Privacy · Updated September 12, 2026

Your project evidence stays under your control.

SiteMosaic is a local-first room-photo documentation utility from NexLevel. This policy explains what is stored on your device, what may leave it, and how to export or delete it.

Local project data

Projects, room names, photographs, plan pages, capture stations, user-assigned directions, coverage slots, photo-punch coordinates and original-photo references, frozen snapshot manifests, Watch return-marker receipts, locally transcribed audio-note text, typed notes, observations, decisions, reminders, and exports are stored in the app container on your Apple device with Apple Data Protection. SiteMosaic does not use advertising SDKs, cross-app tracking, or third-party behavioral analytics. Saving a local photo pin does not send that pin to an AI provider.

Photos, plans, and notes

You choose each source. The app validates supported files, removes image location metadata from sanitized renditions, and shows the exact approved material before a managed request. A selected audio note is limited to five minutes and transcribed with Apple's on-device Speech framework; only the bounded reviewable transcript is stored, while the raw audio staging copy is deleted and is never sent to SiteMosaic, Cloudflare, OpenRouter, or another inference provider. Video is not uploaded, captured, generated, or analyzed.

Coverage uses directions and positions you assign. The app does not measure device heading, camera field of view, dimensions, or photographed area. The home illustration is not a stored customer photo or proof of coverage.

Optional managed photo assistance and Smart Draft

Managed features are available only to an eligible trial or Pro entitlement and may be disabled when authorization, privacy, provider, quota, budget, or reliability checks fail. Photo intake assist presents the exact selected approved photo renditions and room labels before ownership and sensitive-content consent. Its grouping and possible duplicate/overlap suggestions are temporary, read-only, and discarded when you leave. Smart Draft is available under Room punch list → Room tools and previews its selected sanitized images, bounded plan excerpts, and text-note spans before consent. The request is sent through SiteMosaic's first-party gateway to an allowlisted OpenRouter route configured for Zero Data Retention, provider data-collection denial, no training, no response cache, and no model fallback. No photo-assist suggestion changes a room assignment, approves a direction, or changes coverage. Smart Draft observations are advisory, evidence-linked, editable, and excluded from an approved packet until you review them.

The gateway retains no photo, plan, text-note, prompt, or completion content after the request handler finishes. It may retain content-free security and commerce records—such as a pseudonymous transaction-lineage hash, request digest, quota/cost state, policy version, and timestamps—to prevent replay, enforce purchased limits, process revocation, and preserve a lifetime credit balance. These records never contain project or room labels, filenames, addresses, evidence text, or generated text.

App Store privacy categories

For Apple’s App Privacy disclosures, SiteMosaic conservatively reports Purchase History, User ID, and Product Interaction as data linked to the user and used only for App Functionality. These categories cover verified purchase lineage, the pseudonymous service identity derived from it, and content-free request/quota state. They are not used for advertising or tracking. User photographs, plan pages, notes, prompts, and generated drafts are processed only for the requested feature and discarded by the gateway after real-time servicing; they are not retained in the service records described above.

Apple services and purchases

Apple processes App Store downloads, trials, subscriptions, lifetime purchases, refunds, and payment information under Apple's policies. SiteMosaic reads verified entitlement state; NexLevel does not receive your payment-card number. Local notifications are scheduled by your device for review and reinspection reminders. The mosaic Watch return marker is a saved state change, not a scheduled notification. Notification permission is optional and may be changed in Apple Settings.

Permissions

• Photos, camera, and files: only when you choose or capture project evidence.
• Notifications: only after you enable a useful reminder.

Core project editing, review, export, and deletion remain available if optional permissions or the managed service are unavailable.

Export, retention, and deletion

You can export your data in the formats offered by the app. Files shared outside the app are no longer protected by the app container. Deleting a project removes its structured project records and cancels its local reminders, then attempts to remove its protected sources, sanitized renditions, and export files. If local file removal fails, SiteMosaic stores a content-free cleanup record and exposes a retry action in Settings until cleanup succeeds. The separate “Delete managed-service data” action remains available independently of local projects, authenticates the verified PunchPhoto purchase lineages available in StoreKit history, requests deletion of their service records, verifies the gateway receipt with a public P-256 key pinned in the shipped app, and only then resets this installation’s App Attest identity. A missing key pin, failed signature, stale authorization that cannot be safely replaced, or unavailable request is reported and never shown as complete. A minimal one-way purchase/consumption record may remain to prevent a deleted lifetime entitlement from receiving a second 100-packet allowance.

Children, changes, and contact

SiteMosaic is a business utility and is not directed to children. Material changes will be posted here with a revised date. For privacy questions, email [email protected] or visit SiteMosaic Support.