Privacy Policy

On your device

What stays with you

The logbook is the app's memory of your work, and it is stored on the device itself. Each entry holds the equipment you picked, the symptom you described, the diagnosis that came back, its confidence, the repair steps, the reasoning and breakdown behind it, any meter readings you recorded against a spec, any voice transcript, and the fix you finally wrote down as the resolution. If you type your name in Settings so it prints on the reports you export, that name stays on the device.

On iPhone and iPad, if you are signed into iCloud, that same logbook mirrors to the private database of your own iCloud account so it is backed up and shows up on your iPad. It is your Apple account, not ours. We cannot read it, and neither can anyone else you have not shared your Apple account with. With iCloud switched off the app keeps working exactly the same, it just does not sync.

The iOS apps and Android Elevator 2.0 also keep a black box on themselves. If the app crashes or hangs, the system hands it a diagnostic report and the app writes it into its own folder on the device. Nothing about that report is sent anywhere automatically unless you turn crash reports on. Otherwise it sits there until you open Settings, tap Black Box, and choose to export it or send it to support. These local reports are separate from the operational records the dedicated servers keep when they handle a request.

Crash reports (PullSheet Elevator for iOS 2.1 and later, off unless you turn them on). The first time the app finds a crash report on your phone it asks once whether to send reports like it, and Settings has a Send Crash Reports switch under the black box that you can change at any time. With it on, each crash or hang report is sent once to our own server for Elevator. What is sent: Apple's diagnostic report for this app (the stack trace, exception type, app version, iOS version and device model that Apple includes), the app's version and build, and this install's random identifier, which is linked to your PullSheet account if you have signed in. It never includes your symptoms, logbook, readings, account details or location. We use these reports only to find and fix crashes, keep them for 90 days, and do not share them. Turning the switch off stops sending; reports already sent are deleted at the end of that period, or sooner if you ask us.

On Android, Auto and Elevator 2.0 keep their logbook and pending diagnoses in local app storage. For Android Auto, Android's device transfer and backup services may copy logbook data according to your device and account settings. Android Elevator 2.0 turns off Android's cloud backup, but moving to a new phone with Android's device to device transfer may still copy its logbook and settings. In both apps, background diagnosis records and their recovery credentials, and in Elevator 2.0 the account sign-in, black box reports and unsent usage records, are kept in storage that is excluded from backup and transfer. Android Auto has no cloud logbook; Android Elevator 2.0 also copies its logbook to our central logbook, described below.

Backed up with us

The central logbook

In PullSheet Elevator 2.0 on iPhone, iPad and Android, every logbook entry is also sent to a central logbook we run in a Cloudflare D1 database. That includes entries you made before this feature arrived, and entries brought over from the older app onto your phone. An entry is sent again whenever it changes. A copy holds the same things as the entry on your device: when it was made, the equipment, the kind of question you asked, the symptom, any voice transcript, the diagnosis, its confidence and reasoning, the repair steps and possible causes, any readings, the narrowing questions and answers, whether and when the job was closed, the fix you wrote, and the job and unit numbers you typed. On iPhone and iPad it also records which kind of analysis produced the answer.

Each copy is filed under a random identifier your phone creates for itself, not your name, together with the platform, the app version and when the entry was last sent. On first use the app also creates a random secret that proves later requests come from the same phone; we store only a one-way hash of it, and we record when that phone was first and last seen and its sharing choice. On iPhone and iPad the identifier is kept in the device's keychain, so it stays the same if you delete and reinstall the app; it does not move to a new phone. If you sign in to a PullSheet account, that phone is linked to your account so your work stays together. The link stays after you sign out, until you delete the account or sign in on that phone with a different one. We use the central logbook to back up your work, to support you, to understand how the product is used, and to improve diagnosis for everyone.

Deleting an entry on your phone does not delete its central copy or its de-identified copy. Write to us to have those deleted, see Getting your data out below.

