the consented recipients in the request and relevant budgeted conversation history. You can continue on-device measurement without providing it.

Data recipients and routes

This version sends AI requests only through our mainland-China ECS servers, which call DeepSeek and use PoYo as a fallback when needed. The app contains no provider API keys and does not contact providers directly or bypass our servers when they are unavailable. PoYo is a routing platform; downstream model processors and processing locations depend on its service arrangements. Connections use HTTPS. A fallback after a provider failure may send the same context again to a recipient covered by your consent.

Providers process and retain data under their own terms. We do not promise that providers retain no data, exclude it from training or process it only in a particular country. Before use, consult the DeepSeek Privacy Policy and the current privacy terms on the PoYo website. You may decline AI sharing. Measurement access follows your remaining local period or active subscription; measurement does not require consent to AI sharing.

Identity, allowance and security

AI does not require account registration. When an AI service session is first issued or renewed, the app sends Apple-signed purchase evidence and its installation signing public key to ECS. We verify that evidence and issue a limited-duration, revocable session bound to that key. Ordinary requests reuse the valid session with signed, replay-resistant requests. The server records installation identifiers and public keys, necessary purchase and session authorization or revocation metadata, task and conversation identifiers, hashes, routes, times and task status. The current app does not require App Attest for this access path. Earlier clients retain their App Attest path and associated integrity evidence or counters.

The current app stores its daily 50-reply allowance locally, resetting at device-local midnight; it does not synchronize that allowance to ECS or other devices. Partial replies count once; failures without reply content do not. ECS does not enforce this daily reply quota or query Apple for every message. First authorization or session renewal still needs a working connection. A temporary authorization or network failure is not a reason to purchase again.

These security records are not completely anonymous or impossible to link, and do not identify one person across all devices. Connections and rate limiting use IP addresses. To resist copied purchase evidence, we limit installation bindings and technical request frequency associated with an original transaction chain. Request signatures, replay prevention, concurrency and timeout protections remain. Measurement follows the original local access period or an active Apple subscription; a server outage does not restart that period.

Protected local access records

PulseRest keeps device-only daily usage and pending task identifiers separate from health and chat content in protected local storage. Installation credentials and verified service-environment routing records remain in the device Keychain. Membership is verified through Apple StoreKit, not an ECS snapshot. The local ledger contains no waveform or conversation text. Midnight is checked while active and when reopening; an in-flight request remains associated with its sending day.

Clear local data removes measurements and conversations but retains protected installation credentials, necessary task-recovery records, local purchase records, daily usage and the original measurement-access start. Restarting, restoring purchases and clearing content do not refill today’s allowance or restart the measurement period. Preservation after device erasure or every reinstall scenario is not guaranteed. Expiration and refunds are handled using Apple StoreKit; a local flag does not replace verification of a valid subscription.

The app also keeps a small local diagnostic history of timestamps, fixed error codes and device-verification states. It contains no measurement or chat content, transaction or installation identifiers, API keys or authorization headers. This history is not automatically uploaded; you can choose to copy it when requesting support.

Subscriptions and purchase records

Apple handles purchases; we do not receive card details or your Apple password. The app verifies membership on the device with StoreKit. To obtain or renew an AI service session, it also submits Apple-signed purchase evidence to ECS, including product and transaction identifiers, the original transaction chain, environment, signed validity and available expiry or revocation information. ECS validates the evidence and binds the resulting session to the installation signing public key. The server does not persist the complete signed purchase credential. It retains necessary transaction and original-transaction identifiers, environment, signing/purchase/expiry times, refund or upgrade markers, installation links and session-token digests. It also retains the latest verified credential state needed to prevent reuse of older evidence after revocation. Purchase records are not sent to DeepSeek, PoYo or other AI models.

A cached session cannot last beyond the verified subscription expiry and can be revoked. Verified Apple notifications may update revocation state and revoke related sessions; local StoreKit updates continue to handle expiry, refunds and revocations. Verifying a signed transaction is not the same as querying Apple in real time, so we cannot promise immediate knowledge of every refund or revocation. Historical purchase records and older-client notification handling remain for compatibility and necessary retention.

