Privacy Policy

Last updated: April 3, 2026

1. Who We Are

Impulse ("we," "us," "our") operates the Impulse mobile application and the website impulseact.com. Impulse is a behavioral coaching platform for impulse control. We are not a medical provider, and our services do not constitute medical advice, diagnosis, or treatment.

2. Information We Collect

Account Information

  • Name and email address (provided during signup)
  • Encrypted password (hashed, never stored in plain text)
  • Archetype selection from onboarding quiz

Behavioral Data

  • Override session data (start time, duration, completion status)
  • Impulse Control Score (ICS) history
  • Daily pledge completions
  • Arena game results
  • Academy lesson progress
  • Check-in responses
  • Self-reported urge data (intensity, triggers, time, coping methods used)

Coaching Data

  • AI coaching session transcripts (conversations with guides)
  • Your "why statement" (personal motivation text)
  • Baseline spending information you provide
  • High-risk time preferences

Crisis Data

  • Crisis keyword detection events (logged for safety audit purposes)
  • Crisis escalation tier activations

Technical Data

  • Device type and operating system version
  • App version
  • Crash reports (anonymized)

What We Do NOT Collect

  • Location data
  • Contacts or address book
  • Photos or camera data
  • Financial account numbers or bank data (unless you opt into Shield features in a future update)
  • Biometric data

3. How We Use Your Information

  • To provide and personalize the Impulse coaching experience
  • To calculate and display your Impulse Control Score (ICS)
  • To personalize AI coaching responses based on your profile and history
  • To detect crisis keywords and provide immediate safety resources
  • To send push notifications at your configured high-risk times
  • To generate weekly pattern reports and behavioral insights
  • To improve the product through anonymized, aggregated usage analytics

4. AI Coaching Disclosure

Impulse uses AI-powered coaching guides built on Anthropic's Claude API. Your coaching conversations are sent to Anthropic's servers for processing and are subject to Anthropic's data usage policies. Coaching conversations are not used to train AI models. AI guides are behavioral coaches, not licensed therapists, counselors, or medical professionals. They cannot diagnose conditions, prescribe treatments, or provide clinical recommendations.

5. Data Storage and Security

Your data is stored on Supabase infrastructure with Row Level Security (RLS) enabled on all tables. This means you can only access your own data. Authentication tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore) via expo-secure-store, not in plain storage.

  • All data encrypted in transit (TLS 1.3)
  • All data encrypted at rest (AES-256)
  • Authentication via Supabase Auth with secure token management
  • No data stored in plain text on device

6. Data Sharing

We do not sell your personal data. Ever.

We share data only with:

  • Supabase — database and authentication infrastructure
  • Anthropic — AI coaching conversation processing (Claude API)

We do not share your behavioral data, coaching transcripts, ICS scores, or urge history with any third party for advertising, marketing, or data brokering purposes.

7. Data Retention

  • Active account data is retained for as long as your account exists
  • Upon account deletion, all personal data is permanently deleted within 30 days
  • Anonymized, aggregated analytics data may be retained indefinitely
  • Crisis event logs are retained for 24 months for safety audit purposes, then anonymized

8. Your Rights

You have the right to:

  • Access your data — view all personal information we hold
  • Delete your account — available in the app under Settings. This permanently removes all your data from our servers, including your authentication record
  • Export your data — contact us at support@impulseact.com
  • Opt out of push notifications — via your device settings
  • Withdraw consent for AI coaching — stop using the coaching feature at any time

California residents have additional rights under the CCPA, including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.

9. Crisis Resources

Crisis resources (988 Suicide & Crisis Lifeline, Crisis Text Line 741741) are accessible at all times within the app. Access to these resources is never gated by subscription status, login state, or any other condition. Crisis keyword detection operates locally on-device before any data is sent to external services.

10. Children's Privacy

Impulse is rated 17+ and is not intended for users under 17 years of age. We do not knowingly collect personal information from children. If we discover that a user is under 17, we will delete their account immediately.

11. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via in-app notification. Continued use of Impulse after changes constitutes acceptance of the updated policy.

12. Contact

For privacy inquiries, data requests, or concerns:

support@impulseact.com

Impulse Inc. All rights reserved.