Privacy Policy | PulseFlow VPN

Who we are

Account data: your email address, a securely hashed password, email-verification state, account role, and account dates. We never store the password itself.
Subscription data: your plan, subscription status, and relevant dates.
Payment data: NowPayments processes cryptocurrency payments. We retain order and invoice references, amount, selected cryptocurrency and payment address, payment status, and the confirmation returned by NowPayments. We do not see or store bank-card details.
Device and session data: an app-generated device identifier and session tokens stored on our side only as hashes, with timestamps. These are used to keep you signed in and enforce plan device limits.
Connection diagnostics: connection success or failure, latency, packet loss, a typed error reason, app and OS version, and the PulseFlow server used. These diagnostics do not include visited sites or traffic contents.
IP addresses are used outside product measurement where operationally necessary: to show your current IP, rate-limit abuse, and in short-lived standard server access logs. We do not claim that PulseFlow never processes IP addresses.

When the corresponding feature flags are enabled, PulseFlow records server-generated events for completed registration, email verification, trial start, payment-checkout creation, payment-status changes, and subscription activation.
A raw measurement row may contain an internal user ID, event name, source, server timestamps, a technical deduplication identifier, and strictly limited properties such as plan code, payment status, and duration.
We use this information to understand the product and payment journey, improve reliability, and find and fix errors.
Raw product-measurement rows are retained for no more than 90 days. Rows linked to an account may be removed earlier when the account is physically deleted after its recovery period.
This measurement is processed first-party within PulseFlow. We do not use a third-party advertising analytics SDK and do not sell measurement data.
The product-measurement tables do not contain email addresses, IP addresses, full User-Agent strings, access or refresh tokens, cryptocurrency payment addresses, VPN traffic, visited destinations, VPN configurations, or user-traffic contents.
The public anonymous collector, including UTM and referrer collection, is currently disabled. We will update this notice before any future activation of that separate collection.

VPN traffic is carried through an encrypted AmneziaWG or Xray Reality tunnel. App requests to our API use TLS (HTTPS), and tokens on the device are protected with Android Keystore-backed encryption.
We do not sell personal data or share it for advertising analytics. Essential providers receive only the data needed for their role: Cloudflare for protection and routing, Google Workspace for service email, NowPayments for cryptocurrency payments, and hosting providers for VPN servers.
We may disclose information where required by applicable law.

Account and subscription data is kept while the account is active. Raw product-measurement data has the separate 90-day maximum described above.
You can request deletion in the app through Account → Delete account, or by contacting support@pulseflowvpn.com. The account remains recoverable for 30 days.
After that recovery period, the account and associated data are physically deleted. Linked measurement rows are deleted by that operation even if their 90-day period has not ended.
Payment records may remain in anonymised form for accounting and tax purposes.

You can ask what data we hold about you and request correction or deletion by contacting support@pulseflowvpn.com.
PulseFlow VPN is intended for users aged 18 and older and is not directed to children.
We may update this policy. The current version and update date are shown on this page.