Privacy Policy

Last updated: October 2026

This Policy explains what CoinPlotXAI Inc. collects when you use PulseSoc, why, and who else sees it. It covers the PulseSoc website, the installable web app, and the PulseSoc iPhone app.

This Policy describes what the service does today. Where something is not built yet, it says so rather than describing an intention as a practice.

1. What we collect

When you create an account: your name, your chosen handle and display name, email address, a hash of your password (never the password itself), optionally a phone number, your country, and the fact that you confirmed you meet the age requirements where you live. We do not collect your date of birth.

Your choices: whether you opted in to marketing email and, separately, marketing SMS; your language and region preferences; your privacy, notification and visibility settings.

What you create: posts, comments, replies, reels, statuses, stories, photos, video, audio, live broadcasts, profile and store details, product listings, reviews, groups and events, and the messages and calls described below.

How you use PulseSoc: account activity such as sign-in times, and website usage events — the page viewed, the event name, the referring page, UTM campaign parameters from links you arrive through, your browser and device type, your full browser user-agent string, a session identifier, a country value, and a hashed form of your IP address. We store the hash rather than the address itself, as a way of recognising repeated activity from one source for abuse prevention — section 14 explains why you should not read that hash as anonymisation.

Two kinds of usage event are recorded, and the difference matters. The page-view events the website sends as you browse carry no account identifier at all, even when you are signed in. Separately, when you take an action in the product while signed in, we record that action with your account identifier, alongside the page it happened on, your browser and device type, and the same hashed IP value. So please do not read the first kind as meaning your usage is never linked to your account — some of it is.

Commerce: your orders, carts, and the priced quote recorded for each order; payment status and payment-provider references; and, where an order ships, the delivery address collected by our payment processor.

Support: what you send us when you contact support, including the subject and message.

Market-information features: if you use them, the public wallet addresses, public transaction IDs, watchlists or portfolio entries you choose to enter. We never ask for and must never be given a seed phrase, private key, recovery phrase, or wallet password.

2. Cookies, storage and analytics

PulseSoc uses cookies and browser storage to keep you signed in, to remember your preferences, and to protect the service against abuse. These are necessary for the site to work.

PulseSoc's analytics are first-party. Usage events are sent to PulseSoc's own servers and stored in PulseSoc's own database. As of the date of this Policy, PulseSoc's website does not load Google Analytics, Google Ads conversion tracking, PostHog, or any other third-party analytics or advertising tag, and no such third party receives your browsing activity on our site. If we add one, we will update this Policy and, where consent is required, ask for it before loading it.

You can clear or block cookies in your browser. Blocking the necessary ones will sign you out and may stop parts of PulseSoc working.

3. Messages and calls

Direct messages and group chats are not end-to-end encrypted. Traffic is encrypted in transit, but message content is stored on our servers in a form our systems can read. That is what allows search, moderation, abuse investigation, and translation to work. It also means PulseSoc is technically able to access message content, and we do so where it is necessary to operate the service, investigate abuse or fraud, or comply with a legal obligation.

Please do not use PulseSoc messaging for anything that requires end-to-end encryption.

Voice and video calls are carried by our realtime provider. We store the records needed to place and account for a call — such as who the participants were and when it happened.

4. Live video and recordings

When you broadcast live, your audio and video pass through our realtime provider and our live-video provider to reach viewers. Live broadcasts may be recorded and the recording stored in our media storage so it can be replayed. If you go live, assume a recording exists.

5. Translation

PulseSoc can translate content when you ask it to. Translation is performed by Google Cloud Translation, which means the text being translated is sent to Google for processing.

The content types that can be translated include posts, comments, replies, reels, statuses, profiles, marketplace and product text, reviews, support messages, group and event text, and chat messages. So if you use translation on a conversation, that chat text is sent to Google. Links, email addresses, @mentions, hashtags, and code blocks are held back from the text that is sent.

6. AI features

PulseSoc includes AI-assisted features. When you use one, the content you submit to it is sent to the AI provider that serves the request. PulseSoc chooses the provider on the server, so your request never carries our provider keys, but the content does reach the provider. The providers configured for PulseSoc are listed in the table below.

7. Buying and selling

Card payments are handled by Stripe. Your card details are entered on Stripe's own payment page — PulseSoc does not receive or store your full card number. Stripe shares back the result of the payment and references we need to reconcile the order.

