Privacy and Personal Data Policy

1. Scope and principles

This Policy describes how personal data is handled when you visit tumanovnv.github.io/impuls or use the Impuls macOS application. For processing governed by Russian law, the source policy is prepared with Federal Law No. 152-FZ on Personal Data in mind, including the requirement to publish a controller policy.

This Policy is not itself consent to processing. Where consent is required, it is requested separately before the relevant processing begins. Optional version statistics are disabled until the user enables them.

The operator follows principles of lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation and confidentiality.

2. Controller and privacy contact

You may initiate a privacy request through the project’s GitHub repository. GitHub Issues are public: do not post passport or identity-document data, home address, phone number, email address, installation identifier or other confidential information. If identity verification or additional information is required, the operator will arrange a private channel with the requester.

No separate DPO is presented for the project; privacy requests are handled by the operator.

3. Data we process

Impuls is not designed to collect special-category or biometric personal data. Do not submit such information through public GitHub Issues.

4. Purposes and legal bases

4.1. Website, downloads and updates

The purpose is to provide product information, the application file, integrity information and an update channel. Network requests to GitHub are technically served by GitHub infrastructure under GitHub’s own rules. Impuls does not add clipboard contents, notes, calendar content or hardware identifiers to those requests.

4.2. Optional version statistics

The purpose is to estimate opted-in active installations, version distribution and real version transitions so support can be planned. Under the Russian-law source policy, the basis is separate user consent. Disabling the setting stops future statistics requests.

4.3. Feedback and support

The purpose is to investigate a problem or suggestion voluntarily submitted by the user through GitHub. The user sees and can edit the complete text before publication. Public submission is also governed by GitHub’s terms and privacy statement.

5. Retention, localisation and security

• The Impuls website does not create its own visitor database and does not set its own analytics or advertising cookies.
• The first-party statistics database stores only the installation HMAC, first/last seen dates, current version and an available previous version. The raw UUID, IP address and User-Agent are not stored as product analytics fields.
• Statistics records are removed after 365 days without a heartbeat.
• Access to the statistics database is limited to the operator; the administrative view uses aggregated figures.
• Where Russian personal-data localisation requirements apply to data of Russian citizens, initial recording and storage are performed using databases located in the Russian Federation.

The operator uses reasonable legal, organisational and technical measures proportionate to the current processing. Local Impuls data is protected by macOS controls and, where the product provides it, additional local encryption.

6. External services and international processing

The website, releases and public feedback are hosted on GitHub. GitHub processes connections to its infrastructure under its own General Privacy Statement, and its infrastructure may operate in multiple countries.

The in-app web player opens the official site of the service selected by the user — Yandex Music, VK Music or YouTube Music — only after the explicit “Open Web Player” action. That service independently determines how data is processed inside its web interface.

CloudTips and Boosty are external services for voluntary development support. Only after the user explicitly chooses a provider does Impuls open that provider's fixed page in the system browser. The external service processes data entered on its page under its own terms and privacy policy. Impuls receives no card or other payment credentials, amount, payment result or account state.

When the operator itself performs a cross-border transfer governed by Russian law, the requirements of Article 12 of Federal Law No. 152-FZ apply, including prior notification to Roskomnadzor where required. No new external tracker, hosted form or advertising pixel should be introduced without revisiting this Policy and the applicable legal requirements.

7. Your rights

Where Russian data-protection law applies, a data subject may request information about processing, correction, blocking or deletion where provided by law, withdraw consent and complain to Roskomnadzor or a court.

To locate an optional version-statistics record, the local installation identifier may be needed because the operator does not hold a name, email address or Apple ID that could otherwise identify the pseudonymous record.

Future statistics can be disabled under Settings → Data and Privacy. Removing the local UUID from macOS Keychain is not a substitute for a request to erase an already stored HMAC if such a request is needed.

8. International users and translations

The Russian page at /privacy/ is the operator’s source policy. This translation is provided for clear communication. It does not reduce mandatory privacy rights available under law that applies to you. If a mandatory local rule conflicts with this translation, that mandatory rule controls to the extent it applies.

8.1. If the GDPR applies

The GDPR can apply to a controller outside the EU where processing relates to offering goods or services to people in the EU. For optional version statistics, the operator relies on the user’s consent under Article 6(1)(a) GDPR; consent may be withdrawn for future processing. Support requests voluntarily initiated by the user are processed to respond to the request and for the project’s legitimate interests in product support and security, subject to the user’s applicable rights.

Where the GDPR applies, you may have rights to information, access, rectification, erasure, restriction, data portability and objection in the circumstances provided by the GDPR, and the right to complain to a competent data-protection authority. Impuls does not use operator-held data for advertising, does not build marketing profiles and does not make decisions producing legal or similarly significant effects solely by automated processing.

This notice is not a certification or claim of universal compliance with every jurisdiction. It describes Impuls’s actual data flows and recognises additional mandatory rights where applicable law provides them.

9. Changes and reference documents

The operator reviews this Policy when data categories, purposes, services, architecture or applicable law change. A new revision takes effect on the date shown at the top of the page.

• Russian Federal Law No. 152-FZ on Personal Data — official legal source;
• Roskomnadzor information on cross-border personal-data transfers;
• Regulation (EU) 2016/679 (GDPR) and the European Commission overview of individual rights;
• GitHub General Privacy Statement;
• Impuls technical privacy model and security policy.