De-identified diagnosis data. Alongside each entry we keep a separate de-identified copy. Instead of the phone identifier it carries a one-way coded record number, and it leaves out your account, the voice transcript, the reasoning note, the job and unit numbers, and the exact date: it keeps the month the job was started, how many hours it took to close, the platform, and the time the copy was last updated. It automatically replaces the email addresses, phone numbers, street addresses, links, and job, work order, ticket, invoice, unit, car and serial numbers it recognizes in the text. That removal is automatic and pattern based, so it can miss details written in an unusual way, and it does not remove people's or company names; keep those out of what you type. We may share or license this de-identified diagnosis data, for example with equipment makers, service companies or researchers, to improve equipment diagnosis. It is not used to identify you, and we require anyone who receives it not to try. You can turn this off in Settings, under Your Logbook, with Share Diagnosis (called Share Fault Data in earlier app versions). When you turn it off, the app sends your logbook again and we delete the de-identified copies of the entries on your phone and stop making new ones. The central copy of your logbook stays. De-identified data already shared before you turned it off cannot be called back, and entries you had already deleted from your phone keep their de-identified copies until you ask us to delete them.

Cloud logbook entries from the older PullSheet app were moved into the central logbook as part of your account's history, without de-identified copies. If you sign in on Elevator 2.0 and bring those entries onto your phone, they become entries on that phone like any other, including a de-identified copy while Share Diagnosis is on.

The central logbook has no automatic expiry: it is kept until you ask us to delete it. You can ask us for a copy or to delete your central copy at any time, see Getting your data out below.

How the app is used

Usage analytics

PullSheet Elevator 2.0 records how the app is used and sends those records to our own servers on Cloudflare, where they are stored in the same D1 database as the central logbook. We do not use an outside analytics company, an advertising network or an advertising identifier. The other native apps do not send usage records.

What is recorded: the first launch after install, when the app is opened and for how long (sessions), which screens you visit and how long you spend on each, your answers to the app's own prompts (the safety rule, notification, microphone and speech recognition permissions, the microphone explainer, the trial offer, and data sharing), the steps of a diagnosis (asked, answered, failed, asked for a faster answer, narrowed, checks marked, readings recorded, fix logged, exported or read aloud), subscription screens viewed and where they were opened from, plans chosen, trials, purchases with the plan and the price the store showed you, renewals, failed purchases and restores, account sign up, sign in, sign out, passkeys added and account deletion, settings you change (theme, accent, text size, glove mode, sounds and data sharing), logbook entries opened, widgets, shortcuts and notifications you open, and short codes for errors you saw. With a diagnosis we record only the equipment type you picked, the kind of question, whether you used voice, how long the answer took and its confidence level; with a logged fix, only whether a job or unit number was filled in, never the number. Each record carries the time, a random session number, the platform, the app version, the operating system version and the device model (on iPhone and iPad the model code, on Android the model name the manufacturer gives the phone).

What is not recorded in usage analytics: the words you type or dictate, the answers themselves, names, email addresses, job or unit numbers, your location, or your contacts. On iPhone and iPad every record is checked against a fixed list of events and values before it is stored, and on both platforms the app passes only fixed codes, choices you picked, counts and on or off values. Those parts of your work are handled only as described under The central logbook.

Records wait on the phone until they are sent in batches, and are filed under the random identifier your phone creates for itself, described under The central logbook. When that phone is linked to a PullSheet account, our server also files them under the account. We use them to understand what works and what does not, to fix problems, to measure how many people use the app and for how long, and to improve the product. We read them through a private dashboard protected by a key only we hold; it shows totals, trends and a feed of recent events, not the phone identifier or account.

Some moments notify us as they happen, through a Telegram bot that messages only us: a new subscription (with the plan and price), a started trial (with the plan), a new PullSheet account (with the sign-in method used), and a restored purchase, each with whether it happened on iPhone or Android. Once a day the same bot sends us a summary of totals, such as active users, new installs, sessions, and how many people asked, got answers, started trials and paid. These messages carry no identifier, name, email address or diagnostic content, and Telegram handles them under its own privacy policy. We do not sell usage records and we do not use them for advertising.

Usage records are kept for up to 25 months and then deleted. You can ask us to delete yours at any time, see Getting your data out below.

Off the device

What is sent, and to whom

An answer has to be worked out somewhere. Requests go to a Cloudflare Worker we run, which attaches our API key and forwards the request to OpenAI. PullSheet Auto, HVAC Pro, Electrical Pro, Plumbing Pro, EV and Elevator 2.0 each use a dedicated server of their own (HVAC Pro, Electrical Pro, Plumbing Pro and EV from their first App Store release). Earlier Auto releases, test builds of those four made before that release, and PullSheet Elevator under app.pullsheet.fable use the shared proxy described below. The key never sits in the app.

