Pumli · ESOTECH LTD
Privacy Notice
Who is responsible
ESOTECH LTD is responsible for the Pumli app and this notice. A provider or MCP server you independently connect is also responsible for its own processing under its separate privacy notice. The current app has no general Pumli cloud account or cloud conversation sync.
Information stored on your device
Pumli stores conversations, assistant memories, downloaded models, generated or imported media, settings, tool choices, and custom instructions in app storage. Some temporary recordings and generated files may remain in device caches. API keys entered for online models are currently stored in app storage; remote MCP credentials use iOS SecureStore. App storage is protected by your device’s security and may be included in device backups, but it is not the same as a dedicated encrypted credential vault.
Local models and memory
When a local model answers without an online tool, its prompt and response can stay on your device. The optional assistant memory is built from information you ask Pumli to remember, is stored locally, and can be viewed, edited, disabled, or deleted in settings. A local model can still call a web or MCP tool if you enable that tool, which sends the necessary request to the chosen service.
Online AI, search, and research
If you choose an online model, Google Search grounding, research tool, browser, OpenClaw connection, Notion workspace connection, or remote MCP server, Pumli sends the information needed for that request to the selected provider. This may include prompts, conversation context, search queries, selected files, tool arguments, and tool results. Notion access is off until you authorize a workspace and enable the connection; its OAuth tokens stay in iOS SecureStore and can be removed in settings. The provider may receive network identifiers such as your IP address and may retain data under its own terms. Pumli does not control independently operated MCP servers.
Voice, images, and video
Local dictation processes audio on the device after microphone permission. Realtime voice sends live microphone audio and conversation text to the selected online voice provider, currently OpenAI, while you use the session. Image generation sends your prompt and any selected reference image to the selected image provider, including Gemini when chosen. Video generation sends prompts and selected reference media to Seedance through Volcano Ark or BytePlus when chosen. Generated media may be downloaded into app storage; saving it to Photos requires your action. Provider processing, retention, safety review, and charges follow its own terms.
iPhone information and permissions
Phone features are off until you enable them. Depending on the action, Pumli may request access to the microphone, camera, Photos, location, local network, calendars, reminders, contacts, speech recognition, or HealthKit. Calendar and reminder tools can read or create only as their enabled action allows; contact search returns matching entries; HealthKit tools read steps or workouts and do not write health data. Location is requested while using the app, not in the background. You can change iOS permissions in Settings and disable each tool in Pumli.
Health and sensitive information
HealthKit, location, contacts, calendar, mail, and account data may be sensitive. Pumli uses it only for the action you enable and request, not for advertising, data brokerage, or building marketing profiles. A tool result may become part of the current assistant context; if you connect an online AI or remote tool for that task, information needed for the task may be sent to that provider. Do not connect a provider you do not trust with the requested data.
Google Workspace data
If a Google Workspace connection becomes available, Pumli will request only the scopes needed for the enabled Gmail, Calendar, Drive, Docs, Sheets, Slides, or Contacts action. Use of information received from Google Workspace scopes will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data will not be sold, used for advertising, or used to train a general AI model. An in-app disclosure and consent will appear before access to Google account data. Google account access can be revoked in Pumli or your Google Account.
Google sign-in and security records
When you choose Pumli-managed Google sign-in, our authorization service on AWS in the United States briefly processes authorization codes and access or refresh tokens to complete, renew, or revoke the connection with Google. These credentials are not written to our database or application logs. Google tokens saved by Pumli are kept in iOS SecureStore on your device. Our own Google application credentials are kept separately in AWS Secrets Manager. To prevent forged or replayed sign-ins, the service stores a random transaction identifier, state and code hashes, a PKCE challenge, a random app nonce, requested scopes, transaction status, and expiry time. These records expire after five minutes and are deleted on a valid exchange; unused or cancelled records are queued for automatic database deletion, which may take several days. Separate security event logs contain only a request identifier, fixed endpoint name, response status, timing, and event time, with a configured retention of up to 365 days; routine server diagnostics have a 14-day retention. Expired log events are queued for deletion, which normally takes up to 72 hours and may occasionally take longer. They exclude passwords, tokens, authorization codes, request bodies, query strings, email addresses, chat content, and precise location. We use these records only to secure and investigate the authorization service, not for advertising or model training. We review retention and shorten it when no longer necessary or required by applicable law.
Model downloads and external links
Downloading a model contacts its host, such as Hugging Face or ModelScope. The host sees ordinary network data including your IP address and the requested model. Opening source links, maps, email apps, or websites gives those destinations the data you choose to send them.
Why we process data
Local storage and selected tool processing are used to provide the features you request, remember your choices, and maintain the app. Where applicable law requires a legal basis, core app processing is necessary to provide the service; optional device access, sensitive data, online AI, and connected-account access rely on your choice or consent as required by law. For minimal authorization security records, we rely, where applicable, on our legitimate interest in preventing unauthorized access and investigating security incidents, subject to necessity and balancing assessments. You may withdraw a permission or disconnect a provider, without affecting processing already completed.
Sharing, transfers, and retention
Pumli sends data to a third party only when you choose a feature that needs it, such as an AI provider, model host, or remote MCP server. Those services may process data outside your country; check their notices for destinations and safeguards. Our Google authorization service uses AWS in the United States. AWS processing is governed by its Data Processing Addendum and applicable contractual transfer safeguards, including Standard Contractual Clauses where applicable. Contact us for information about safeguards relevant to your location. Local chats, memories, models, credentials, and generated files remain until you delete them, remove the app, or your device clears temporary data, subject to iOS backups. Provider copies and logs are retained under that provider’s policy.
Security and your controls
Use a device passcode, keep your phone and providers’ accounts secure, and avoid putting secrets in prompts. You can delete chats, memories and downloaded models, remove saved keys, disconnect MCP servers, and revoke iOS permissions. Revoking a Pumli setting does not automatically erase data already held by a third-party provider; use its account controls for that. No network or storage method can be guaranteed completely secure.
Your privacy rights
Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, and may withdraw consent or appeal a privacy decision. For data held locally, use Pumli’s controls or remove the app. For data held by an independent provider, use that provider’s privacy process. Contact hello@1stdo.com for requests concerning data under our control.
Children and updates
Pumli is not directed to children below the age permitted by applicable law and connected providers. If a parent or guardian believes a child’s personal data was provided improperly, contact hello@1stdo.com. We will update this notice when features, data flows, or legal requirements materially change and present a new choice where required.