The short version
There is no account, no advertising, and no tracking. We do not sell your data, and we never have.
Your native app's logbook lives on your device and, on iOS with sync enabled, in your own private iCloud. Requests send the text or audio needed to answer you. PullSheet Auto verifies trial or subscription access through its dedicated server. Auto temporarily stores background diagnosis requests and results so an answer can finish when the app disconnects and be retrieved without generating it again. The retention periods and limited usage records are described below.
Intent Mesh LLC publishes the PullSheet apps and is responsible for this policy. Questions go to support@intentmesh.dev and a person reads them.
Scope
Which apps this covers
Two generations of PullSheet exist right now, and they are built differently. This policy covers both, and says plainly where they differ.
The native apps
Six iPhone and iPad apps share one engine. They have no PullSheet sign in. Their logbooks stay on the device and in private iCloud when enabled; Auto also uses temporary server storage for background diagnoses, described below.
- PullSheet Elevator
- PullSheet HVAC Pro
- PullSheet Electrical Pro
- PullSheet Plumbing Pro
- PullSheet Auto
- PullSheet EV
Their bundle identifiers are app.pullsheet.fable, app.pullsheet.hvacpro, app.pullsheet.electricalpro, app.pullsheet.plumbingpro, app.pullsheet.auto and app.pullsheet.ev.
This policy also covers the native PullSheet Auto Android app, package app.pullsheet.auto. It has no PullSheet sign in. Android storage, voice and payment differences are described below.
The older PullSheet app
The original PullSheet app, bundle identifier app.pullsheet, version 1.0.x. It is a web app wrapped for the store, it has a sign in, and it does keep data on servers we run. Its section is further down and it is materially different. If you use that app, read that section too.
The native apps
On your device
What stays with you
The logbook is the app's memory of your work, and it is stored on the device itself. Each entry holds the equipment you picked, the symptom you described, the diagnosis that came back, its confidence, the repair steps, the reasoning and breakdown behind it, any meter readings you recorded against a spec, any voice transcript, and the fix you finally wrote down as the resolution.
On iPhone and iPad, if you are signed into iCloud, that same logbook mirrors to the private database of your own iCloud account so it is backed up and shows up on your iPad. It is your Apple account, not ours. We cannot read it, and neither can anyone else you have not shared your Apple account with. With iCloud switched off the app keeps working exactly the same, it just does not sync.
The iOS app also keeps a black box on itself. If it crashes or hangs, iOS hands the app a diagnostic report and the app writes it into its own folder on the device. Nothing about that report is sent anywhere automatically. It sits there until you open Settings, tap Black Box, and choose to export one to us. These local reports are separate from the operational records Auto's server keeps when it handles a request.
On Android, Auto keeps its logbook and pending diagnoses in local app storage. It has no app-managed cloud logbook sync. Android's device transfer and backup services may copy logbook data according to your device and account settings. The new background diagnosis records and their recovery credentials are excluded from device backup. The app does not send them to a Firebase database or an analytics service.
Off the device
What is sent, and to whom
An answer has to be worked out somewhere. Requests go to a Cloudflare Worker we run, which attaches our API key and forwards the request to OpenAI. Newer PullSheet Auto builds use a dedicated server. Earlier Auto releases and the other native apps use the shared proxy described below. The key never sits in the app.
Diagnosis
The symptom text you type or dictate, the equipment you selected, the kind of question you asked, and any meter readings you recorded. That text goes to the proxy and on to OpenAI, which returns the diagnosis. Whatever you type into the symptom box is sent, so keep names, addresses and account numbers out of it. The app does not need them.
Voice
On iPhone and iPad, dictation is transcribed on the device first, using Apple's on-device speech recognition, with no network involved. Only when on-device recognition is unavailable or comes back empty is the recorded audio sent to the proxy and on to OpenAI's Whisper transcription service. The transcript comes back as text and is saved with your logbook entry.
Android Auto uses the device's speech-recognition provider. It requests offline recognition first but can fall back to online recognition, so that provider may receive your audio under its own terms. The app does not save dictation audio files. The resulting transcript is sent with your diagnosis request and saved in the local logbook.
Read aloud
When you have the app read an answer out loud, the text of that answer is sent to the proxy and on to OpenAI's text to speech service, which returns audio the app plays. On Android, playback uses temporary audio files in the app's cache. These are not saved as logbook attachments or uploaded elsewhere.
Auto purchase verification
On iOS, Auto builds using the dedicated server send an Apple-signed purchase transaction when starting an AI request. The server verifies the signature and asks Apple's App Store Server API whether that subscription currently permits access, including an active seven day trial. The proof includes Apple's transaction identifier, the purchased product and subscription dates. It does not give us your Apple account, card number or billing address. Full signed purchase proofs are processed for verification and are not stored or written to our logs.
