pulse_
home
// privacy

Privacy & Data Collection

Pulse is a Real-User Monitoring tool. To benchmark performance, the SDK reads coarse hardware and browser hints from the visitor's environment. This page documents every signal we collect and lets you opt out for this browser.

Capture is ON for this browser

Stored locally as pulse:opt-out. Do-Not-Track requests are honored automatically.

What the SDK collects automatically

Captured once per session via standard Web APIs — no permission prompts, no native access.

CPU cores (logical)
navigator.hardwareConcurrency

Number of logical processors. Indicates parallelism — but not clock speed or model.

Device memory (GB, bucketed)
navigator.deviceMemory

Approximate RAM in coarse buckets (0.25, 0.5, 1, 2, 4, 8). Capped at 8 GB by browsers to limit fingerprinting.

GPU
WebGL WEBGL_debug_renderer_info

Vendor + renderer string from WebGL. Often masked or generic in privacy-focused browsers.

Network
navigator.connection

Effective connection type (4g/3g/2g), downlink (Mbps), RTT (ms), and saveData hint.

Browser brands + version
navigator.userAgentData

Structured list of browser brands from User-Agent Client Hints (e.g. Chromium 130, Google Chrome 130).

Operating system
userAgentData.platform / navigator.platform

OS name (e.g. macOS, Windows). Build number is not available.

Mobile device
userAgentData.mobile

Whether the browser self-identifies as a mobile build.

Touch input
navigator.maxTouchPoints

Whether the device exposes any touch points.

Pixel ratio (DPR)
window.devicePixelRatio

Hardware pixels per CSS pixel. Hints at HiDPI/Retina displays.

Language
navigator.language

User's preferred UI language. Useful for regional performance comparison.

Time zone
Intl.DateTimeFormat().resolvedOptions().timeZone

IANA time zone name. Coarser than IP-based geolocation.

User-Agent (full string)
navigator.userAgent

Full UA header. Browsers are gradually freezing this — UA Client Hints (above) are preferred when available.

What Pulse does not collect

  • CPU model name, clock speed, or temperature
  • Disk size, free space, or volume names (only origin storage quota, and only if explicitly requested)
  • GPU memory size or live VRAM usage
  • IP address (we strip it; only your origin keeps it for routing)
  • Cookies, form values, keystrokes, mouse paths, or page contents
  • Process list, installed apps, MAC address, or any OS-native identifiers
  • WebSocket payloads — only frame size, direction, channel name, and main-thread handler time are stored. The message body is never read.
  • API request or response bodies — only URL, method, status, and timing.

Network & rendering signals

Powers the APIs, Websockets and Rendering tabs in your dashboard.

  • HTTP requests — URL (path + query), method, status, duration, transferSize. Request/response bodies are never collected.
  • WebSocket frames — channel name, direction (in/out), byte length, and main-thread handler ms. Payload contents are never read.
  • Long tasks — start time and duration of any main-thread task > 50ms (PerformanceObserver longtask entries).
  • JS errors — message, stack, and source URL. Lightly redacted — query strings on URLs are kept for debugging but no cookies/headers.

Optional: Chrome extension power signals

The Pulse Chrome extension can additionally sample live CPU load and free RAM during a capture session. This requires explicit consent in the extension popup and the system.cpu /system.memory permissions. Sampling is off by default.

  • Captured at most once every 5 seconds while the tab is in focus.
  • Stored as system-sample events tied to the active session.
  • You can revoke at any time from the extension popup or by removing the optional permissions in chrome://extensions.

Where the data goes

  • Sent to /api/public/ingest on this domain (or your self-hosted Pulse instance).
  • Stored in a per-project database row, readable only by the project owner under Row-Level Security.
  • No third-party analytics SDKs are loaded by Pulse itself.
Glossaryweb.dev/vitals ↗