Protected local app storage retains Apple-signed transaction records and associated product, transaction, environment and expiry or revocation information. These records are separate from health content and marked as excluded from system backups. Purchase history helps avoid repeatedly showing a subscription offer; a saved record alone does not grant membership. Access still requires an Apple-verified active subscription, and renewal, expiry, refunds and revocations continue to be handled through StoreKit.

Purchase, installation-binding, session-revocation and abuse-prevention records remain as needed to provide access, restore purchases, handle security and disputes; they are not deleted with the seven-day task window. Contact support to request deletion, subject to necessary security records or legal retention requirements. Deleting the app does not cancel an Apple subscription. Sandbox and Production use separate service instances and ledgers. Earlier-version and test records remain subject to their corresponding service rules and do not grant a new introductory allowance.

Server retention and cleanup

ECS does not persist health-related request or reply content and does not log authorization headers or provider keys. During forwarding, content is processed in memory. Providers' own retention is not controlled by deletion on your device.

The retention window for tasks and their associated attempts and settlement metadata lasts for seven complete UTC days after the task's creation day D ends. It closes at 00:00 UTC on day D+8. For example, the window for a task created on September 5, 2026 UTC closes on September 13, 2026 at 00:00 UTC. For a task with no active ECS worker and no ECS worker whose status remains unverified, that cutoff closes reconciliation for the old-day task. Eligible records are deleted in bounded maintenance batches. Unreferenced technical accounting records are also cleaned up according to this window. These server-side UTC records support recovery and version compatibility; they do not synchronize or determine the current app's device-local daily allowance. The cutoff is not a promise that files, logs or backups are fully erased at exactly that second.

If an ECS worker is still active or its status cannot be confirmed, the related task, execution occupancy and technical accounting records are retention exceptions. A timeout alone is not treated as proof that a task failed or produced no reply. The minimum identity and security records necessary to keep installation credentials valid and prevent replay or abuse are not automatically deleted with the task window. Short-lived tokens, verification challenges, replay-prevention nonces and rate-limit windows enter bounded maintenance cleanup after expiry; batch cleanup may not be immediate.

Contact support to request deletion of your server-side identity. Necessary security and historical accounting records may remain until their purpose is complete. Local deletion does not erase provider-held data, exported copies or server backups, and does not reset the local daily allowance or original measurement period.

For earlier-version compatibility, an accounting mirror retains those versions’ recent usage and unresolved tasks. Settled entries outside their historical rolling window may enter bounded cleanup; unresolved entries remain until their outcome is known. This mirror contains no health content and does not determine or restrict the current device’s daily allowance.

Your choices

You can withdraw consent for future AI sends in Settings without deleting local measurements. Delete individual or all local records and associated conversations, or export an individual PDF. Clear local data preserves the original access-period start in the device Keychain; it does not restart access, reset AI usage or cancel an Apple subscription. Exported files, other copies and information already sent to our servers or providers are not recalled by local deletion. Manage those copies where they are stored. Exports contain health information, so choose recipients carefully. Using AI and consenting to AI sharing remain your choices; the measurement-period and subscription conditions still apply.

Earlier app versions

Earlier subscription and free versions retain their previously disclosed access policies and consented routes. The current version uses only ECS forwarding. Updating does not retract previous sharing or erase historical accounting. Historical pending tasks may be reconciled without resending health content; the new device-local daily allowance is not synchronized to those ledgers.

Age, safety and changes

The product is intended for adults, not children. It is not a medical device, ECG, blood-pressure monitor or emergency-monitoring service. Do not use it to diagnose, treat a condition or change medication. Rest, activity, emotional-well-being and food suggestions are optional general lifestyle information. Check specific foods against allergens, personal dietary restrictions and food/medicine interactions; the app does not guarantee that every contraindication has been excluded. Consult an appropriate clinician, pharmacist or nutrition professional when uncertain. If you experience chest pain, difficulty breathing, fainting or other symptoms, seek professional help promptly and do not wait for the app or AI. If data recipients, purposes or scope change materially, we will update the information and request consent again.

