Privacy Policy

01The short version

• Your content lives on your machine, in a local database inside your user folder.
• Encryption keys never leave your device. They are generated locally and stored in your operating system's keychain. We hold no copy and no escrow.
• Cloud sync is optional. With it off, no content of yours reaches our servers at all. With it on, our servers receive AES-256-GCM ciphertext they cannot decrypt.
• Third-party connections are added by you, one at a time, with the narrowest permission that makes the feature work — and are revocable from Settings.
• We do not sell your data, show you ads, or build advertising profiles. There is no such business here to fund.
• AI features are opt-in. Nothing is sent to an AI provider unless you trigger a feature that says it will.

This summary is written to be read, not to replace the sections below. Where the two ever disagree, the detailed sections govern.

02Who is responsible

Mussi Pulse (the app, bundle identifier tech.mussi.pulse) and this website (pulse.mussi.tech) are operated by Marcelo Mussi, an independent developer trading as mussi.tech, based in Brazil. For the purposes of the GDPR, that is the data controller; under the Brazilian LGPD, the controlador.

For any privacy question, request or complaint, write to mussicorp@gmail.com. There is no support queue between you and the person who wrote the code.

03What the app stores on your device

Everything you put into Mussi Pulse — notes, events, messages, mail, financial records, timesheets, repository data and settings — is written to a local SQLite database inside your home folder, together with any attachments and locally computed search indexes.

Secrets are handled separately and more strictly. Access tokens, app passwords, API keys, your PIN hash and the master encryption key are stored in the operating system keychain (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux) under the service name tech.mussi.pulse — never in plain files, never in the browser's local storage.

None of this is transmitted anywhere by default. An installed, unconnected Mussi Pulse is a fully working, entirely offline application.

04What we receive

There are only two ways data reaches infrastructure operated by us, and both are visible to you:

If you never enable cloud sync, we receive nothing from the app at all — not usage statistics, not crash reports, not a heartbeat.

05Google user data and Limited Use

If you choose to connect a Google account, the app requests access through Google's OAuth 2.0 consent screen. You see the exact scopes before granting anything, and no Google data is touched until you approve.

Limited Use disclosure. Mussi Pulse's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, that means all of the following are true of your Google data in this app:

• It is used only to provide and improve the calendar features you can see in the app — never for advertising, ad personalisation, credit assessment, lending, or any other unrelated purpose.
• It is stored on your own device, in the same encrypted local database as the rest of your content. Tokens live in your OS keychain.
• It is never sold, rented, or transferred to data brokers, information resellers, or any third party — except as strictly needed to comply with a valid legal order, or with your own explicit instruction.
• It is not read by humans. No employee, contractor or developer — including the author of this app — reads your Google data. The narrow exceptions permitted by Google's policy would be: your explicit consent for a specific support case, what is strictly necessary for security purposes such as investigating abuse, or compliance with applicable law.
• It is not used to train generalised AI or machine learning models. If you deliberately invoke an AI feature on a specific event, only that content is sent for that request, as described in the AI section below.
• It is not sent to our servers in readable form. If you enable cloud sync, calendar data travels and rests as ciphertext we cannot decrypt.

Revoking access. Disconnect the account in the app's Settings — which deletes the stored tokens and the synced copy from your device — and, if you want belt and braces, remove the app at myaccount.google.com/permissions. Revocation takes effect immediately; no further Google API calls are possible without a new consent from you.

06Other services you can connect

Every integration below is optional, added by you, and stored the same way: credentials in the OS keychain, fetched data in the local encrypted database.

Data you pull from these services is governed by their own privacy policies while it is with them, and by this one once it is on your device.

07AI features and what they send

Mussi Pulse can work with Anthropic's Claude to summarise, draft and explain. This is opt-in and off by default: the app is fully usable with no AI account connected, and features that would use AI are hidden or disabled rather than silently degraded.

