Ghydion Pulse Privacy Policy

Effective date: October 25, 2026
Last updated: October 25, 2026
Version: pulse-privacy-2

Who we are

Ghydion Pulse ("Pulse") is a free hydration app from Ghydion, the company making the Ghydion Gallon smart water bottle. In this policy, "Ghydion", "we" and "us" mean Ghydion Co., whose mailing address is 1779 Kirby Pkwy #10086, Memphis, TN 38138.

• Privacy questions and requests: support@ghydion.com
• The rules for using Pulse: our Pulse Terms of Use
• Anything else: the Contact page at ghydion.com/contact

This policy covers the Pulse web app at ghydion.com/pulse. It will also cover the Pulse apps for iPhone and Android when they launch (see "The phone apps"). Our website and Gallon orders are covered by a separate policy at ghydion.com/privacy.

Pulse is made for adults 18 and over, and it's offered only in the United States.

Your health-data rights are also set out in one place in our Consumer Health Data Privacy Policy.

The short version

• Free, with no ads, and nothing is sold. We never sell your data, and we never use your health data for ads or marketing.
• No account, no email, no password. Your drinks, your goal and your body details stay on this phone.
• A small record lives on our server. It holds your first name, a friend code, today's progress and your badges, so friends you add can find you and see your bubble.
• Friends and groups see only what's listed below. They never see ounces, what you drink, your body details, or any health reason behind a quiet day.
• You're in control. Sharing your progress with friends you add is its own box at sign-up. It starts ticked, and you can untick it. After that, you can turn sharing off for everyone, or for one friend at a time. You can switch features off at any time, and Delete my data erases your data on this phone and on our server (a few things are kept; see "Delete my data").
• An AI assistant may help us read what you send us. When you send feedback or a report, an AI assistant (Claude, made by Anthropic) may help us read it and review the report, including the note that was reported. We don't use your data to train AI models. If that ever changes, we'll ask for your permission first.
• Pulse is a habit tool, not a medical device. It doesn't diagnose, treat, cure or prevent any condition.

What stays on your phone

Pulse saves what you tell it in this browser, on this phone. We can't see it.

• Your first name (a copy also goes to our server; see the next section)
• Your birthday (used to work out your age and to celebrate it). The date itself never leaves your phone. If you wear the birthday hat during your birthday window (the 30 days starting on your birthday) while you share your progress, Pulse tells our server only that you're wearing it, and friends and group-mates you share with see the hat on your card. That can hint that it's around your birthday. Our server keeps the day the hat first went on, so it comes off by itself after 31 days and can't come back for about 10 months.
• If you use the goal estimate: your weight, height, gender, activity level, state and city, and your home's elevation
• Whether you're pregnant or breastfeeding, if you tell Pulse. This never leaves your phone.
• Whether a clinician has given you a fluid limit or target, and that number. The number never leaves your phone. While you share your progress, friends and groups see "Just tracking today, no set goal" in place of a goal (see "What friends and groups see").
• Every drink you log: the time, the amount, the type of drink, and electrolytes if you add them
• Your goal, drinking hours, weekly number, streak, flame, badges, history and settings

Each drink is kept until its week has been scored. After that, Pulse keeps the daily totals. Everything stays until you delete it. If you clear your browser's data for ghydion.com, it's gone, and we can't bring it back.

What goes to our server, and why

Pulse's server runs on Netlify, a US hosting company.

Your Pulse record (everyone has one)

When you first open Pulse after sign-up, it creates a small record on our server. It holds:

• your first name
• a friend code that your phone makes (9 characters, or 6 for older codes)
• today's progress, as a whole percent
• the badges you've earned (never the ones about how much water you've logged, and never Charged Up)
• whether you're sharing, the friend codes you've added (up to 25), any whose notes you've muted, and any you've stopped sharing with one at a time
• when Pulse last updated your record

Why: so friends can add you by code and see your bubble, and so your code stays yours. The record exists even if you never add a friend.

Your phone also holds a secret key for your record. Our server keeps only a scrambled copy of that key, so no one else using Pulse can change or delete your record. Our support team can erase it too, but only when you ask (for example, when another phone holds your friend code).

While Pulse is open on your screen, it checks our server about every 20 seconds (every minute if notifications are on) to pick up cheers and friends' updates. It doesn't check while it's closed or in the background.