PulseRest 隐私政策

更新日期：2026-10-06。服务运营方：杭州昇丽科技有限公司（SunnyCreate），产品为 PulseRest。联系：support@sunnycreate.com。本页当前规则适用于采用安装绑定 AI 会话及「每日 AI 次数、当地午夜重置」的版本。旧版本继续按此前披露的权益与数据共享规则运行；旧版每日 AI 额度不适用于当前版本。

本机测量

PulseRest 使用手机运动传感器记录胸部机械运动，估计心率。原始多轴运动、完整回放、测量结果和聊天记录默认保存在本机。不使用相机、麦克风、位置、广告标识或 HealthKit，不展示广告、不进行跨 App 跟踪。准备倒计时不采集；实际测量为 30 秒。

App 将本机数据库和波形存储目录标记为排除系统备份。该设置不控制您自行导出的文件、由您或其他工具制作的副本，也不保证供应商或服务器的备份会随本机删除而消失。设备保护与您管理的副本仍取决于您的系统和存储设置。

本机测量体验期

首次打开新版本时，App 在设备钥匙串中保存原始开始时间，用于本机计算连续 7 × 24 小时的测量体验期，不发送到服务器。该时间与测量、会话及普通偏好设置分开保存；「清除本地数据」不会删除或重置它。旧安装若没有可核验的历史开始时间，则在首次启动具有七天测量体验期的版本时记录一次，不推定过去日期。无法读取该记录时不会重新赠送体验期。设备抹掉及所有重装情形下能否保留，不作保证。

体验期仅包含心率测量，不包含 AI 回复。体验期结束后，新测量需要有效订阅；AI 始终需要本机 Apple StoreKit 验证的有效订阅。已有记录、回放、单次 PDF、删除和旧会话阅读保持可用。

AI 仅在明确同意并主动发送后使用

进入分析页面只在本机附加上下文，不发送健康正文。您同意数据共享并点击发送或主动选择发起问题后，本次测量得出的估计心率及可用状态与单位、记录时间（精确到分钟）、30 秒时长、固定胸部运动测量方法、随机记录 ID、语言、您的提问及当前会话中预算内的按时间由近至远选取的完整消息轮次会经我们的服务器用于生成一般健康生活参考。购买、恢复订阅或切换页面本身不会发送问题。

每段新关联测量对话的首个主动请求，若本机存在可信回放，会另附本次胸部运动的处理、抽样波形，不超过 1200 点，包含相对秒数、g 单位、40 Hz 抽样信息与缺口标记。它不是原始多轴 IMU 数据或心电图。首个完整回复保存后，追问只携带结果及预算内聊天，不重复附带波形数组；重新打开已有对话不会重置首轮。首轮失败、取消或回复尚未保存时的重试，以及已同意路线的容灾尝试，可能再次传输同一首轮上下文。缺失或不可信波形不伪造，只分享结果；旧会话升级不会为了补传波形自动发起请求。

自动附加的测量信息不包含全部多轴原始传感器采样点、设备与姿态信息、信号质量、其他测量历史、姓名或完整 PDF，其记录时间只精确到分钟，不包含秒及以下精度。您输入的聊天文字及纳入请求的会话历史仍按上述范围传输，包括您自行填写的身份信息。抽样波形不能让 AI 重新测量、核验准确性、诊断或估算血压。后续请求不附波形不代表供应商删除了之前接收的数据，本机删除或升级也无法撤回已分享内容。请勿在聊天中填写身份号码、联系方式或他人的健康资料。若您自愿提供过敏、饮食限制或用药信息，这些文字属于聊天内容，会随该请求及预算内的相关聊天一并发给已同意的数据接收方；无需提供这些信息也可继续本机测量。