When you do invoke an AI feature, only the content that feature needs — for example, the diff of the pull request you asked about, or the text of the event you asked to interpret — is sent to Anthropic for that single request, under the account you connected. Nothing is streamed continuously and nothing is sent in the background.

Anthropic processes that request under its own terms and privacy policy, as an independent provider you have a direct relationship with. Content sent through commercial API access is not used to train their models. The app's AI calls run with no tool access — the assistant cannot execute commands, read arbitrary files, or reach your accounts on its own.

AI output is a suggestion, not a fact. Review anything it produces before acting on it, especially where money, legal obligations or other people are involved.

08Why we are allowed to process this

Where the GDPR applies, our legal bases are: performance of a contract (processing needed to deliver the app you asked for, including routing your encrypted sync blobs), consent (each integration you connect and each AI feature you invoke — withdrawable at any time by disconnecting), and legitimate interests (keeping the service secure and available, in a way that does not override your rights).

Where the Brazilian LGPD applies, the corresponding bases are execução de contrato (art. 7, V), consentimento (art. 7, I) and legítimo interesse (art. 7, IX).

09Who else is involved

We do not sell, rent or trade personal data. A small number of providers process data strictly on our instructions to keep the service running:

• Website hosting — serves pulse.mussi.tech and keeps standard request logs.
• Pulse Cloud infrastructure — stores encrypted blobs and the routing metadata described above. The provider cannot read your content any more than we can.
• Anthropic — only for requests you explicitly trigger, and only the content of those requests.
• The services you connect yourself — Google, GitHub, your mail provider, and so on, each under its own policy.

We may also disclose data where legally compelled to do so. Because content is end-to-end encrypted, what could be produced in response to such an order is ciphertext and account-level metadata — not your readable content.

10How long things are kept

• Local data stays until you delete it. Uninstalling with the local database removed leaves nothing behind but the keychain entries, which you can delete too.
• Encrypted sync blobs are kept while your account is active and deleted within 30 days of you deleting the account or the object, allowing for backup rotation.
• Website request logs are retained for a short period for security purposes, typically no more than 90 days.
• Revoked credentials are deleted from the keychain immediately when you disconnect an integration.

11How it is protected

• AES-256-GCM authenticated encryption for content that leaves the device, with the key held only in your OS keychain.
• TLS for every network call the app makes.
• A 6-digit PIN lock with configurable auto-lock, plus an immediate lock shortcut, so an unattended machine is not an open app.
• A single recovery code, shown once when you set the PIN, which you are responsible for storing safely.
• No key escrow. Since we never hold your key, losing every trusted device together with your recovery code means the encrypted data cannot be recovered by anyone, including us. That is the deliberate cost of the guarantee.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to mussicorp@gmail.com before disclosing it publicly.

12Your rights, and how to use them

Under the GDPR, the LGPD and comparable laws you may request access to your data, correction, deletion, portability, restriction of processing, objection to processing, and withdrawal of consent. Most of these you can exercise yourself, immediately, without asking anyone:

• Access and portability — export your data from the app in open formats, at any time.
• Deletion — delete records in the app, disconnect integrations in Settings, or remove the local database entirely.
• Withdrawing consent — disconnecting an integration stops all processing tied to it and deletes its stored credentials.

For anything you cannot do yourself, write to mussicorp@gmail.com. We answer within 30 days. You also have the right to complain to your local supervisory authority — the ANPD in Brazil, or your national data protection authority in the EU/UK.

13International transfers

The operator is based in Brazil and infrastructure may be located in Brazil, the European Union or the United States. Where personal data is transferred out of your region, it is protected by the encryption described above — for synced content, the receiving infrastructure holds ciphertext only — and by contractual safeguards with our providers, including Standard Contractual Clauses where applicable.

14Children

Mussi Pulse is a professional tool intended for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a minor has provided personal data, write to us and it will be deleted.

15Changes to this policy

If this policy changes materially — new categories of data, a new purpose, a new recipient — the date at the top of this page is updated and users of connected accounts are notified in the app before the change takes effect. Continuing to use the app after that point means the updated policy applies.