Privacy Policy

Who we are

WellPad is developed and operated by Southpaw Digital Labs Inc. (“we”, “us”), a company in Alberta, Canada. This policy covers the WellPad app on Android, iPhone and iPad, the website at wellpad.ca including the web LSD Lookup, and the WellPad LSD API.

Part 1: The WellPad app

Information the app does not collect

The app does not collect:

• Your name, email or contact information
• Accounts or logins of any kind
• Your search history or lookup data
• Your favorites, notes, photos or corrections
• Usage analytics, advertising IDs or behavioural data

The app has no servers that receive your personal data.

Information stored on your device

On iPhone, the date your free trial started is also kept in the iOS Keychain on your device, so reinstalling the app doesn’t restart the trial. It contains only that date, is never sent anywhere, and is removed if you erase your iPhone.

You own this data. You can export a full backup including photos (Settings → Share Backup), delete favorites, history, notes, photos and corrections (Settings → Clear All Data), or uninstall the app to remove everything.

Phone backups

Android: if Android backup is turned on, Android may back up your favorites, history, notes, corrections and settings to your own Google account, and copy them (with photos) when you move to a new phone.

iPhone: if you use iCloud Backup or back up to a computer, your favorites, history, notes, photos, corrections and settings are included in your own backup. The large well and parcel databases are not backed up, since they come with the app.

These backups are handled by Google or Apple, not by us. We cannot access them, and you can turn them off in your phone’s settings.

Location

The app asks for location permission for two features:

• GPS lookup (the location button on the Lookup screen) finds the parcel you’re standing in.
• Update LSD Location saves your current position as a corrected wellhead location.

Your position is used on your device and stored only there (in History and Corrections). The app does not send your location to us or anyone else. You can deny location permission and still use every other feature.

Features that use the internet

Well registry updates. When you tap Check for Updates in Settings, the app downloads the latest AER well data from our public data repository on GitHub. GitHub receives the download request, including your IP address. See the GitHub Privacy Statement.

Purchases. WellPad Pro is sold through Google Play on Android and the App Store on iPhone. The app asks the store which purchases your account owns, to unlock Pro. We never see your payment details or your store account. See the Google Privacy Policy and Apple Privacy Policy.

Crash reports on Android (Firebase Crashlytics). When the app crashes, it sends the crash stack trace, device model, manufacturer, Android version, app version, and a random installation identifier created by Crashlytics to count crashes. It is not linked to your name, email or Google account, and never includes your location, lookups, favorites, history, notes, photos or anything you type. See Firebase privacy.

Crash reports on iPhone (Apple MetricKit). The iPhone app uses no crash-reporting service. After a crash, iOS gives the app a diagnostic report (crash details, device model, iOS version and app version). WellPad keeps the newest 10 on your device, and a report is only sent if you choose to share it, for example by email. Separately, if you turned on Share with App Developers in your iPhone’s Analytics settings, Apple may send us anonymous crash and performance statistics. You can turn that off in Settings → Privacy & Security → Analytics & Improvements.

Maps and sharing. When you tap Navigate or Share, the app hands the parcel’s coordinates to the map or sharing app you choose. Those apps have their own privacy policies.

Part 2: The website and web LSD Lookup

Without signing in

When you use the LSD Lookup at wellpad.ca, your browser is given an anonymous ID (through Firebase Authentication) so we can count your lookups and apply the free limit of 10 a day. We store the number of lookups made under that ID each day. We do not store which LSDs you looked up, and the anonymous ID is not linked to your name or email.

When you sign in with Google

Signing in raises your limits (50 lookups a day and bulk lookups). Google shares your name, email address and profile photo with us, and we keep them in your WellPad account along with your daily lookup counts. We use them only to run your account and to contact you about it.

Stored in your browser

The website saves a few preferences in your browser’s local storage: light or dark theme, the map layer you picked, and the home base you set in the route planner. They stay in your browser and are never sent to us. Firebase sign-in also keeps a session in your browser so you stay signed in.

The website has no ads, no analytics and no tracking cookies.

Part 3: The LSD API

To use the API you sign in with Google and choose a paid plan. We keep:

• Your name, email and Google account ID (from sign-in)
• Your Stripe customer ID, plan, subscription status and billing period dates
• How many lookups you made in each billing period
• For each API key: its name, the first few characters, when it was created and last used, and a one-way fingerprint (SHA-256 hash). We never store the full key and cannot show it to you again.

As with the web lookup, we count API lookups but do not store the LSDs you send or the results.

Payments. Subscriptions are processed by Stripe. You enter your card details on Stripe’s checkout page; we never see or store your card number. Stripe also collects your billing address to calculate GST/HST, and keeps invoices and payment records. See the Stripe Privacy Policy.

Service providers

We use these companies to run the website and API. Each handles data only to provide its service to us.

Google Cloud and Stripe may store and process data in the United States and other countries, under their own security and privacy commitments.

How long we keep data

• App data: on your device until you delete it or uninstall the app.
• Website account and lookup counts: until you ask us to delete your account.
• Anonymous lookup counts: kept as daily totals that aren’t linked to any person.
• API account: while you have an account. Billing and tax records are kept for six years, as Canadian tax law requires.
• Server logs: kept by Google Cloud for about 30 days for security and troubleshooting.
• Crash reports (Android): kept by Firebase Crashlytics under Google’s retention policy.

Security

• All connections use encrypted HTTPS.
• App data stays in the app’s private storage, protected by Android’s and iOS’s app sandboxing.
• API keys are stored only as one-way fingerprints, and card details are handled only by Stripe.

Your rights

You can:

• Ask what personal information we hold about you, and get a copy
• Ask us to correct it
• Delete it: in the app with Settings → Clear All Data, or for a website or API account by emailing us (see Delete your data)
• Deny location permission in the app
• Contact us with any privacy question or complaint

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). If you aren’t satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

WellPad is built for professional field workers and is not aimed at children. We do not knowingly collect information from children under 13.

Changes to this policy

We may update this policy. Changes will show a new “Last updated” date at the top. If you have an API subscription and the change is significant, we’ll also email you.

Contact

Southpaw Digital Labs Inc.
Email: mike@wellpad.ca
Website: wellpad.ca