数据接收方和路线

本版本的 AI 请求仅经我们运营的中国大陆 ECS 服务器转发至 DeepSeek；需要后备时由服务器转发至 PoYo。App 不内置供应商 API 密钥，也不直接连接供应商或在服务器不可用时回退直连。PoYo 是转发平台，其下游模型处理方及处理地区受供应商实际服务安排影响。所有连接使用 HTTPS。首选供应商失败后的后备请求可能再次向已同意的接收方发送相同上下文。

供应商会依其条款处理、保留数据；我们不承诺供应商零存储、不用于训练或仅在某个国家处理。使用前可查阅 DeepSeek 隐私政策和 PoYo 网站中的现行隐私条款。您可以拒绝 AI 共享；本机测量仍按剩余体验期或有效订阅判断，不要求为了测量而同意 AI 共享。

身份、额度和安全

AI 不要求注册账号。首次签发或更新 AI 服务会话时，App 向 ECS 发送 Apple 签名购买凭据及本机安装签名公钥。我们核验凭据后签发绑定该公钥、期限有限且可撤销的会话；日常请求复用有效会话，并使用签名和防重放验证。服务器记录安装标识、公钥、必要购买与会话授权/撤销元数据、任务及对话标识、哈希、路由、时间和任务状态。当前版本的此访问路径不要求 App Attest；旧客户端继续保留原 App Attest 路径及相应完整性证明或计数记录。

当前 App 在本机保存每日 50 次额度，设备当地午夜重置，不将此额度同步至 ECS 或其他设备。部分回复计一次，没有回复内容的失败不计次。ECS 不执行该每日回复配额，也不逐条消息查询 Apple。首次授权或更新服务会话仍需联网；暂时的授权或网络失败不代表需要重复购买。

这些安全记录不是完全匿名或无法关联的数据，也不能识别同一自然人在所有设备上的身份。连接和限流使用 IP 地址。为防止复制购买凭据，我们按原始交易链限制安装绑定数量与技术请求频率；请求签名、防重放、并发和超时保护仍保留。测量仍按原始本机体验期或有效 Apple 订阅判断，服务器故障不重置体验期。

受保护的本机访问记录

PulseRest 将本设备每日计数及未完成任务标识与健康、聊天正文分开保存在受保护的本地存储中。安装凭证和已验证的服务环境路由仍存于设备钥匙串。会员由 Apple StoreKit 验证，不依赖 ECS 快照；计数账本不含波形或对话正文。前台跨午夜及重新打开时重新检查日期，在途请求仍归发送当日。

「清除本地数据」删除测量与会话，但保留安装凭证、必要任务恢复记录、本机购买记录、当天使用量和原始体验起点。重启、恢复购买、清除内容不会补满当天次数或重启测量体验。设备抹掉及所有重装情形下的数据保留不作保证；到期和退款由 Apple StoreKit 处理，不以本地开关替代对有效订阅权益的核验。

App 还在本机保留少量诊断历史，包含时间、固定错误代码和设备验证状态，不包含测量或聊天正文、交易或安装标识、API 密钥或授权头。该历史不会自动上传；联系支持时，您可以主动选择复制并提供。

订阅与购买记录

购买由 Apple 处理，我们不接收银行卡或 Apple 账户密码。App 使用设备端 StoreKit 判断会员。首次取得或更新 AI 服务会话时，还会向 ECS 提交 Apple 签名购买凭据，其中包含商品及交易标识、原始交易链、环境、签名有效期限和可用的到期或撤销信息。ECS 核验后将会话绑定至本机安装签名公钥，不持久化完整签名购买凭据，仅保留必要交易及原始交易标识、环境、签名/购买/到期时间、退款或升级标记、安装关联和会话令牌摘要，以及防止撤销后重新使用旧凭据所需的当前验证状态。购买记录不会提供给 DeepSeek、PoYo 或其他 AI 模型。

缓存会话不能超过已验证订阅到期，且可被撤销。经验证的 Apple 通知可更新撤销状态并撤销相关会话；本机 StoreKit 更新仍处理到期、退款及撤销。核验签名交易不同于实时查询 Apple，因此无法承诺立即知晓每次退款或撤销。历史购买记录及旧客户端通知处理仍为兼容与必要保留而存在。