Where an order ships, Stripe collects the delivery address and passes it to us so the order can be fulfilled. The countries a delivery address may be in are set by the platform and shown at checkout. Where an order ships outside the United States, the address including its country is processed for customs, carrier and import-declaration purposes by the seller and the carriers handling the shipment.

Some items are supplied by a third-party dropshipping network rather than held by the seller. When you buy one, the seller places a matching order with that supplier, and your delivery details — recipient name, delivery address, and where the carrier requires one a contact number — are passed to that supplier so it can ship the item to you directly. We send those details for that shipment and nothing else about you: not your account, your email address, your order history, or anything you post. An item fulfilled this way may be dispatched from outside your delivery country, in which case the supplier and the carriers it uses also process the address for customs and import-declaration purposes.

You can check out as a guest without an account. In that case we process the items, quantities, options and delivery or pickup choices needed to fulfil the order, under a guest record rather than a member account.

If you sell on PulseSoc and accept card payments, you complete identity and bank verification directly with Stripe. Those checks are Stripe's; we receive the status of your account's capabilities, not the underlying documents.

Some sales are paid in cash on pickup or in person. Those payments happen between buyer and seller and are not processed by PulseSoc.

8. Advertising

PulseSoc shows advertising and promoted content, and places commerce content through its own discovery and curation systems. Targeting uses information held on PulseSoc. PulseSoc does not use a date of birth for advertising, because PulseSoc does not collect one, and PulseSoc does not send your activity to a third-party ad network from our website.

9. How we use information

• To run the product: your feed, profile, messages, calls, live video, reels, groups, stores and listings.
• To create and protect your account, sign you in, reset your password, and keep sessions secure.
• To process orders, payments, payouts and refunds, and to keep the records a transaction has to leave behind.
• To moderate content, enforce the community rules, and investigate abuse, fraud and security incidents.
• To send you service and security notices, and the notifications you have enabled.
• To send marketing email or SMS only on the channel you opted in to.
• To understand how the site performs and improve it, using the first-party analytics described above.
• To meet legal, accounting and regulatory obligations.

10. Who we share it with

We use the following providers to operate PulseSoc. Each receives only what its function requires.

We also share information where we are legally required to, where it is necessary to investigate fraud, abuse or a threat to someone's safety, and with professional advisers where needed. If the business is ever reorganised or acquired, information may transfer as part of that, and this Policy continues to apply until it is replaced.

Other members see what the product shows them: your profile, your public content, and what your privacy settings allow. The settings that actually decide this are the privacy and visibility settings in your account settings. The visibility tick-boxes on Privacy Center are not what controls it, for the reason set out in section 13.

11. We do not sell your information

CoinPlotXAI Inc. does not sell your personal information, and does not share it with third parties for their own advertising.

12. How long we keep it

We keep information for as long as it serves the purpose it was collected for:

• Your account and your content — while your account is open, and until you delete the content or your account is removed.
• Messages — while the conversation exists for the people in it.
• Orders, payments and payouts — for as long as needed to complete the order, handle refunds and disputes, and meet accounting and tax obligations.
• Security, moderation and abuse records — for as long as needed to protect members and to investigate repeat behaviour.
• Website analytics events — kept in aggregate and event form to measure and improve the site.

Some records outlive an account deletion where we are required to keep them — for example payment and tax records, and records of serious abuse. We have deliberately not published a single fixed retention period for every category, because a number published here has to be one the system actually enforces.

13. Your choices and requests

You can edit your profile, and change your privacy, notification and visibility settings, at any time in your settings.

Marketing email and SMS are opt-in. The promotional-email and promotional-text tick-boxes in your account settings are the control, and that control works: unticking one takes you off the matching marketing list we keep with Brevo, the provider that sends our email and SMS. We are not going to point you at an unsubscribe link, or tell you to reply STOP, because PulseSoc generates neither. We do not run marketing campaigns from the product itself today — the mail PulseSoc sends you is transactional, such as sign-in, verification, password, payment and order messages. If a marketing message does reach you and you want it stopped, untick the box in your settings or email support@pulsesoc.com.