Android Auto sends a Google Play purchase token to the dedicated server when verifying or restoring a purchase and when starting an AI request. The server asks Google Play for the subscription's current state, product, expiry and test status, and acknowledges eligible purchases. Google Play also sends purchase-change notifications through Google Cloud Pub/Sub so the server can update access and acknowledge purchases when the app is closed. Purchase tokens and complete store responses are processed transiently and excluded from our operational logs. Google Pub/Sub may retain undelivered notification messages for up to three days; successfully acknowledged messages are not retained there.
Once a background diagnosis is accepted, the app uses a random credential specific to that job to retrieve, cancel or acknowledge it, even if the subscription later expires. The credential stays in protected local storage; the server stores only its hash. It cannot authorize a new diagnosis.
Usage counting
Auto counts requests against the verified subscription using Apple's original transaction identifier or a one-way hash of the Google Play purchase token and its related subscription tokens. Changing a device or network does not reset that allowance. The iOS apps also send a random identifier generated on first launch and kept on the device. The shared proxy uses that number and the connection's IP address to count usage for the other native apps; Auto's server does not use that number, and Android Auto does not send one. Cloudflare receives the IP address as part of providing the service. Auto's operational logs do not contain device identifiers, transaction identifiers, purchase-token hashes or IP addresses.
Auto service operation
Auto sends its app version and build number with requests. Its server records the request category, outcome and error category, response time and size, model, whether purchase verification succeeded, and whether the purchase used a production or test store. When OpenAI supplies usage information, the server also records token counts, prompt-cache usage and an estimated processing cost. These fixed fields help us diagnose failed requests, keep the service reliable and understand its cost. We do not collect in-app taps, screens or navigation events.
Retention
What the proxy keeps
Requests are passed to OpenAI to produce an answer. Auto's background diagnosis service temporarily stores request text and results as described below. We do not store dictation or read-aloud audio on our servers. Auto's operational logs exclude prompts, answers, audio, receipts, purchase proofs, transaction and device identifiers, request bodies, and API keys.
PullSheet Auto
Background diagnoses: the server associates a random job identifier with a hash of the verified subscription and temporarily keeps the text needed to generate the answer. This includes symptoms, equipment, instructions, and any context or readings submitted with the request. Queued request text is removed from the active job store before generation starts, or when the queued job is canceled or expires. A queued request expires after 15 minutes. During generation, the request is processed in memory and sent to OpenAI.
The completed result is available for up to 24 hours after the server accepts the job. The app confirms once it has saved the result locally, which deletes the server's active copy sooner. A record containing the job identifier, subscription hash, request fingerprint and processing state remains for up to 48 hours after acceptance to prevent the same job from being charged again. That record contains no symptoms or answer text. Expiry makes content unavailable for retrieval; storage cleanup is scheduled at the expiry time, but a service outage can delay physical deletion.
Cloudflare's recovery backups may retain deleted job data for up to 30 days under its Durable Objects recovery policy. Deleting the app does not immediately delete those backups or a job still processing on the server.
The dedicated server keeps daily and short-term usage counters associated with Apple's transaction identifier or a Google Play purchase-token hash, plus the result and expiry of a recent subscription check. A successful access check is reused for at most one minute before checking with the store again. These counters and short-lived check results enforce usage limits and prevent unauthorized requests. They are scheduled for automatic deletion by daily cleanup within two days.
For Google Play, the server also keeps one-way hashes linking replacement subscription tokens, their production or test environment, and their expiry or supersession bounds. These records prevent a replaced token from restoring access or resetting the usage allowance. They remain through the latest known related subscription expiry plus a one-day grace period, then are removed at the next scheduled daily cleanup. They do not contain the raw purchase token, your Google account or your diagnostic content.
The operational records described above are stored in Cloudflare Workers Logs and expire within seven days, or three days on Cloudflare's Free plan. They are not exported to a separate analytics or crash reporting service. Our verification service does not retain full purchase proofs or the stores' complete subscription responses.
Releases using the shared proxy
The other native apps and earlier Auto releases use a shared proxy, which keeps:
- A number of requests per day, keyed to the random device identifier and the IP address. It expires by itself after 26 hours.
- A daily total of requests and token counts per model, with no device, no identifier, and no content attached. It exists to tell us what the service costs to run, and it expires by itself after 40 days.
OpenAI processes what is forwarded in order to produce the answer, under their own API terms. Content sent through the API is not used to train their models. OpenAI has separate retention rules: its default abuse-monitoring logs may include prompts and responses for up to 30 days, with longer retention in the circumstances described in its API data policy. Their privacy policy is at openai.com/policies/privacy-policy, and Cloudflare's is at cloudflare.com/privacypolicy.
Not collected
What the native apps do not do
- No account, no sign in, no password. There is nothing to create and nothing to close.
- No name, email address, phone number, employer, or union local is asked for or stored.
- No location. The apps never ask for it and never read it.
- No camera and no photo library. The native apps request microphone and notification permissions; iOS also requests speech-recognition permission.