受保护的 App 本机存储保留 Apple 签名交易记录及相关商品、交易、环境、到期或撤销信息，与健康正文分开，并标记为排除系统备份。购买历史用于避免反复展示订阅介绍，保存的历史记录本身不会授予会员权限。访问仍需 Apple 验证的有效订阅，续订、到期、退款与撤销继续通过 StoreKit 处理。

购买、安装绑定、会话撤销及防滥用记录保留到权益履行、恢复购买、安全与争议处理目的完成；不随七日任务清理窗口一同删除。您可联系支持提出删除请求，必要安全或依法需保留的记录除外。删除 App 不会取消 Apple 订阅。Sandbox 与 Production 使用隔离的服务端实例与账本；旧版、早期测试记录继续按相应服务的规则处理，不用于重新赠送新版额度。

服务器保留与清理

ECS 不持久化健康正文或回复正文，不记录授权头或供应商密钥。转发时正文在内存中处理；供应商自己的保留不受本机删除控制。

任务及关联尝试、结算元数据的保留窗口为任务创建日 D 结束后七个完整 UTC 日，到 D+8 日 00:00 UTC 截止。例如，UTC 2026-09-05 创建的任务，其窗口在 2026-09-13 00:00 UTC 截止。对于不再有活跃 ECS 工作进程、且不存在工作进程状态无法确认情形的任务，该截止点结束旧日任务对账；符合清理条件的记录在有界维护批次中删除。不再被任务引用的技术结算记录也按该窗口清理。这些服务器 UTC 记录用于恢复和版本兼容，不同步或决定当前 App 的设备本地每日额度。这个截止点不是承诺文件、日志或备份在精确同一秒被彻底擦除。

仍有活跃或状态无法确认的 ECS 工作进程时，相关任务、执行占用和技术结算记录属于保留例外，不能仅凭超时假定任务失败或没有输出。维持安装凭证有效及防止重放、滥用所必需的身份安全记录也不随任务窗口一同自动删除。短期令牌、验证挑战、防重放随机数和限流窗口在到期后进入有界维护清理；批次清理可能不是即时完成。

需要删除服务器身份时请联系支持；必要安全和历史结算记录可能保留到对应目的完成。本机删除不会擦除供应商数据、导出副本或服务器备份，也不重置本地当天次数或原始测量体验期。

服务器为旧版兼容保留旧版近期用量和未确认任务的结算镜像；超出旧窗口的已结算记录可进入有界清理，未确认记录保留到结果明确。镜像不含健康正文，不决定或限制当前设备的每日次数。

您的选择

设置中可撤回未来 AI 发送授权；撤回不删除本机测量。您可删除单条或全部本机记录及关联会话，或导出单次 PDF。清除本地数据不会删除设备钥匙串中的原始体验期起点，不会重启体验期、重置 AI 用量或取消 Apple 订阅。导出的文件、其他位置副本和已交给服务器或供应商的数据不随本机删除撤回，请在相应位置管理。导出包含健康信息，请谨慎选择接收方。是否使用 AI 与是否同意 AI 共享由您决定；新测量的期限和订阅条件仍然适用。

旧版本说明

旧订阅版和免费版按此前披露的权益及已同意路线运行，当前版本只使用 ECS 转发。更新不会撤回先前共享或擦除历史结算；历史未完成任务可以继续核对，但不会为此重发健康正文。新版设备本地每日额度不同步到旧账本。

年龄、安全及变更

本产品面向成年人，不面向儿童，不是医疗器械、心电图、血压计或急救监护服务。不要据此诊断、治疗或更改药物。休息、活动、情绪和饮食建议是可选的一般生活参考；具体食物需核对过敏原、个人饮食限制及食物与药物相互作用，不保证已排除全部禁忌。不确定时请咨询医生、药师或营养专业人员。若出现胸痛、呼吸困难、晕厥等不适，请及时寻求专业帮助，不要等待 App 或 AI。数据接收方、用途或范围发生实质变化时，我们会更新说明并再次请求同意。