PulseAI
Open the app
Privacy Policy
What PulseAI Studio collects, why, and how to get rid of it.
Effective 24 September 2026 · Last updated 24 September 2026
The short version. We keep your email address, the pictures and prompts you give us, and the results we make for you. We send your pictures and prompts to the AI companies that run the models, because that is the only way to generate anything. We run no advertising, no analytics and no tracking of any kind, and we never sell your data. Delete a picture and it is gone from our storage. Delete your account and everything goes with it.
Who we are
PulseAI Studio is operated from the United States and reachable at support@createpulseai.com. For anything in this policy — a question, a correction, a deletion request — that address reaches a person.
What we collect
| What | Why | How long |
|---|---|---|
| Your email address | It is your username, and it is how we send sign-in links and password resets. | Until you delete your account. |
| Your password | To sign you in. It is hashed by our authentication provider. We never see it and cannot recover it. | Until you delete your account. |
| Photos and videos you upload | They are the input to whichever model you chose. | Until you delete the item that used them, or your account. |
| Your prompts and settings | So your Library can show you what you asked for, and you can run it again. | Until you delete the item, or your account. |
| The images and videos we generate | They are the thing you came for. They live in your Library. | Until you delete them, or your account. |
| Your credit balance and what you spent | To run the credit system and to show you your own history. | Until you delete your account. |
| A sign-in cookie | So you stay signed in. It holds your account ID and an expiry, signed so it cannot be forged. It is not used to track you anywhere. | 30 days, or until you sign out. |
| A device cookie | A random ID for this browser, signed so it cannot be forged. Its only job is to remember that this browser has already received the free welcome credits, so the grant is not handed out again to a second account from the same device. It holds nothing about who you are and is not used to track you anywhere. | Up to 400 days. It is deliberately kept after sign-out and after account deletion. |
| A welcome-credit record | When an account receives the free welcome credits we store a one-way, salted fingerprint of the email address (not the address itself) and the device ID above. This is how we stop the same mailbox or browser claiming the free credits more than once. The fingerprint cannot be turned back into your address. | Kept after account deletion, for the reason above. |
What we do not collect
- No analytics, no tracking pixels, no advertising IDs, no third-party trackers. There is no analytics code in this app at all.
- No location, no contacts, no microphone, no camera roll scanning. The app only ever sees a photo you pick and hand to it.
- No card numbers. If you buy credits, Apple or Google handles the payment. We are told that a purchase succeeded; we are never shown your payment details.
Who else sees your content
To make a picture or a clip, we send your prompt — and your uploaded image, if you gave one — to a third-party AI provider that runs the model you selected: Replicate for most models, fal.ai for the photo-editing tools (remove background, erase object, expand) and the Kling Effects templates, and ElevenLabs (through Replicate) for speech and music. Those providers in turn run models built by companies such as Google, ByteDance, Kuaishou, MiniMax, Black Forest Labs, Runway, Luma and Alibaba. Your content reaches whichever of those providers runs the model you picked. We cannot generate anything without this step.
For the runs we send through the API, Replicate deletes the inputs, the outputs and the logs from its systems automatically, normally within an hour. When you delete an item in PulseAI, we also ask Replicate to delete the source file you uploaded for it. Each model provider has its own retention practices, which are outside our control.
The rest of our suppliers
- Netlify — hosts the app and stores your uploads and results (United States).
- Supabase — stores your login: email address and hashed password (United States).
- Resend — delivers our sign-in and password-reset emails (United States).
- Apple and Google — process credit purchases, once in-app purchases go live.
All of our own storage is in the United States. We do not sell, rent or trade your data, and we do not share it with anyone beyond the suppliers listed above, except where the law requires it.
Deleting things
- One item. Delete it in your Library. The result, the preview and the source file you uploaded for it are removed from our storage, and we ask Replicate to delete its copy of the source.
- Everything. Account → Delete account. It asks for your password first, then erases every job, upload, result and credit record, and permanently removes your login. It cannot be undone and we cannot restore it. The only things that remain are the two anti-abuse records described above: the device cookie in your browser and the one-way fingerprint that marks the free welcome credits as already used. Neither identifies you.
Deletion is immediate in the app. Ordinary backups at our hosting providers may hold copies for a short period before they roll over.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it — write to support@createpulseai.com. If you are in California, the EU or the UK, you have these rights by law and we will not charge you or treat you differently for using them. We do not sell personal information as those laws define it.
Children
PulseAI Studio is not for children. You must be at least 18 years old to use it, and older if the law where you live sets a higher age for agreeing to terms like these. We do not knowingly collect anything from a child under 18. If you believe a child has created an account, write to us and we will remove it.
Security
Everything travels over HTTPS. Your password is hashed by our authentication provider and is never visible to us. Sign-in cookies are cryptographically signed. Your Library is scoped to your account: one account cannot read, download or delete another's work. No system is perfect, and we will tell affected users promptly if we ever learn that data has been exposed.
Changes
If we change this policy in a way that matters, we will update the date at the top and tell you in the app before the change takes effect.