Your friend card (only while sharing is on)

Your sharing switch, Let friends and groups see my progress on the Partners tab, starts the way you leave the Share my progress with friends I add box when you sign up: on if it's ticked (it starts ticked), off if you untick it. Accounts made before that box existed keep their switch as they left it. You can also stop sharing with one friend at a time: turn off Share my progress with them on their card. That friend then sees only what everyone connected sees, in groups you share too. If your switch is off and you add someone, connecting turns it on for that person only: every friend already on your list is set to Share my progress with them off, and every group you'd shared with is set to not shared, so they still see only what everyone connected sees. While your switch is on, our server also keeps your friend card:

• today's progress as a %
• your streak, best streak and flame size
• the flame style you wear (Classic, or a month's flame you've earned) and the background you wear (the default, or one you've earned)
• the last month's flame you earned (its name, month and when), so your friends can be told. They see it for 7 days
• your weekly number, this week's goal days and when your week ends
• the last month we told your friends about: each month's flame gets one notification, sent only inside their drinking hours, however often it's earned again
• the minute you reached today's goal
• electrolytes as a %, if you track them
• your drinking hours
• your local day (which shows your time zone, and the time your day starts if you changed it in My day starts at)
• whether you're taking it easy today
• last week's goal days and weekly number, for the weekly group recap (kept up to 15 days)

When you turn sharing off, your friend card is deleted from our server right away.

Groups

If you create or join a group, our server keeps:

• the group's name, its code, who owns it, and when it was made
• who's in it, and when each person joined
• your share switch for that group, and which version of the "what you share" list you agreed to, and when
• join requests and invites (for 7 days)
• a daily count of cheers in the group, with no names (kept for 10 days)
• the weeks the group's bonfire stayed lit: dates only, no names or numbers (kept until the group closes)
• bonfire updates: when a group-mate who shares with the group adds a goal day, a short note for each of the others who share, holding only the group, how fed its fire is and how many have secured the week, counted as that person sees the group (their first name is added when you read it). Nobody taking it easy, or on a clinician's number, gets one. At most one a day per group, kept for 2 days
• a group's first sip of the day: when someone in a group you share with logs the first sip of their day, the time of it, so the others get Someone in your group logged their first sip for today once it has stood 2 minutes (an undo inside that time cancels it). The note names no one and holds no amount. One a day per group for each person, kept for 2 days

Groups are for adults 18 and over. You confirm that when you create one.

Friend requests, cheers and notes

• When you add someone, they get a note with your first name and your friend code.
• A cheer stores who sent it, their first name, which cheer, and when.
• A heart on a cheer you got is stored with that cheer (who hearted it, their first name, and when) so the person who sent it can see it. It goes when you take it back, when their next cheer replaces that one, or when either of you blocks the other or deletes their data.
• A typed note (up to 80 characters) can only go between friends who have added each other. We block notes containing links, email addresses, phone numbers or social handles. The note is shown for 48 hours. Its text stays on our server until that person's next cheer to you replaces it, or until one of you blocks the other or deletes their data.
• Group cheers are preset cheers only, with no notes. They show for 2 days and are deleted after 7.

Blocks and reports

If you block someone, our server keeps that until you unblock them or delete your data. They're never told. Reports go to our feedback inbox (see "Feedback, reports and the waitlist").

Each report also waits in a review queue on our server until we decide: the reason, your friend code and the reported person's (for a group, its owner's), their name as you see it, the group's name, and your words. When you report a friend, or someone who added you, the queue keeps a copy of the last note they sent you, as our server stored it, not a copy from your phone. We delete the report and that note 30 days after we decide.

If a report shows our Community rules (in the Pulse Terms of Use) were broken, our server keeps a moderation record under the reported friend code: how many times, the date of each decision, any limit with its dates (notes paused until a date, or suspended), and a short fingerprint of each note so the same note is never counted twice (not its words). It's kept as long as that person's Pulse record, because earlier decisions count toward the next limit. Delete my data doesn't erase it at once: once you've deleted your data, your moderation record is deleted 30 days after the last decision about you. We never tell anyone who reported them.

Network addresses

Pulse's own server code never stores your IP address. To stop spam and code-guessing, it counts requests per network by the hour, filed under a scrambled version of the address (a keyed hash). Older hours are deleted as new ones begin.

