Each heartbeat ejects ~70 ml of blood at high pressure. Newton's third law: your body recoils slightly with each beat. The phone accelerometer can detect this recoil (~0.01–0.05 m/s²) when held still against your torso. We bandpass-filter the signal to 0.7–4 Hz (covers 42–240 BPM) to isolate cardiac motion from breathing (slower) and tremor (faster), then detect peaks.
This will NOT work if you're sitting up, walking, or holding the phone in your hand at arm's length. The signal is below the noise floor of most everyday motion.