Telemetry & privacy

Local-first. By default.

Pullframe is a Mac app for professional editorial work. Your downloads, your file paths, and your source URLs stay on your Mac. The app sends a small operational telemetry envelope so we can keep launches, downloads, updates, and licenses working. This page documents exactly what that envelope contains.

What Pullframe never collects

The contents of any video, audio, subtitle, or metadata file you download.
Source URLs you paste into the app, channel addresses, or playlist links.
File or folder paths on your Mac, including the destination folder.
Titles, channel names, or filenames from your downloads.
Your raw license key. The server stores an escrowed copy for license recovery only.
Hostnames, usernames, serial numbers, MAC addresses, or hardware identifiers.
Clipboard contents, window titles, or local browsing history.
Raw exception dumps, request bodies, or full referrer URLs.

What Pullframe does collect

App operations

The Mac app reports operational events so we can tell if customers can launch, activate, update, and download successfully.

app.launched
license.activation.* · started, succeeded, failed
license.deactivation.succeeded
license.recovery.*
update.check.* · update.download.*
download.started · download.succeeded · download.failed
feedback.opened · feedback.submitted

Download batch shape

When a download finishes we record what kind of batch it was, as counts and coarse categories only. No titles, URLs, filenames, or paths.

downloadType · video, audio, video_audio, subtitles, metadata, thumbnail, or mixed
videoCount, audioCount, subtitleCount, thumbnailCount, metadataCount
transcodeCount + hasTranscodes · whether ProRes / DNxHR / H.264 ran
remuxCount · whether streams were remuxed

Failure context

If something breaks we record a small, sanitized failure code and short reason so we can fix it. The reason never includes URLs, paths, request bodies, or license keys.

failureCode · one of a known enum like network_unavailable, license_invalid, artifact_download_failed, unknown_error
failureReason · short, sanitized, user-safe

App context

A small machine context envelope helps us diagnose compatibility issues by macOS version and architecture. It is not a fingerprint.

appVersion, appBuild
osName (macOS), osVersion, architecture (arm64 / x64)
updateChannel (stable / beta)
installId · an app-generated UUID, not a hardware ID
licenseState · trial, licensed, unlicensed, or expired
plan · solo, personal, extended, team, or custom

Optional diagnostic context

These are coarse and optional. They help reproduce edge cases without identifying you.

macModel · model family only
memoryGbBucket · <8, 8–15, 16–31, 32+
locale, timezone

Explicit feedback

When you submit feedback in the app, that message is user-initiated. The UI shows you the attached diagnostics before you send it.

category · general, bug, feature, license, download, update
message · the text you type
email · optional, only if you provide one for a reply
Last failure code and message for context, if relevant

Website

The website records basic funnel events for launch support and may load Plausible from Pullframe’s configured analytics deployment for privacy-friendly pageview and marketing conversion analytics. Email addresses are only seen when you submit them yourself in checkout, recovery, or feedback.

site.page_viewed · site.pricing_viewed
site.checkout_started · site.download_clicked
site.license_recovery_started · site.license_recovery_submitted
site.feedback_opened · site.feedback_submitted
Plausible goals like Download Clicked, Pricing Viewed, Checkout Started, and GitHub Star Clicked
Coarse source bucket: direct / search / social / email / unknown
Referrer host only — never full referrer URLs
No cookies, raw license keys, emails, local paths, source URLs, or downloaded content in Plausible events

Turning diagnostic sharing off

Pullframe exposes a single setting:

Share diagnostic and usage data

Turn it off in the app preferences and operational telemetry stops being sent. Explicit feedback you submit yourself always sends, because you are the one submitting it. License activation and update authorization still need to talk to the Pullframe server because that is what those features do; those calls do not include source URLs, file paths, or downloaded content.

Contract

This page is summarized from the canonical collection contract maintained in the server repository. If you find a mismatch between what is documented here and what the app actually does, that is a bug — please report it.

The shared event envelope, allowed event names, allowed property keys, and forbidden field rules are versioned with schemaVersion: 1. Future versions will be documented here when they ship.

Questions or a takedown request

Email [email protected]. If you would like to delete telemetry tied to your installId or license, include it in the message and we will remove it. The app can be reset to a new installId from preferences.

For license recovery and account-level questions, use the license recovery flow.