Privacy
WellPlan has no accounts, no analytics and no third-party trackers. It shows partner offers in Rewards (you can switch them off), and they never use your health information. Your habit data lives on your own device, and it only goes anywhere if you turn on an option below.
What WellPlan keeps on your device
Your four daily times, your ticks for sleep, water, meals and walking, any notes, your settings, and your approximate location if you choose a place for weather. It is stored in your browser’s own storage (IndexedDB) on this device.
A small error log (the last few technical problems, with no health data) is also kept on this device. It is never sent anywhere. You can read it, copy it or clear it in Settings > Diagnostics.
If WellPlan cannot read part of your stored data (for example after a bug), it keeps the rest, sets the unreadable entries aside on this device and tells you once. You can export them as a file, or delete them, in Settings. They are never sent anywhere.
WellPlan Cloud (optional)
If you turn it on, your data is locked on your device with a key made from your sync key before it is uploaded. The server only ever stores an unreadable encrypted file, an anonymous account code made from your key, a version number and the time of the last change. It cannot read your data, and it cannot recover your sync key.
If you lose your sync key, the online copy cannot be opened by anyone, including us. The copy on your device keeps working. Your device’s internet address is used briefly for rate limiting (to stop abuse) and is not tied to what you store.
Delete my cloud data in Settings removes the online copy at once. An online copy that is not used for 400 days is deleted automatically.
Google Drive (optional, when available)
A copy of your data is saved in a hidden app folder in your own Google Drive. Only WellPlan can open that folder, and it does not appear in your normal Drive files. This copy is not locked with your sync key: it is protected by your Google account, and Google’s privacy policy applies. You can disconnect and delete the copy in Settings at any time.
iCloud (optional)
Back up to Files lets you save a backup file wherever you choose, including iCloud Drive. That file is yours and WellPlan never sees it. Automatic iCloud sync, when available, stores one record in your private iCloud database, which only you can access.
Weather
If you turn weather on, your approximate location (about 1 km) is sent to Open-Meteo to get the forecast. Nothing else is sent.
Push reminders and calendar
If you turn on push reminders, our server holds your device’s push address and your four times so it can send the reminders at the right moment, and nothing else. You can turn this off in Settings.
The calendar file is made from the times in its link. Nothing about it is stored.
Health care (optional)
Health care is off until you turn it on. It can hold medications, blood sugar and blood pressure readings, prescription refills, doctor appointments and people you want to call. This stays on your device, and if you use WellPlan Cloud it is locked on your device with your sync key like everything else, so the server cannot read it. It is included in your backup file and in what you choose to share with your doctor.
If push reminders are on, our server also learns that a care reminder of a certain kind (for example “medication”) exists at a certain time or date, so it can send it. It never receives a medicine name, a reading, a doctor’s name, a phone number or a note. The lock screen says only things like “Time for your medication”. If you turn on details for the lock screen, the text is locked on your device with a key that never leaves it, so only this device can read it.
Appointments are not put in the calendar feed. Use the download on an appointment to add it to your own calendar.
Family check-ins (optional)
Family check-ins are off until you add someone. Each person you add gets their own private link (an invite). When you tick a habit or log something you have chosen to share with that person, WellPlan sends a short message to them through our server. The message is locked on your device with a key that only you and that person have. The key is in the invite link after the # sign, which browsers never send to a server.
Our server holds only what it needs to deliver the message: an anonymous circle code, a hashed token, times, the follower’s device push address, and the locked messages for up to 7 days. It cannot read names, habits, medicines, readings or the key. By default a follower sees plain wording such as “took their medicine”. Medicine names and reading values are sent only if you switch that on for that person.
The person you invite can read what you share with them, no account needed. You can pause a person, change what they see, or choose Stop sharing, which deletes that circle on our server.
Camera (optional)
The Android app asks for camera access only when you tap Scan, to read a WellPlan QR code (to pair another device or accept a family invite). The picture is read on your device, is not saved, and is never sent anywhere. You can say no and use a link or a photo of the code instead.
Home screen widgets (iOS and Android apps)
The WellPlan apps for iPhone and Android can show widgets on your home screen and lock screen. To draw them, the app keeps a small summary in storage shared only between WellPlan and its widgets on your device: today’s water, meals, walk and sleep, your streak, points and level, your wake and bed times, a rounded location (about 10 km) if weather is on, and your next few care reminders worded generically, such as “Medication at 8:00 pm”. The summary never contains medicine names, readings, doctors, contacts, phone numbers or notes.
If you turn on details for the lock screen in Health care settings, the next care reminder on the widget may use its real name, so anyone who can see your lock screen could read it. It is off by default. Tapping “+ Water” or “Walk” on a widget saves a small note on your device that WellPlan applies the next time it opens.
The Day at a glance widget asks Open-Meteo for the weather itself, with the same rounded location, and keeps the answer for 30 minutes. Nothing else is sent, and the widgets send nothing to WellPlan’s servers.
Rewards and partner offers
WellPlan Rewards gives you points for ticking your habits. Points are worked out on your device and stored with your other data (so they are locked with your sync key if you use WellPlan Cloud). They are for motivation only.
Rewards also lists offers from partners: health insurance, products, treatments and massages. Every offer is labelled Sponsored, Affiliate or Partner, and WellPlan may earn a commission or fee when you use a partner link or code. WellPlan does not recommend or endorse any provider, and offers are not medical advice.
Everyone sees the same offers. WellPlan never uses your health information, your habits or your points to choose, rank or target offers. The only thing that varies is that some promo codes unlock at a higher level, and that is decided on your device. Opening the Rewards screen asks our server for the list of offers with a plain request that carries nothing about you (no cookies, no account, no identifiers). We do not store your internet address for this.
When you tap Get offer, your device is sent through a WellPlan link that adds one to that offer’s click total and then forwards you to the partner’s website. When you tap Copy code, the total for that offer’s copies goes up by one. These are anonymous totals per offer. Nothing is recorded about who tapped.
Once you are on a partner’s website, their privacy policy applies, and they may place cookies or track you. Some offer pictures are loaded straight from the partner’s own site, in which case that site can see your device’s internet address. Pictures uploaded to WellPlan are served by WellPlan.
Switch partner offers off in Settings > Rewards. They disappear, nothing is requested, and your points stay.
Your choices
Export your data any time, restore it from a file, delete your online copy, or erase everything on this device. Clearing this site’s data in your browser also erases your progress on this device, so keep a backup.
Not medical advice
WellPlan is a habit tracker. It is not a medical device and does not give medical advice. Reference ranges and bands are informational only. Follow your doctor’s advice, and call emergency services if you are unwell.