Retention

What the proxy keeps

Requests are passed to OpenAI to produce an answer. The dedicated background diagnosis services temporarily store request text and results as described below. We do not store dictation or read-aloud audio on our servers. The dedicated services' operational logs exclude prompts, answers, audio, receipts, purchase proofs, transaction and device identifiers, request bodies, and API keys.

Apps using a dedicated server

Background diagnoses: the server associates a random job identifier with a hash of the verified subscription and temporarily keeps the text needed to generate the answer. This includes symptoms, equipment, instructions, and any context or readings submitted with the request. Queued request text is removed from the active job store before generation starts, or when the queued job is canceled or expires. A queued request expires after 15 minutes. During generation, the request is processed in memory and sent to OpenAI.

The completed result is available for up to 24 hours after the server accepts the job. The app confirms once it has saved the result locally, which deletes the server's active copy sooner. A record containing the job identifier, subscription hash, request fingerprint and processing state remains for up to 48 hours after acceptance to prevent the same job from being charged again. That record contains no symptoms or answer text. Expiry makes content unavailable for retrieval; storage cleanup is scheduled at the expiry time, but a service outage can delay physical deletion.

Cloudflare's recovery backups may retain deleted job data for up to 30 days under its Durable Objects recovery policy. Deleting the app does not immediately delete those backups or a job still processing on the server.

The dedicated server keeps daily and short-term usage counters associated with Apple's transaction identifier, a PullSheet account identifier (or, for app versions from before the move, the older account's identifier), a Google Play purchase-token hash, or an Amazon app user identifier hash, plus the result and expiry of a recent subscription check. A successful Apple or Amazon check is reused for at most one minute and a successful Google Play check for at most ten minutes before checking with the store again; access carried on a PullSheet account is checked against the account on every request. These counters and short-lived check results enforce usage limits and prevent unauthorized requests. They are scheduled for automatic deletion by daily cleanup within two days.

For Google Play, the server also keeps one-way hashes linking replacement subscription tokens, their production or test environment, and their expiry or supersession bounds. These records prevent a replaced token from restoring access or resetting the usage allowance. They remain through the latest known related subscription expiry plus a one-day grace period, then are removed at the next scheduled daily cleanup. They do not contain the raw purchase token, your Google account or your diagnostic content.

The operational records described above are stored in Cloudflare Workers Logs and expire within seven days, or three days on Cloudflare's Free plan. They are not exported to a separate analytics or crash reporting service; crash reports you choose to send are kept by our own server for 90 days, as described above. We do not retain the stores' complete subscription responses. Purchase identifiers and tokens linked to a PullSheet account are retained as described below; otherwise verification processes them transiently.

Releases using the shared proxy

Native releases without a dedicated service use a shared proxy, which keeps:

• A number of requests per day, keyed to the random device identifier and the IP address. It expires by itself after 26 hours.
• A daily total of requests and token counts per model, with no device, no identifier, and no content attached. It exists to tell us what the service costs to run, and it expires by itself after 40 days.

OpenAI processes what is forwarded in order to produce the answer, under their own API terms. Content sent through the API is not used to train their models. OpenAI has separate retention rules: its default abuse-monitoring logs may include prompts and responses for up to 30 days, with longer retention in the circumstances described in its API data policy. Their privacy policy is at openai.com/policies/privacy-policy, and Cloudflare's is at cloudflare.com/privacypolicy.

Not collected

What the native apps do not do

• No account is required for a native app store subscription. PullSheet Elevator 2.0 offers an optional PullSheet account, described below.
• Except for the optional PullSheet account, the native apps do not ask for an email address, phone number, employer, or union local. The only name they ask for is the optional one printed on your exported reports, and it stays on your device.
• No location. The apps never ask for it and never read it.
• No camera and no photo library. The native apps request microphone and notification permissions; iOS also requests speech-recognition permission.
• No contacts, calendar, health, or motion data.
• No advertising identifier, no ad network, no app tracking, no cross app or cross site profile. The apps show no advertising of any kind.
• No outside analytics or advertising company. PullSheet Elevator 2.0's usage analytics, described above, go only to our own servers, and the moments we are notified about reach us through Telegram as described above. Black Box reports stay on your device until you export them or, in PullSheet Elevator for iOS, turn on Send Crash Reports, which sends them only to our own server. Separately, Google Play can provide crash and unresponsive-app reports through Android vitals when a user has opted into Google's usage and diagnostics sharing.

