Last updated: September 15, 2026 (version 1.1 of the App)

Punch List AI ("we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use the Punch List AI mobile application (the "App"), published by Nice Express.

1. Information We Collect

Punch List AI is designed to minimize the data we collect. There is no account to create and we never see your name, email address or payment details. The App handles your information in four places, described below.

Information stored on your device

The following information is stored in a private database on your device:

  • Project information you create (project name, site address, client and inspector details, references, dates)
  • Issue records you create (titles, descriptions, recommendations, severity, priority, status, tags, due dates, location)
  • Photos you capture or import for inspection purposes, and the markup you draw on them
  • Generated PDF reports
  • Application settings (theme preference, custom logo, company name)

We do not have access to this database. It is not transmitted to any server we operate.

Information synced to your private iCloud

If you are signed in to iCloud, the App keeps the information above in sync between your iPhone and iPad through Apple's CloudKit service, in the private iCloud database of your own Apple ID. This includes your projects, issues, photos, markup and reports, so that they survive a new device or a reinstall.

Only you can read this data. We, as the developer, cannot access your private iCloud database, and Apple processes it under the Apple Privacy Policy and your iCloud terms. Photos count against your iCloud storage. You can stop the sync at any time by signing out of iCloud in the iOS Settings app; the App then keeps working locally. Settings in the App show the sync status and the last error, if any.

Information sent to Anthropic for AI analysis

When you choose to analyze a photo using the AI feature, the App transmits to Anthropic, PBC ("Anthropic"), through their Claude API:

  • The photo you selected, resized for analysis
  • A short context to make the draft more accurate: the project name, the site address if you entered one, and the titles of up to five recent issues on that project
  • A system prompt describing the task

Anthropic processes this to draft a description, a severity, a category and a recommendation. The draft is shown to you in the App; you review it, keep it or rewrite it, and only your final text goes on your reports. According to Anthropic's published policies, content sent through their API is not used to train their models. Anthropic's data retention is governed by their commercial terms.

The AI Insights feature (Pro) sends Anthropic an aggregated, numerical summary of your issues (counts by severity, category and status, and the most frequent locations and issue titles). It does not send photos.

AI analysis is never automatic: nothing is sent unless you tap Analyze or open Insights.

Information handled by our relay

Requests to Anthropic do not carry an API key inside the App. Instead they pass through a relay service that we operate on Cloudflare Workers. The relay:

  • Receives your request (photo, context and prompt), forwards it to Anthropic and returns the answer. It does not store the photo, the context or the answer.
  • Verifies, using Apple's App Attest, that the request comes from a genuine copy of the App on a genuine Apple device. To do this it keeps, per installation, a key identifier and a public key generated by your device, and a counter of the day's requests. These values are generated by Apple's DeviceCheck framework; they are not your device's advertising identifier, are not linked to your name, email or Apple ID, and cannot be used to identify you across other apps or websites.
  • Applies a daily limit of AI analyses per installation to prevent abuse.

Cloudflare, Inc. hosts the relay and, like any internet service, sees the network address of your device while a request is in flight. Cloudflare does not receive the content of your request other than to route it, and processes it under the Cloudflare Privacy Policy.

Subscription information

Subscriptions are managed by Apple Inc. through the App Store. We do not receive your payment information, billing details, or Apple ID. Apple provides us only with anonymous transaction confirmations to validate your subscription status. See Apple's Privacy Policy for how Apple handles this data.

2. Information We Do Not Collect

Punch List AI does not collect, track, or process:

  • Your name, email address, or phone number (no account is required to use the App)
  • Your precise or approximate location from the device's location services
  • Your contacts, calendars, or browser history
  • Analytics, telemetry, or crash reports: no usage data leaves your device, and the App contains no third-party analytics or advertising SDK
  • Advertising identifiers
  • Health, fitness, or financial information

The App does not track you across other companies' apps or websites.