What friends and groups see (and never see)

Everyone you're connected to (friends and group-mates) always sees these, even with sharing off:

• your first name
• your bubble: roughly how far along today you are, in steps of 10%. Never ounces.
• your avatar, if you make one: friends see the avatar you build. It's made from preset pieces in Pulse, never a photo.
• your badges (never the ones about how much water you've logged, and never Charged Up)
• in groups: when you joined, and whether you own the group

Group-mates, only while you both have sharing on, both share with that group, and have both agreed to the list (never a friend you've stopped sharing with one at a time):

• your flame and the flame style and background you wear, your streak and best streak
• the birthday hat, while you wear it during your birthday window
• your week: goal days against your weekly number, and whether the week is secured
• today's progress as a %
• when you reached today's goal
• "Taking it easy": that it's a quiet day, and whether you're behind today or just tracking

Friends, only while your sharing switch is on: everything group-mates see, plus electrolytes as a %, your drinking hours and your local day. A friend you've stopped sharing with one at a time sees only what everyone connected sees, in groups you share too. We don't tell them.

Never, to anyone: ounces, what you drink, your body details, your birthday or age (the birthday hat, while you wear it, can hint that it's around your birthday), your city, pregnancy or breastfeeding, a clinician's number, or any health reason behind a quiet day.

If Pulse is following a clinician's number, you don't have a Pulse goal, so while you share, your card says "Just tracking today, no set goal". It never says why, and the number never leaves your phone. But only people on a clinician's number see that line, so a friend could guess the reason.

Also good to know:

• Anyone who has a group's invite code can see the group's name, its owner's first name and how many people are in it before they join.
• If you ask to join a group, its owner sees your first name.
• Notifications that include your name or your note show up on the other person's lock screen.
• When you earn a month's flame while you share, your friends get a notification that names you and the flame.
• Your group's bonfire is worked out from the weeks of everyone who shares with the group, on each person's own clock. It shows only totals (how fed it is, how many secured the week), never anyone's own numbers. Whether a week's bonfire stayed lit is the group's result, shown to every member who shares with the group.

To stop sharing: turn off Let friends and groups see my progress, turn off Share my progress with them on a friend's card, turn off Share with this group, remove a friend, leave a group, or block someone. Your name, bubble and badges stop going to someone only when you remove them, leave the group, or block them.

Notifications and check-ins (optional)

Both are off until you turn them on. Your browser asks your permission first. On iPhone, Pulse must be added to the Home Screen.

Notifications. Our server keeps the push address your browser gives us and the keys that go with it, for up to 5 devices. Our server writes each message and encrypts it before sending, so the push service that delivers it can't read it. Your browser company's push service delivers it: Apple, Google, Mozilla or Microsoft, depending on your browser. That service can see the push address, when a message is sent, its size, and a short label used to replace older messages. Today that label includes a friend code.
Each device also tells us which kinds it wants: friend and group notifications, check-ins, bonfire updates and a group's first sip (each on unless you turn it off in Partners › Notifications; they're sent only inside your drinking hours, at most once a day per group).
When you turn notifications off, the push address is deleted. It's also deleted if the push service says the device is gone, or if sending keeps failing for more than a day.

Check-in reminders. Our server keeps only the reminder times, your time zone, the time your day starts (if you changed it), and whether today counts yet. With Last call on (it is, with check-ins, unless you turn it off), it also keeps one more time, near the end of your drinking hours, and on a day when last call may go, that day's date. Your phone decides that: only while what's left can still be drunk at a steady pace before your day ends, never for a clinician's number, while you're taking it easy, or on a rest day of a secured week. Never what you drink, your goal or your drinking hours. The times fall inside your drinking hours. When you turn check-ins off, they're deleted. They're also deleted after 30 days with no device to send them to. On Android and desktop Chrome, a check-in can show one button with the amount Pulse suggests for it, such as "Log 10 oz". That amount is worked out on your phone and never sent to our server, but it shows on your lock screen.

Weather (optional)

Adaptive Hydration is off by default. Pulse never uses it if you follow a clinician's number. When it's on, Pulse gets today's weather from Open-Meteo:

• If your city is in Pulse's built-in list, Pulse sends only that city's map location (the city center, not where you are).
• If it isn't, Pulse first sends the city name (or state) to look it up.

Like any website, Open-Meteo also sees your IP address and browser type. Today's weather is kept only while Pulse is open. Pulse never uses your phone's GPS.

Feedback, reports and the waitlist

These go to our feedback inbox, which Netlify runs for us.

An AI assistant may help us read these. We may use an AI assistant, Claude, made by Anthropic, to help us read feedback and review reports, including the note that was reported and the friend codes in a report. Anthropic's terms with us cover how it handles them (see "Who else handles data"). We don't use your data to train AI models. If that ever changes, we'll ask for your permission first. The Feedback form and the Report sheet in Pulse say "An AI assistant may help us read this." right above the button that sends them.