Money

Payment goes through your app store

iPhone and iPad subscriptions are sold through Apple's App Store. Android versions distributed through Google Play use Google Play billing. PullSheet Elevator 2.0 distributed through Amazon Appstore uses Amazon In-App Purchasing. We never receive your card number, billing address or store-account login. Each app checks purchases with its platform's store.

On iOS, the dedicated servers of Auto, HVAC Pro, Electrical Pro, Plumbing Pro, EV and Elevator 2.0 additionally verify Apple's signed purchase proof and current subscription status before allowing an AI request. An active seven day trial and a paid subscription use the same verification path. No PullSheet account or sign in is required; in Elevator 2.0, an optional account can carry verified subscription access between platforms. PullSheet Elevator under app.pullsheet.fable uses its existing on-device subscription check. Apple's handling of your purchase is covered by Apple's privacy policy.

The Google Play versions of Android Auto and Android Elevator 2.0 use Google Play directly, without RevenueCat. Their dedicated server verifies an active subscription or eligible trial before allowing AI access. Google determines offer eligibility and shows the purchase terms before payment. Google's handling of purchases, speech services and device backup is covered by Google's privacy policy.

Amazon determines offer eligibility, presents the purchase terms and handles billing for Amazon Appstore subscriptions. Amazon's handling of account and purchase information is described in its Privacy Notice.

The iOS apps can set one local reminder before a free trial converts. The apps also use local notifications to tell you when a diagnosis is ready, and the iOS apps and Android Elevator 2.0 can send one morning reminder about a job from an earlier day that has no fix logged. These notifications are scheduled on your own device by the app, and their contents never leave the phone. In Elevator 2.0, opening one is recorded in usage analytics as which kind of notification it was.

Your data, your call

Getting your data out or getting rid of it

See your work: your jobs are in the app's logbook. iOS and Android Elevator 2.0 reports can be exported as a PDF; Android Auto shares reports as plain text through the Android share sheet.

Delete it: deleting the app removes the local copy, but not the central logbook copy or usage records in Elevator 2.0; ask us to delete those, as below. On iPhone and iPad the random identifier described under The central logbook stays in the device's keychain after the app is deleted. If iCloud sync was on, the mirrored copy lives in your own iCloud storage, and iOS Settings, under your name, iCloud, then Manage Account Storage, lets you delete the app's iCloud data.

On Android you can clear the app's storage or uninstall it to remove the local logbook and pending requests. Manage any device backup separately in your Android or Google account settings.

Ask us about server records: PullSheet Elevator 2.0 keeps a central copy of your logbook and usage records, described above, and we will send you a copy of them or delete them on request, including the logbook's de-identified copies. We find them through your PullSheet account. Records from a phone that was never signed in are filed only under that phone's random identifier, which the app does not currently show you, so without an account we may not be able to tell which records are yours. Deleting your PullSheet account in the app unlinks your phones and logbook entries from you, as described below; write to us if you also want the entries themselves deleted. The dedicated services' temporary background diagnosis data, recovery backups, and limited access, usage and operational records expire separately from your local data as described above. For access or deletion requests, write to support@intentmesh.dev. Operational logs contain no customer or device identifier, so those logs cannot be used to look up a person's diagnostic history.

We do not sell information that identifies you, and we do not share it for advertising or for anyone else's marketing. The only logbook data we share is the de-identified diagnosis data described above, which you can turn off.

Optional

PullSheet accounts

In PullSheet Elevator 2.0 you can create a PullSheet account with Sign in with Apple, Google, or an email address and password. Apple and Google handle their own sign-in screens under their own privacy policies and give us a signed confirmation of who signed in. Once signed in you can add a passkey and use it to sign in after that. An account is optional; the app works fully without one.

We run accounts ourselves, in the same Cloudflare D1 database. For an account we keep a random account number, your email address, your name if you type it or the sign-in method provides it, the identifier Apple or Google gives us for your sign-in and the email address it came with, your password only as a salted one-way hash, the public half of any passkey (the private half never leaves your device or password manager) with the name you give it and when it was added and last used, when the account was created and last signed in, and any subscription access carried over from the older app. Signed-in phones hold a session credential; we store only its hash, with the phone it was issued to and when it expires, 180 days after sign in. Expired sessions are deleted by a daily cleanup. To slow down password guessing, we count sign-up and sign-in attempts for each email address in 15 minute windows; those counts are deleted by the same daily cleanup once their window ends. The phone you sign in on is linked to your account so your central logbook entries and usage records are kept together.

