01The short version
Perfect Takeoff runs in your browser. Your plans are read and marked up on your own machine — we don't run a server that stores your drawings. The one time plan images leave your computer is when you ask the AI to recognize devices: those images go directly from your browser to the AI vision provider (Anthropic's Claude API) under that provider's terms, and come straight back. Perfect Takeoff never holds a copy in between.
That's the whole model: local-first, bring-your-own-key, nothing warehoused. For a solo estimator or a small shop bidding sensitive work, that's a stronger data posture than most cloud takeoff tools — and it's true because of how it's built, not because of a promise.
There is no central vault of contractor drawings to breach, because the takeoff happens on your computer. Your pricing, labor rates, and win values never leave your device at all.
02Where each piece of your data actually lives
It helps to separate the pieces, because they live in different places. Here's every part of your data and exactly where it sits:
| Your data | Where it lives | What that means |
|---|---|---|
| Your PDF plan set | Your machine | Read and rendered entirely in your browser with pdf.js (the same open-source engine that ships in Firefox), held in memory while you work. Not uploaded to a Perfect Takeoff server — there is no such server in the takeoff path. |
| AI device recognition | Browser → Anthropic | Image tiles of your plan go directly from your browser to Anthropic's API (api.anthropic.com) and the recognized devices come back. Browser-to-Anthropic — it does not pass through a Perfect Takeoff backend, and we keep no copy. Anthropic processes those images under its own commercial API terms. This section is being finalised. |
| Your takeoff, BOM & quote | Your machine | Device counts, the bill of materials, labor, and the priced quote are all calculated in the browser from the placed devices. Math and code logic on your machine — no round-trip, nothing stored off-device. |
| Your saved projects | Your machine | Saves and the project pipeline live in your browser's own storage (localStorage / IndexedDB). You can export a full project as a portable .ptproj file whenever you want — your data is yours to move, back up, or hand off, not locked in a vendor cloud. |
| Your account & subscription | Auth layer (when live) | When accounts go live, sign-in and "what plan you're on" run through a standard auth/billing layer (Supabase) that knows who you are and what you paid for — not what you're bidding. Plan content and billing identity are deliberately kept in different places. |
Read the table by the pin colors: green stays on your machine, orange leaves it. Only one thing in the whole flow is orange — the AI recognition call — and even that is browser-direct to Anthropic with no copy kept by us. Everything that reveals your pricing or your competitive position is green.
03What this means for the objections you'll actually hear
The data story only matters if it answers the questions a buyer actually asks. Here are the ones that come up, and the straight answers:
No. There's no Perfect Takeoff server holding your plans — the takeoff happens on your machine. The only external hop is the AI recognition call to Anthropic, and we don't retain those images. So there is no central vault of contractor drawings to breach in the first place.
No. We don't collect your plans, so there's nothing for us to train on or share. The AI recognition runs on Anthropic's commercial API, whose terms say API data isn't used to train their models This section is being finalised.. Your pricing, labor rates, and win values never leave your device at all.
Because the app is local-first, the sensitive part — your full plan set and your finished takeoff — stays on your machine. The one thing to weigh is the AI recognition step, where plan images are sent to Anthropic for processing. For work where even that isn't acceptable, that's a conversation to have directly (see §04) rather than something to gloss over.
Your projects live on your device and export as portable .ptproj files, so you keep your work regardless of subscription status. You're not renting access to data we hold hostage.
We're early — we don't claim certifications we don't have. What we can point to is an architecture that minimizes what's exposed in the first place: local-first processing and no warehouse of customer drawings. As the product matures for larger teams, formal reviews are on the roadmap; we'll say so plainly when they land rather than implying them now.
04For teams and sensitive work
Multi-estimator teams and organizations with stricter requirements — secure facilities, procurement questionnaires, data-handling addenda — should raise it during the Team-tier conversation. The right answer there may include a self-hosted or proxied AI path so plan images don't leave a controlled boundary, plus written data-handling terms.
That's a deliberate, case-by-case discussion — not a checkbox we'll pretend is already shipped. If you have a specific requirement, tell us what it is and we'll tell you honestly whether the current architecture meets it or what it would take.
05The one honest caveat
Perfect Takeoff is in early access, built and iterated quickly by a small team. The architecture above is real and is the reason the data story is strong — but the product is evolving, and the subscription backbone is still being wired in.
If any future change moves plan processing onto a server — for example, a hosted AI proxy so customers don't bring their own key — this page gets updated to match before that change ships. We'd rather under-promise here than have a trust page that quietly stops being true.
If you have a specific data-handling requirement, ask. A straight answer about how your drawings are handled is part of the product.
06Where to go next
This page is the deep, architecture-level version of the data story. For the shorter legal-style summary — what the website itself collects (just the email you give us), your deletion rights, and the plain-English early-access terms — see the privacy & early-access terms page. To see the actual output the app produces, walk the sample takeoff.
Local-first isn't a feature we bolted on for a security page — it's how the analyzer was built. That's why the honest answer and the marketing answer are the same answer.