Privacy Center shows four tick-boxes, and we have to be straight with you about them, because three are not connected to anything yet. "Opt out of personalized ads" works — our ad selection reads it, and if you have never saved the page you are treated as opted out already. The other three — opting out of optional analytics, "Public profile visible", and "Creator visibility enabled" — save your choice and nothing currently reads it. In particular, unticking "Public profile visible" on that page does not make your profile private. Use the privacy and visibility settings in your account settings for that, and treat those three boxes as a preference we have recorded rather than a control we have applied.

Account deletion on this website. You can delete your account yourself at Account → Delete Account. It asks for your password, and when you confirm, the deletion runs immediately — it is not queued and there is no waiting period. We remove the personal details on your account, including your username, email address, phone number, password, country, bio, profile and banner images, recovery contacts and any linked payment-customer or messaging identifiers, and we delete your saved notification devices and any outstanding sign-in, password-reset or verification tokens. Your posts, status updates and comments are withdrawn from PulseSoc at the same time.

We want to be exact about what that does not do, because the difference matters. Deletion does not erase every trace of you from every system. Messages you sent to other people remain in their conversations. Marketplace orders, payouts and the payment and tax records attached to them are kept, because we are required to keep them. Uploaded media files and operational logs are not purged by this step. An internal record of the account remains, in an anonymised form, so that the orders and records above still make sense.

Deleting from the PulseSoc mobile app is not the same thing, and right now it is worse. The app's delete-account screen does not perform the deletion described above. It records a request, tells you the account is scheduled for deletion about 30 days later, and cancels that request if you sign back in before then. The cancellation works. The deletion does not: nothing currently carries out a scheduled deletion, so a request made in the app can sit indefinitely and your account is not removed. We are not going to describe that as a 30-day deletion, because it is not one. Until the app is fixed, use Account → Delete Account on this website if you want your account actually deleted, or email us and we will do it by hand.

Data export. There is no working self-service data download on PulseSoc today. The mobile app has a button for it, and tapping that button produces a message saying a download link is on its way to you. No link is ever sent. The request is recorded and nothing processes it, so please do not wait for the email. Ask us at privacy@pulsesoc.com instead and we will put your copy together by hand. We do not promise a turnaround time, because no automated job is doing the work.

Depending on where you live you may have further rights over your information, such as access, correction, deletion, portability, or objecting to a particular use. To exercise any of these, or to ask a question about this Policy, email privacy@pulsesoc.com from the address on your account, or include the email address or phone number you used.

14. Security

We use reasonable technical and organisational measures to protect what we store. Passwords are stored as hashes, never as plain text. Traffic to PulseSoc is encrypted in transit.

Three things we will not overstate:

• PulseSoc does not currently offer two-factor authentication. Your password is the factor protecting your account, so use a strong, unique one. If a security screen shows two-factor protection as "enabled", that setting does not currently add a second factor: nothing asks you for a code, and the recovery codes it issues are not currently checked. We would rather tell you that than let the screen reassure you.
• Messages are not end-to-end encrypted, as described above.
• The hashed IP address in our analytics is not anonymisation, and we are not going to list it as a safeguard. We do store a hash instead of the address. But the hash is produced with a fixed value kept in our own code rather than a secret, and there are few enough possible addresses that anyone holding that value can work back from a hash to the address it came from. Treat it as a label standing in for your address, not as something that hides it. It is there so we can recognise repeated activity from one source, which is why it has not simply been removed.

No online service can be guaranteed secure. CoinPlotXAI Inc. will never ask you for a seed phrase, private key, recovery phrase, or wallet password. To report a security issue, email security@pulsesoc.com.

15. Age

PulseSoc is not intended for young children. When you create an account you confirm that you meet the age requirements that apply where you live. PulseSoc does not collect a date of birth and does not verify anyone's age, so this Policy does not claim an age check that does not exist. If you believe a child has given us information, contact privacy@pulsesoc.com and we will act on it.

16. Where data is processed

PulseSoc is operated from the United States, and the providers listed above process information in the United States and in other countries where they run infrastructure. If you use PulseSoc from outside the United States, your information is transferred to and processed in the United States.

17. Changes to this Policy

We may update this Policy as the product changes. Each published version carries the date above, and your acceptance is recorded against the version you were actually shown. When a new version is published, the website asks you to accept it the next time you sign in.

18. Contact

Privacy questions: privacy@pulsesoc.com. Security reports: security@pulsesoc.com.

PulseSoc is operated by CoinPlotXAI Inc.