When you sign in with an active store subscription, the app can link it to your PullSheet account so verified Pro access works across platforms. We keep the store provider, a purchase reference, the last verified access end, and when the link was created and checked. To recheck the purchase, we retain an Apple original transaction identifier and environment, a Google Play purchase token, or the Amazon app user identifier and receipt identifier, as applicable. These links are held in our Cloudflare D1 account database until you delete the account or ask us to remove the link. They are excluded from operational logs. Amazon links are rechecked when used after one minute; an outage can preserve only the last verified access lease, which lasts no more than one hour. Deleting an account removes its store links but does not cancel the store subscription.

Accounts from the older PullSheet app were moved to this service in September 2026 with their existing password hashes, so existing customers sign in with the same email and password. The first time you do, your password is re-saved in our own hashed format. The older account system on Google Firebase is being shut down once the move is complete.

Account-based subscription access from the older app is checked against your PullSheet account. App versions released before the move still check an older account sign-in with Google's Firebase service, which then reads that account's subscription record. Your existing billing provider remains responsible for your subscription.

Deleting your account: Settings, Account, Delete Account erases the account's email address, name and password, removes its Apple and Google sign-ins, passkeys and sessions, and unlinks your phones and logbook entries from you. What remains is a closed record holding only the random account number, its dates and any carried-over subscription dates. Usage records made while you were signed in keep that random account number, which no longer leads to you. It does not cancel an App Store, Google Play or Amazon Appstore subscription; cancel that in the store. To also delete the central logbook entries, write to support@intentmesh.dev.

Bundle app.pullsheet, version 1.0.x

Where that app is different

The original PullSheet app has an account and a server side. This section describes version 1.0.x. Its accounts, subscription records and cloud logbook entries have moved to PullSheet's own service on Cloudflare, described above. From an account, only the email address, name, password hash and subscription dates moved; the profile details described below did not. The copies on Google Firebase, including any profile details you entered in that app, will be deleted when the older app is retired.

It has an account

Signing in stores your user id, email address, and display name with Firebase, which is Google's platform. Your profile can also carry your role, union local number, city, state, country, years of experience, and specialties, all of which you choose to enter.

It keeps your diagnostic sessions

Submitting a fix saves the symptom description, the diagnosis, the suggested repairs, the possible causes, and your final resolution to that account so it syncs across your devices.

It can send photos

Images you capture for analysis are sent to OpenAI through the proxy for vision analysis. The resulting text is stored with the session. Voice input in that app is uploaded and transcribed by Whisper, and the transcript is stored with the session.

Some of it is public by design

Forum posts, safety check ins, and leaderboard entries in that app are visible to other users, and can display your name, callsign, and country. Anything you post there, treat as public.

Its subscriptions run through RevenueCat

That app uses RevenueCat to manage in app purchases, so your purchase history and subscription status are shared with them. Payment itself is still billed by the App Store or Google Play. Their policy is at revenuecat.com/privacy, and Firebase's is at firebase.google.com/support/privacy.

Deleting it

You can delete individual logbook entries in the app, and you can delete your account from Settings, which removes your account and profile data. If anything remains that you want gone, write to support@intentmesh.dev and it will be removed.

Rights

What you can ask for

Wherever you live, and whichever app you use, you can ask us what we hold about you, ask for a copy of it, ask us to correct it, and ask us to delete it. Write to support@intentmesh.dev and we will answer within 30 days.

We will never charge you for asking, and we will never treat you differently for having asked. If you are in the European Economic Area or the United Kingdom, our lawful basis is performing the service you asked for, and our legitimate interest in keeping that service running and not being abused.

Children

Not for children

PullSheet is a tool for working tradespeople. It is not directed to children, it is not designed for them, and we do not knowingly collect anything from anyone under 13. If you believe a child has used the app and sent us something, write to support@intentmesh.dev and it will be deleted.

Changes

If this policy changes

When the apps change what they do with data, this page changes with them, and the effective date at the top moves. Continuing to use the apps after that date means the new version applies. We will not quietly start collecting something this page says we do not collect.

Effective 12 October 2026

Talk to a person

Contact

One address, read by a person, for privacy questions, data requests, and anything on this page you think is wrong.