Privacy

Part one: the app

What it collects

Nothing. Welle has no backend. There is no server to receive your entries, no account to attach them to, and no analytics or crash-reporting service embedded in the app.

Where your entries live

In a database on your device. We hold no copy, because we never had one. If you delete the app, they are gone from the app.

Your phone's own backup can include Welle's data: iCloud or computer backups on iPhone, and Google backup on Android if you have it turned on. Those copies are held by Apple or Google under your account, not by us. If you restore a backup, your entries come back with it.

Use Export everything in Settings at any time to get every entry as plain, readable JSON. Recordings are not part of the export. Your history is never locked behind a subscription.

Speech, search and patterns

Everything that looks like it might need a server does not:

• Speech to text uses the recogniser built into your phone, with on-device recognition required. If your device or language cannot do that without a network, Welle refuses to record and offers you typing instead, rather than sending your voice somewhere.
• Search runs against the database on your device.
• Names are detected on your device, and nothing is added to your People list until you confirm it.
• Language models. The first time you use a language, your phone may download its speech or language model from Apple or Google. Only the model comes to your phone. Nothing you say or write is sent.
• Patterns on the You screen are calculated from your own entries, on your device, using fixed sentence templates. You can switch the whole analysis layer off, and off means it is never calculated.

How you can check

Open Settings › What runs on this device. It lists every capability and which on-device implementation your particular phone selected, including the ones it tried and could not use.

On Android, the release build ships without the INTERNET permission. The operating system itself prevents the app from opening a network connection, and you can verify that in the Play Store listing rather than taking our word for it.

Part two: this website

welle.om is not the app, and it is honest to say so plainly. Two forms on it send something to a server we run. Here is all of it.

If you join the beta

We store the email address you typed, your first name if you gave one, your answer to the optional question, the page you were on, the marketing tag in the link if there was one, the name of your browser and operating system, whether you ticked the update box, and the time.

The email address is used to send you a TestFlight invitation, and for nothing else. To send it, we give your email address and first name to Apple, which runs TestFlight and emails you the invitation; Apple's privacy policy applies to that email. We never sell or rent your address, never share it with anyone else, and never add it to any other list. If you did not tick the box, you get the invitation and no further email.

If you send feedback

We store your note, which kind you picked, the screen you named if you named one, the page you were on, the name of your browser and operating system, and the time. Your email address is stored only if you typed one, and only so a person can reply.

What we count

We count how many times a page was opened, a button was pressed and a form was finished. These are counters: a date, the name of the thing, and a number. There is no identifier, no session, no cookie and no profile, so two visits by you and one visit each by two people are the same row and cannot be told apart afterwards.

To stop a robot filling the beta list we keep a one-way, salted, daily hash of your IP address for up to 24 hours. It cannot be turned back into an address, it is never stored next to your submission, and it is deleted automatically once it is older than 24 hours.

The web server keeps no access log of visitors. It logs errors so a broken page can be fixed, and an error line can include the IP address of the request that caused it. Cloudflare, which sits in front of welle.om, processes your IP address to deliver the page. The database that holds beta registrations and feedback is included in our nightly server backup, so a deleted record can remain in older backups until they expire.

What this website does not do

• No cookies. Open your browser tools and check.
• No Google Analytics, no Meta pixel, no advertising network. Every file this page loads is served from welle.om.
• Our content network injects one analytics script of its own into every page it serves, and this site's security policy blocks it, so it never runs and never reports anything. Open your browser console and you can watch it being refused.
• No fonts loaded from a font network. The typefaces are hosted here.
• No pre-ticked boxes, and no subscription you did not ask for.

How long we keep it

Beta registrations are kept until Welle is on the App Store and the beta is closed, then deleted. Feedback is kept while it is still useful for fixing the thing it describes. Counters hold no personal data and are kept indefinitely.

Getting it removed

Email [email protected] and ask. We will delete your registration, your feedback, or both, and reply to say it is done. You do not need to give a reason, and there is no form to fill in.

Children

Welle is not directed at children under 13. The app collects no information from anyone, including children. Please do not use the forms on this website if you are under 13.

If this ever changes

If a future version of the app adds anything that uses a network, it will be off by default, it will ask you first and explain exactly what is sent, and this page will be updated before that version ships. The claim above is enforced in the app's source code, not only in this document.

Contact

Questions about privacy: [email protected]