Proof, not a profile

For twenty years the location economy has run on a guess. Brokers watch billions of anonymized dots move around, and from the patterns they infer you — model where you live, attribute an audience, extrapolate from who they saw to who you probably are. They never actually know you; they estimate you, at scale. And the consent for it is laundered: collected nominally somewhere upstream, then de-identified, aggregated, brokered, and resold until “privacy compliant” is something companies settle between themselves — you were never a party to it, and you never had a live choice.

Pulse is the inversion of that. It replaces the guess with proof, and it puts the choice back in your hands. Two moves, and they’re the whole thing:

• Probabilistic → deterministic. Not “this dot is probably a real person.” A specific device, tied by its own security hardware to a confirmed identity — a passport chip, a face, a carrier — whose physical presence must agree with the real world, on a thread that never breaks. The world corroborates it or it doesn’t. That’s a fact, not a likelihood.
• Consent-laundering → agency. Your journey never leaves your phone. You hold your own places, name them yourself, and only a verdict ever leaves — on your say-so, listed in your ledger, erasable everywhere. You’re the person deciding, not the product being sold.

Proof, not a profile. Held by you, not brokered about you.

The core: where you put your feet

Where people put their feet tells the truth about who they are.

A real life has a shape: two centers — home and work — and a couple dozen satellites where you shop, eat, work out, worship, study, and see the people you love. Find that shape and you’ve found the person. And you find it the honest way, the way this has always worked: frequency and dwell time — how often you’re somewhere, and how long you stay. Cluster that, and Home and Work fall right out; the satellites follow.

This is the skeleton of a life, and it’s computed entirely on your phone. But on its own, frequency and dwell time is exactly what a broker has — and it’s guessable and fakeable. Anyone can model a pattern or fabricate “this dot was Home two hundred times.” Clustering pings is still a guess.

The truth layer: the sensors certify it

Here’s what turns the guess into proof: every visit carries physics. When your phone is really at a place, the air pressure it feels, the magnetic field it reads, the way it’s moving — all of it has to agree with the independent truth of that exact place and time (the weather overhead, the geomagnetic field of that spot, the network it arrived on). A phone on a rack in a data center can’t manufacture that. A spoofer can’t manufacture it two hundred times.

So the sensors don’t sit off to the side as a separate check — they certify the clustering. They turn claimed frequency-and-dwell into proven frequency-and-dwell. Where you cohere (the anchors) × proof each visit was real (the sensors) = deterministic proof of a life. That’s the difference between a profile a broker assembles about you, and proof your own phone can stand behind.

How a single visit is checked, sensor by sensor: the phone reads the world (pressure, field, position, motion), fetches what the world independently says should be true there, lines them up into one coherent read, and — vouched for by the phone’s own security hardware — seals a small, self-contained record. On our side we re-derive the same references and confirm the story reproduces. The phone’s word is cross-examined, never taken on faith.

The score: strong in three days, stronger for life

The output isn’t your raw life — it’s a score: how strongly this collection of signals coheres, over time, into one real person.

• Day zero — confirming who you are (passport + face + carrier) sets the identity root.
• ~Three days — frequency and dwell lock in Home and Work, each visit sensor-corroborated. The score is already strong — fast enough to be useful almost immediately, and earned, not assumed.
• Over time — the satellites accrue toward the full shape of your life, the history deepens, the routes between places settle. The score gets stronger, and more defensible.

And because it’s built from parts, it decomposes: a decision comes with its reasons — “strong: home and work established, arrivals corroborated” or “needs another look: this place has no history and fits no route.” Answers you can stand behind.

Movement that makes sense

Anchors also make travel legible. Home → gym → work is the normal pattern. Seattle → New York is perfectly coherent if you have anchors in both, or the time between fits a flight; it’s only worth a second look when a place has zero history and fits no route. The skeleton is what lets “this doesn’t fit any journey” be a reason instead of a hunch.

Accuracy vs. precision — and why your exact location never leaves

These get confused, and the difference is the whole privacy design. Accuracy is “is the phone really there?” Precision is how finely you describe it — the corner of 42nd & Lexington, or Midtown, or New York City, or New York State. All accurate; wildly different precision.

Pulse keeps accuracy high on your phone — it needs your exact position to check the physics well — and lets only low precision leave: a coarse ~11 km area, enough to look up the weather and the field, never your exact spot. High accuracy, low egress-precision. Your location stays yours; only “does it add up” travels.

Where your data lives — the three tiers

The line between Tier 1 and everything else is the deterministic-with-agency promise made literal. The journey — where you go, what you call those places, the map of your life — never leaves the phone. What can cross into your own server-side custody is the self-contained evidence to check a moment. What ever reaches a service is a judgment on the shape — this coheres to a real, continuous life — never the shape itself.

What an institution gets — and can defend

An institution decides yes or no on the score, and gets enough to defend it in an audit — but what it’s defending is the coherence of a journey, not a dossier. A fabricated identity can be modeled to look real; it cannot be confirmed and corroborated live across days of real presence. Deterministic means the yes/no is trustworthy; agency means the person’s life stays private and their consent is real — the only acceptable posture for a program serving citizens.

What this is — and what it isn’t

This makes remote, at-scale fraud impractical: to get past it you’d have to be a real person, with a real phone, actually living a real, coherent life in real places over real time. New users and new devices start thin, and are treated gently, not suspiciously — anchors strengthen a score; their absence on day one is never a red flag. No single layer is unbreakable; the strength is that they’re anchored to the phone’s security hardware, corroborated by independent references, and read together, over time — not trusted one snapshot at a time.

Background: the journey of a blue dot

The method underneath this is old and proven. In out-of-home measurement, a “blue dot” is a person’s device moving through a day — home, work, shop, play, drive, home — and you learn the real world by correlating those journeys against ground truth: toll booths and traffic counters that count everyone, turning observation into certainty. Pulse takes that machinery and turns it inside out: instead of observing billions of dots for advertisers, it keeps the journey of your one dot entirely on your device, corroborates it against the ground truth of physics, and lets only a verdict leave. The guess becomes proof; the watching becomes yours.