Your moments belong to the room.

Who operates Pulse

Pulse is self-hosted software. The person or organization running the Pulse instance at this website is the operator responsible for its use and for responding to privacy requests. If you joined through an event invitation, contact the event host to reach that operator.

Data we process

• Guest participation: the nickname you choose, an event-scoped session identifier, Photo Likes, track votes, music requests, photo submissions, and related timestamps.
• Host accounts: the host email address, a one-way password hash, login sessions, event settings, and moderation or playback actions.
• YouTube data: search terms, video and channel identifiers, titles, thumbnails, duration and availability metadata, playlist identifiers, playlist items, and playback observations.
• YouTube authorization: when a host connects YouTube, Pulse stores the connected channel details, granted scopes, and an encrypted OAuth refresh token so it can manage the selected playlist.
• Photos: the uploaded file, filename, media type, size, associated guest nickname, moderation state, and the identifier assigned by the configured Immich server.
• Technical and security records: necessary cookies, hashed session tokens, service errors, rate-limit records, and audit entries used to operate and protect the event.

How we use data

Data is used only to authenticate hosts, let guests join an event, display and moderate shared photos, search and request YouTube videos, synchronize the event playlist, coordinate playback, prevent abuse, diagnose failures, and maintain the security and reliability of Pulse.

Pulse does not use this data for targeted advertising and does not sell personal data.

YouTube API Services

Pulse uses YouTube API Services to search public videos, retrieve video metadata, play embedded videos, and—with a host's authorization—list and update playlists. YouTube and Google may receive request information such as IP address, device information, account authorization, and interactions with embedded content under the Google Privacy Policy and YouTube Terms of Service.

Hosts can disconnect YouTube inside Pulse and can review or revoke Pulse's Google Account access from their Google Account connections.

Photos and Immich

Guest photos are sent to the Immich server configured by the operator and placed in the album selected for the event. Photos can be held for moderation before appearing to guests or on the wall display. The operator controls that Immich server and its storage location, access rules, backups, and retention.

Cookies and local access

Pulse uses strictly necessary, HTTP-only cookies to maintain host, guest, and wall-display sessions. Guest sessions expire after 24 hours, while host and wall sessions use their configured expiry periods. Pulse does not include advertising cookies or third-party analytics by default.

Retention

Event records, requests, Photo Likes, track votes, playback history, audit entries, and photo references remain until the event host permanently deletes the event. Archiving closes the room but keeps those records so the host can restore it. Pulse does not automatically age-delete event content.

YouTube search results are cached for up to 12 hours, and expired OAuth authorization states and cache entries are removed by the operational cleanup worker. Host, guest, and wall credentials stop working at expiry. After the operator-configured operational grace period, which defaults to 7 days, expired host and wall session rows are removed, guest credential hashes are scrubbed without changing event likes, votes, or attribution, and old playback-deduplication records are removed.

Sharing and service providers

Pulse sends data only to services needed for the features the operator enables: YouTube and Google for video search, metadata, authorization, playlists, and playback; the configured Immich server for photos; and the operator's hosting, database, network, and backup providers. Data may also be disclosed when legally required or necessary to protect users and the service.

Your choices

You may ask the event host or Pulse operator to access, correct, or delete information associated with you. Hosts can archive, restore, or permanently delete events and can disconnect YouTube or revoke Google access. Permanent event deletion removes the related Pulse database records.

During permanent deletion, a host may also request deletion of eligible assets created by Pulse in Immich. This is deliberately conservative: imported photos, duplicate-upload matches, legacy assets with unknown ownership, externally managed or shared-album assets, and assets used by another Pulse event are preserved. The Immich album itself is not deleted, and the operator's Immich trash, backup, and retention settings continue to apply.

Security

Pulse keeps service credentials on the server, hashes session tokens, encrypts stored YouTube refresh tokens, scopes guest access to a single event, validates uploads, and rate-limits sensitive actions. No system can guarantee absolute security, so suspected misuse should be reported promptly to the event host or operator.

Contact

For questions or privacy requests, contact the event host or the person or organization operating this Pulse instance. The operator should provide direct contact details with the event invitation or on the website where Pulse is deployed.

You can also review the Pulse Terms of Service.