Privacy Policy

We use collected information for the following purposes:

We do not use your analytics data for advertising, profiling, or any purpose other than generating your requested reports.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data under the following legal bases:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service you signed up for.
• Legitimate Interests (Art. 6(1)(f) GDPR): Improving the Service, ensuring security, and preventing fraud, where these interests do not override your fundamental rights.
• Consent (Art. 6(1)(a) GDPR): Marketing communications and non-essential cookies, which you may withdraw at any time.
• Legal Obligation (Art. 6(1)(c) GDPR): Compliance with applicable laws and regulations.

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Service Providers: We engage trusted third-party processors to assist with payment processing (Stripe), cloud hosting (Render, AWS), and analytics (GA4). Each processor is bound by data processing agreements and may only use your data as instructed by us.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such change and any choices you may have regarding your data.
• With Your Consent: We may share data with third parties when you explicitly authorize us to do so.

We retain your data only for as long as necessary to fulfill the purposes described in this policy:

When data is no longer needed, it is permanently deleted or anonymized so that it can no longer be associated with you.

We implement robust technical and organizational measures to protect your data:

• Encryption in Transit: All data transmitted between your browser, our servers, and third-party APIs is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive data stored on our servers is encrypted using AES-256 encryption.
• Access Controls: Access to user data is restricted to authorized personnel on a need-to-know basis, protected by multi-factor authentication.
• Infrastructure: We host on AWS with SOC 2 Type II-compliant infrastructure, regular security audits, and automated vulnerability scanning.
• OAuth & API Key Security: Google OAuth tokens and App Store Connect API keys are stored in encrypted vaults and are never exposed in logs or to support staff.
• Incident Response: We maintain an incident response plan and will notify affected users within 72 hours of discovering a personal data breach, as required by applicable law.

While we take every reasonable precaution, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the highest commercially reasonable standard.

MorningPulse is based in the United States. If you access the Service from outside the U.S., your data may be transferred to and processed in the United States or other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data processing agreements with all sub-processors that include appropriate safeguards.
• Additional technical measures (encryption, pseudonymization) to ensure an equivalent level of protection.

We use a minimal set of cookies:

We use Google Analytics for website analytics, which is a privacy-focused analytics tool. Fully GDPR-compliant.

We do not use advertising cookies, tracking pixels, or social media trackers of any kind.

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@morningpulse.app. We will respond within 30 days (or sooner where required by law). We may need to verify your identity before processing your request.

MorningPulse is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will take immediate steps to delete that information.

If you believe a child has provided us with personal data, please contact us at privacy@morningpulse.app.

The Service may contain links to third-party websites or services that are not owned or controlled by MorningPulse. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We honor Do Not Track (DNT) browser signals. When we detect a DNT signal, we disable any non-essential analytics tracking for that session. Since we already use privacy-focused analytics that does not track individual users, the practical effect is minimal — your experience remains unchanged.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will update the "Last updated" date at the top of this page.
• We will notify you by email at least 15 days before changes take effect.
• For significant changes, we may require you to re-acknowledge the updated policy.

We encourage you to review this page periodically. Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out:

For GDPR-related inquiries, you may also contact our Data Protection Officer at dpo@morningpulse.app.

We aim to respond to all privacy-related requests within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.