3. How We Use Your Information

The information described above is used solely to:

  • Provide the App's functionality (manage projects, capture issues, generate reports)
  • Keep your data in sync between your own devices through your private iCloud
  • Draft issue descriptions and recommendations via Anthropic when you initiate an AI analysis, and produce AI Insights when you open them
  • Verify that AI requests come from the genuine App and enforce a fair daily limit
  • Maintain your subscription status

We do not sell, rent, or share your data with any third party for marketing or advertising purposes.

4. Permissions Requested by the App

To function, Punch List AI requests the following permissions:

  • Camera — to capture photos of construction defects
  • Photo Library — to import existing site photos
  • Microphone and Speech Recognition — to dictate notes hands-free; speech is processed by Apple's speech recognition, and the resulting text stays in your issue notes
  • iCloud — to sync your data between your devices through your private iCloud database

Each permission is requested when the corresponding feature is first used and can be revoked at any time in the iOS Settings app.

5. Data Security

Your data is protected by iOS data protection on your device and by Apple's encryption in transit and at rest in iCloud. Requests to our relay and to Anthropic use HTTPS. The relay authenticates each request with a cryptographic signature produced by your device's Secure Enclave, so a request cannot be forged or replayed, and the credentials used to reach Anthropic never leave our server.

6. Your Rights

Because your data lives on your devices and in your own iCloud account, you are in control of it:

  • Access and export: generate a PDF report at any time; your photos and notes are visible in the App
  • Deletion: delete any project or issue in the App, or use "Delete All Data" in Settings. Deleting the App removes the local database; data synced to iCloud is removed when you delete it in the App while signed in, or through iCloud settings
  • Stop the sync: sign out of iCloud or disable iCloud Drive for the App in iOS Settings
  • Stop AI processing: simply do not use the Analyze or Insights features; all other functionality works offline

Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA. Since we hold no personal data about you, most requests can be fulfilled directly from the App; for anything else, contact us at the address below.

7. Children's Privacy

The App is intended for professional use and is not directed to children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal information from children.

8. International Data Transfers

If you initiate an AI analysis, your request is routed through Cloudflare's network and processed by Anthropic on servers that may be located in the United States or other countries. iCloud data is stored by Apple in accordance with your Apple ID's country settings. These providers apply safeguards required by applicable data protection law for such transfers.

9. Website

This section covers punchlistai.app, the website, as opposed to the App.

The website is static: it has no accounts, no forms and no comments, and our hosting provider (Hostinger) keeps ordinary server logs (IP address, pages requested, browser) for security, which we do not use for tracking.

We use Google Analytics 4 to count visits and see which pages are useful, only if you accept the cookie notice shown on your first visit. Until you accept, no Google script is loaded and no analytics cookie is set; your choice is kept in your browser's local storage so we do not ask again. If you accept, Google sets cookies (_ga, _ga_*) on punchlistai.app, receives the pages you view, your approximate location derived from your IP address (which Google Analytics 4 does not log or store), your browser and device type, and processes this under the Google Privacy Policy. We have not enabled advertising features or Google Signals, and data is kept for 14 months. You can change your mind at any time with "Cookie settings" in the footer, or by deleting the site's cookies in your browser.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after changes constitutes acceptance of the updated policy.

September 15, 2026: added the Website section (Google Analytics behind a cookie notice; server logs).

September 13, 2026 (version 1.1): added iCloud sync through your private CloudKit database; AI requests now travel through our relay, which verifies the App with App Attest and applies a daily limit; the project name, site address and recent issue titles are sent with a photo as context for the analysis; described the AI Insights feature; clarified that AI drafts are reviewed by you before appearing on reports.

May 4, 2026: first version.

11. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: punchlistai@niceexpress.org Hosted at: https://punchlistai.app/privacy/

This Privacy Policy is provided for the Punch List AI mobile application by Nice Express. Effective date: September 13, 2026.