The Well Privacy Policy
Who this covers
The Android app com.stuarttech.thewell (Play and sideload),
this origin site, and (later) the origin PWA. An iOS hub, if published,
uses this same policy unless a platform-specific notice says otherwise.
What we do not collect
- WAN analytics, advertising, or a crash-reporting SDK
- User accounts or email
- Pastoral notes, individual attendance records, prayers, or membership lists uploaded to us
- Sale or brokerage of personal information
- WhatsApp chat contents (share sheet is the Android OS share sheet; no WhatsApp API)
What stays on your phone
| On device | Leaves the phone? |
|---|---|
Signed packs (.cpk) and week files (.cpjson) |
Only if you host, export to SD, or share via the OS share sheet |
| Pastoral / local notes | Only in journal exports and recovery files you create. |
| Device signing key | No. Non-exportable. |
| Church seed (32 bytes) | Only if you (a pastor) export it as QR/paper. We never receive it. |
| Week clock override | In recovery files you create. |
Android backup and device-to-device transfer of app data are off. Uninstalling the app removes its private storage. Exports and recovery files remain where you saved them. Daily backups require you to select a folder.
Optional internet use
If the phone has WAN, the app may download origin-signed library files from
https://thewell.stuarttech.com. That is content, not a profile.
Pack URLs that are not this host on HTTPS, or not a local/LAN address on
HTTP, are refused. Visiting this website uses ordinary HTTPS. Server access
logs on the VPS are operational (abuse, TLS, uptime), not a product
analytics suite, and are not joined to an in-app identity — there is none.
Optional pastor check-ins
The Well accepts the reporting month, counts of pastors, leaders, and members, and a token derived on the pastor’s phone that changes each month. The token lets a church replace its previous submission during that month. Website administrators see monthly aggregate totals. The submission excludes church identifiers, device identifiers, names, individual attendance, and location. The dedicated check-in route strips identifying headers and disables its request logs. Network operators can still observe the internet connection.
Members and leaders can choose to share attendance and role counts with a trusted church leader or pastor. A one-time QR code encrypts transfers over church Wi-Fi. The recipient reviews the report before saving it. Journal entries and personal Bible notes are excluded from these reports.
Sharing a church library
When a pastor taps Share this church’s library, the phone starts a local-only hotspot or uses church Wi-Fi and serves already-on-device signed files over local HTTP so nearby phones can read and copy them. Stopping the notification drops the LAN bind. The in-app reader on this phone keeps working without LAN.
An APK from that Wi-Fi is a last-resort, trust-on-first-use download. Prefer Google Play, or an SD card / HTTPS copy from someone you know.
Permissions
Android permissions exist to host Wi-Fi, keep the host process alive, and talk to local phones or origin HTTPS. They are not a data-collection list. Location / nearby-Wi-Fi permission, when present, is Android’s prerequisite to start a local hotspot on some API levels — not for tracking, not sent to us.
Children
This is a church library, not a Play Families “designed for children” product. We still do not collect personal information from anyone, including minors.
Your choices
- Do not tap Host if you do not want this phone to serve files on LAN.
- Do not export the church seed if you do not want a paper/QR backup.
- Uninstall to delete on-device app data.
- Play-installed copies update from Play; sideload copies may update from a pinned APK.
Contact
Stuart Technologies — https://thewell.stuarttech.com
Changes
We will update this page and the date above if the app’s data practices change. The Play Data safety form must be revised before any such app ships.