Privacy

Most of Pulite works without an account, name, or Puller mark.

Cloudflare receives the ordinary data needed to deliver and protect each page. It also provides the server-side features described here. Story progress otherwise stays in this browser. The following sections explain First Pull, measurement, Memoria, and optional PipLine.

Continuing the initial contact opened from the desktop shortcut automatically starts First Pull and Turnstile, without a separate confirmation.

A successful Pull stores a public Puller number, signed credential, issue time, and pseudonymous digests derived from the browser and network address. The raw address is not kept in the First Pull record; its anti-abuse digest remains personal data. No name, email, or password is required.

Measurement records predefined milestones, surface, release, referring host, and limited campaign labels. It has no returning-visitor ID and receives no names, emails, advertising IDs, wallets, content, raw network address, or user-agent string. Campaign context stays in the current tab.

Memoria records a predefined action category and PulitePad surface, never command text, fingerprint, session ID, or runtime state. A short-lived network digest limits abuse. Only an aggregate count is exposed, not individual events or exact times.

PipLine is optional.

Opening a line stores a public profile and address, public device keys, contacts, blocks, a pseudonymous First Pull reference, and sign-in and delivery records. The relay does not retain the signed First Pull credential, private keys, or readable recovery code.

Messages are encrypted in the browser. The relay sees delivery metadata and sealed messages, not readable text. History and private keys stay on each device. Contacts see only current online or offline status, never a last-seen time. Safety reports contain a reason and pseudonymous references, never readable message text.

Pulite uses First Pull data to prevent duplicate issuance and abuse, preserve its receipt, and validate PipLine. Browser storage preserves story state.

PipLine data supports your request to open, use, recover, or delete a line. Rate limits, blocks, and reports protect the service and its participants. Limited measurement and Memoria's aggregate count show whether public systems are working.

Where applicable, security and limited measurement rely on Pulite's legitimate interests under GDPR Art. 6(1)(f). Personal information is not sold or used for targeted or cross-context behavioral advertising.

First Pull: checks, 10 minutes; anti-abuse records, 30 days; receipts, until deletion or project end. Measurement: 3 months. Cloudflare logs: up to 6 months. Memoria: brief limits and a 7-day aggregate. Legacy data stays hidden until expiry.

PipLine: challenges, 10 minutes; tickets and delivered or rejected messages, 24 hours; contact requests, 7 days; undelivered messages, 14 days; session, sync, and delivery retry data, 30 days; reports, deleted accounts, and deletion receipts, 90 days. Profiles, contacts, and blocks stay until removed; restrictions, while active. A minimal address and key-fingerprint record remains permanently to prevent reuse. Backups may persist during Cloudflare recovery.

Deleting a line removes its encrypted messages. Related delivery retry metadata is kept for 90 days from deletion of either line to prevent duplicate delivery and preserve delivery outcomes. This metadata includes sender and recipient references, message and conversation identifiers, an encrypted-envelope digest, and delivery status. It does not include message contents.

Clearing site data removes local progress, the First Pull credential, PipLine private keys, and readable history. It does not delete server records or close an open PipLine line.

PipLine recovery requires the private First Pull credential and recovery code. It replaces the old line with a new address, keys, and code, but cannot restore prior routes or readable history.

For access, deletion, restriction, or objection, email pulite@proton.me with only the public Puller number or PIP- address and complete verification. Never send private credentials. Where applicable, you may complain to your data protection authority.

Pulite uses TLS. First Pull uses Turnstile and server checks that may refuse or rate-limit duplicates. This affects only a free narrative receipt, not the main experience, and has no legal or similarly significant effect.

PipLine encrypts message text, but Pulite sees delivery metadata. Messages cannot be protected if the code, browser, or either device is compromised. PipLine V1 has no forward secrecy or post-compromise security.

Pulite is intended for ages 16 and older. A receipt found to have been stored contrary to that restriction will be deleted.