- No contacts, calendar, health, or motion data.
- No advertising identifier, no ad network, no app tracking, no cross app or cross site profile. The apps show no advertising of any kind.
- No in-app advertising or behavior analytics service. Auto's server operational records are held by Cloudflare as described above. The iOS app's own Black Box reports stay on your device until you export them. Separately, Google Play can provide crash and unresponsive-app reports through Android vitals when a user has opted into Google's usage and diagnostics sharing.
Money
Payment goes through your app store
iPhone and iPad subscriptions are sold through Apple's App Store. Android Auto subscriptions are sold through Google Play using its native billing system. We never receive your card number, billing address or store-account login. Each app checks purchases with its platform's store.
On iOS, PullSheet Auto's dedicated server additionally verifies Apple's signed purchase proof and current subscription status before allowing an AI request. An active seven day trial and a paid subscription use the same verification path. No PullSheet account or sign in is required. The other native iOS apps use their existing on-device subscription checks. Apple's handling of your purchase is covered by Apple's privacy policy.
Android Auto uses Google Play directly, without RevenueCat. Its dedicated server verifies an active subscription or eligible trial before allowing AI access. Google determines offer eligibility and shows the purchase terms before payment. Google's handling of purchases, speech services and device backup is covered by Google's privacy policy.
The iOS app can set one local reminder before a free trial converts. It is a notification scheduled on your own device by the app, and nothing about it leaves the phone. Android Auto uses local notifications to tell you when a diagnosis is ready.
Your data, your call
Getting your data out or getting rid of it
See your work: your jobs are in the app's logbook. iOS reports can be exported as a PDF; Android Auto shares reports as plain text through the Android share sheet.
Delete it: deleting the app removes the local copy. If iCloud sync was on, the mirrored copy lives in your own iCloud storage, and iOS Settings, under your name, iCloud, then Manage Account Storage, lets you delete the app's iCloud data.
On Android you can clear the app's storage or uninstall it to remove the local logbook and pending requests. Manage any device backup separately in your Android or Google account settings.
Ask us about server records: we do not keep a server copy of your complete native-app logbook. Auto's temporary background diagnosis data, recovery backups, and limited access, usage and operational records expire separately from your local data as described above. For access or deletion requests, write to support@intentmesh.dev. Operational logs contain no customer or device identifier, so those logs cannot be used to look up a person's diagnostic history.
We do not sell your personal information, and we do not share it for advertising or for anyone else's marketing. Not now, not later.
The older PullSheet app
Bundle app.pullsheet, version 1.0.x
Where that app is different
The original PullSheet app has an account and a server side. Everything in this section applies to that app only, not to the six native apps above.
It has an account
Signing in stores your user id, email address, and display name with Firebase, which is Google's platform. Your profile can also carry your role, union local number, city, state, country, years of experience, and specialties, all of which you choose to enter.
It keeps your diagnostic sessions
Submitting a fix saves the symptom description, the diagnosis, the suggested repairs, the possible causes, and your final resolution to that account so it syncs across your devices.
It can send photos
Images you capture for analysis are sent to OpenAI through the proxy for vision analysis. The resulting text is stored with the session. Voice input in that app is uploaded and transcribed by Whisper, and the transcript is stored with the session.
Some of it is public by design
Forum posts, safety check ins, and leaderboard entries in that app are visible to other users, and can display your name, callsign, and country. Anything you post there, treat as public.
Its subscriptions run through RevenueCat
That app uses RevenueCat to manage in app purchases, so your purchase history and subscription status are shared with them. Payment itself is still billed by the App Store or Google Play. Their policy is at revenuecat.com/privacy, and Firebase's is at firebase.google.com/support/privacy.
Deleting it
You can delete individual logbook entries in the app, and you can delete your account from Settings, which removes your account and profile data. If anything remains that you want gone, write to support@intentmesh.dev and it will be removed.
Rights
What you can ask for
Wherever you live, and whichever app you use, you can ask us what we hold about you, ask for a copy of it, ask us to correct it, and ask us to delete it. Write to support@intentmesh.dev and we will answer within 30 days.
We will never charge you for asking, and we will never treat you differently for having asked. If you are in the European Economic Area or the United Kingdom, our lawful basis is performing the service you asked for, and our legitimate interest in keeping that service running and not being abused.
Children
Not for children
PullSheet is a tool for working tradespeople. It is not directed to children, it is not designed for them, and we do not knowingly collect anything from anyone under 13. If you believe a child has used the app and sent us something, write to support@intentmesh.dev and it will be deleted.
Changes
If this policy changes
When the apps change what they do with data, this page changes with them, and the effective date at the top moves. Continuing to use the apps after that date means the new version applies. We will not quietly start collecting something this page says we do not collect.
Effective 16 September 2026
Talk to a person
Contact
One address, read by a person, for privacy questions, data requests, and anything on this page you think is wrong.
support@intentmesh.dev