• Feedback: your name (filled in from your profile, and you can change it or leave it "Anonymous"), the topic, your message, your browser and device type, a device ID that Pulse makes, the address of the page you were on, and a screenshot if you add one. Screenshots can show your water data.
• Reports: the reason, your name and friend code, the other person's name (and their friend code, if they're your friend), the group's name, code, size and owner's name if it's about a group, your words, the last note they sent you as our server stored it (if it's about a friend or someone who added you), a review number, and a sealed reference that only our support team can open.
• Erase requests: if another phone holds your friend code, Delete my data sends us a request with that code so we can erase it for you.
• Waitlist: which feature, the date, your friend code and your device ID.

Netlify also records your IP address, your browser and the page you sent it from with each one, and emails us a copy. Our email inbox is run by Google (Gmail).

Delete my data doesn't erase these. To have them deleted, including the email copies, email us at support@ghydion.com.

Who else handles data

We use a few companies to run Pulse. We share data with them only so they can provide their service to us, and never for ads.

Anthropic (Claude) works for us under Anthropic's terms with us. It may help us read feedback and review reports, including the note that was reported. We don't use your data to train AI models. If that ever changes, we'll ask for your permission first.

We may also share information if the law requires it, for example a valid court order, or to protect someone's safety.

No ads, no selling, no tracking

• No ads. Pulse has no ads and no ad or analytics tools. It may mention our own Gallon and the charity: water giving record we support. No one pays to appear in Pulse.
• Nothing sold. We never sell your data. We never use health data for marketing or advertising.
• No cookies. Pulse doesn't set any.
• No tracking across sites. Pulse doesn't follow you around the web or other apps, and no other company runs ads or trackers in Pulse. Because there's no tracking to turn off, Pulse works the same whether or not your browser sends a "Do Not Track" signal.
• No AI training. We don't use your data to train AI models. If that ever changes, we'll ask for your permission first.
• No location tracking. Pulse never uses your phone's GPS or geofencing.
• No profiling. We don't use your data to make decisions about you, such as for credit, insurance or jobs. Pulse works out your goal on your phone, for you.

Ghydion makes money from the Gallon, and later from optional paid features (such as Lockout and Partners+, which you can join a waitlist for today), never from your data.

Browser storage and device features

Pulse uses your browser's storage and a background helper (a "service worker") to:

• save your profile, drinks and settings
• remember which version of this policy you agreed to, and when, and your answer to the sharing box
• keep a copy of the app, and of this policy, so they open offline
• remember which notifications you've already seen
• word your check-in reminders

All of it is there to run Pulse, and none of it tracks you. You can clear it with Delete my data or in your browser's settings.

Device features:

• Motion sensors: move the water when you tilt your phone. They're used live and never stored or sent.
• Vibration: used for taps and effects.
• Clipboard: Pulse only copies to it when you tap Copy. It never reads it.
• Share: when you tap Share, Pulse makes an image of your streak, weekly number and week, with a link. That link has a short tag made on your phone. The tag isn't your friend code, and Pulse doesn't use it to track you. Two more pictures are made the same way, on your phone, and go only where you send them through your phone's own share sheet: Share my regimen (when you drank over the days you pick and your electrolyte totals; your name only if you include it) and the picture of a flame you've unlocked.
• Invite links: a friend invite link contains your friend code, and a group link contains the group's code.

The web app never uses your location (GPS), microphone, contacts or Bluetooth. It uses your photos or camera only if you add a screenshot to feedback, through your phone's own picker, and only the picture you choose.

Your choices

Your consent

When you sign up, you tick two boxes: one agrees to our Terms of Use and this policy, and the other agrees that Pulse can use your health data as described here. Pulse needs both. A third box, Share my progress with friends I add, is a separate choice: it starts ticked, you can untick it, and Pulse works either way. Ticked, your sharing switch starts on; unticked, it starts off. If you signed up before this policy existed, Pulse asks you once, the next time you open it. If you agreed to an earlier version of this policy, Pulse doesn't ask again, and your sharing switch stays as you left it. Pulse saves on your phone which version you agreed to and when, and your answer to the sharing box, and shows the date in Settings › Your data.

• To withdraw your health-data consent, use Delete my data. Pulse can't work without that consent, so withdrawing means erasing your data (see "Delete my data" for the few things that are kept).
• To withdraw your sharing consent, turn sharing off (for everyone, or for that friend), leave the group, or remove the friend. Nothing else changes.

Delete my data

Settings › Your data › Delete my data erases:

• On our server: your record, friend card and friends list (with the friends you've stopped sharing with), "added you" notes and cheers sent to you and by you, your notification sign-ups, your check-in times, your blocks, your places in groups, your last flame unlock, bonfire updates to you or about you, and your group first-sip times and notes. If you own a group, you choose who takes it over, or it closes. Join requests, invites and notes go too.
• On this phone: everything Pulse saved. Then Pulse reloads, fresh.

It takes a moment. If you're offline, you can wipe this phone right away, and the server part finishes the next time you're online. If another phone holds your friend code, we get an erase request and act on it within 30 days.

What it keeps:

• Feedback, reports and waitlist sign-ups. Email us and we'll delete them.
• Reports in our review queue, until 30 days after we decide, and a moderation record about you, until 30 days after the last decision (see "Blocks and reports").
• Spam-protection counters filed under your friend code. They hold only counts and scrambled codes: no names and no amounts.
• A marker that your friend code was erased, and when, so no one else can take it.
• Netlify's own web logs, for as long as Netlify keeps them.

Without the app: email support@ghydion.com with your friend code. We'll confirm the request and delete your data within 30 days.

How long we keep things

Your rights

Wherever you live, you can ask us to:

• tell you what we hold about you, and who we've shared it with
• give you a copy
• correct it (you can edit most of it yourself in Settings)
• delete it
• withdraw your consent

Email support@ghydion.com. It's free, and you don't need an account. To protect you, we may ask you to send the request from Pulse, or to show us your friend code on your phone.

We answer within 45 days. If we need more time, we'll tell you why, and we can take up to 45 more days. We delete data within 30 days.

If we say no, reply with "Appeal" and we'll look again and answer in writing within 45 days. If we still say no, we'll tell you how to contact your state's Attorney General.

Washington, Nevada and Connecticut residents: see our Consumer Health Data Privacy Policy.

Kids and age

Pulse is for adults 18 and over. Sign-up asks your birthday and won't continue if you're under 18. Groups are 18+ too, and anyone can report someone who might be under 18. If we learn that someone under 18 is using Pulse, we'll delete their data from our server. If you think a child is using Pulse, contact us.

Security

• Everything travels over an encrypted connection (HTTPS).
• Only your phone holds the secret key for your Pulse record, so no one else using Pulse can change or delete it. Our support team can erase it when you ask.
• Notifications are encrypted so the push service that delivers them can't read them.
• Pulse's own server code never stores raw IP addresses.
• Each report carries a sealed reference that only our support team can open.
• Only the people at Ghydion who run Pulse, and the companies listed in "Who else handles data", can open our server records and feedback inbox.

No system is perfect. If a breach affects your data, we'll tell you in Pulse and on this page, and we'll notify the authorities, as quickly as we can and within the time the law requires.

The phone apps (coming soon)

We're building Pulse for iPhone and Android. Before they launch, we'll update this policy and ask you to agree again. This is what we plan, so you know now.

• Apple Health, Health Connect and Samsung Health. Only if you connect them, Pulse reads and writes plain water only: the amount, the time, and which app logged it. Never other health data, never workouts, and never pregnancy or cycle data.
• Imported water stays on your phone. It counts toward your goal and streak, labeled with where it came from. The entries are never sent to our server. Because it counts toward your progress, it also counts toward the progress your friends and groups see. Pulse will ask your permission for that first.
• What Pulse writes back: each plain-water drink you log in Pulse, so your history there is complete. Never coffee or other drinks.
• Health data from these apps is never used for ads or marketing, never sold, and never stored in iCloud. It only reaches friends and groups as part of your progress, after you've agreed.
• Turn it off any time in Settings. Delete my data leaves water entries in Apple Health, Health Connect or Samsung Health as your own history. You can delete them there.
• Samsung Health: Pulse is provided by Ghydion Co., not by Samsung Electronics Co., Ltd., and Samsung isn't responsible for our privacy practices.
• The Ghydion Gallon will connect over Bluetooth to report the bottle's water level, battery and charging.
• Paid features: if you buy one in the phone apps, Apple or Google handles the payment.
• Accounts and sign-in: if the phone apps add accounts, we'll say here what an account stores, and how to delete it in the app and on the web, before they launch.

Changes to this policy

When we change this policy, we'll update the date at the top. For important changes, we'll tell you in Pulse before they take effect. If we ever want to use your health data in a new way, we'll ask you first.

Contact

Ghydion Co.
1779 Kirby Pkwy #10086
Memphis, TN 38138
Privacy: support@ghydion.com
Everything else: ghydion.com/contact