Welwa™ — Privacy Policy
This policy explains what Welwa collects, why, and what you can do about it. It's written to be readable. Where we had to use a technical term, we explain it.
1. Who we are
Welwa is operated by Pacio LLC, a Michigan limited liability company ("we", "us", "our"). The Welwa Android app helps you check product ingredient labels for allergens and dietary preferences for the people in your household. Contact:
- Email: support@welwaapp.com
- Mail: Pacio LLC, PO Box 144, Davison, MI 48423
- Website: welwaapp.com
Welwa is currently offered in the United States only. International expansion (United Kingdom, Canada, Australia, New Zealand, European Union) is planned for a future release. If you are accessing the app from outside the United States, please do not provide personal information through it.
2. What we collect and why
Welwa is designed so that most of what you use the app for stays on your phone. The table below lists everything the app collects — what stays on-device only, what gets sent to our backend, and why.
On your device only (never sent to our servers)
| Data | Why |
|---|---|
| Device-local user ID (a random UUID generated on first launch, stored in Android's app-private preferences) | To scope your scan history and household profiles to this device. Survives reinstall only if Android Auto Backup is enabled — and it isn't, by default. Cleared when you clear the app's data or uninstall. |
| Household member profiles you create (name, allergens, dietary preferences) | To compute the verdict — SAFE / REVIEW / AVOID / UNKNOWN — for each scan against the people in your home. Stored in the app's local SQLite database. Never leaves your phone. |
| Scan history (the products you've scanned + the captured ingredient images) | To let you re-review a product without re-scanning. Stored in the app's local SQLite database + image files in the app's private file directory. Free tier retains the last 30 days; Premium retains unlimited. Never leaves your phone. |
| Reaction log entries (private notes you make about a product you reacted to) | Your private record. Never shared, never uploaded, never aggregated. Stored in the app's local SQLite database. |
| Airplane Mode preference | A setting that, when ON, disables all of our backend calls — see Section 9. |
Sent to our backend when you scan a product
| Data | Why | Who receives it |
|---|---|---|
| The barcode number (GTIN / UPC) of the product you scanned | To look up product details in our product database stack | Pacio LLC Cloud Function — see Section 3 |
| Approximate location (country only, derived from your IP address by Google Cloud) | To restrict service to the United States and route to the right data sources | Pacio LLC Cloud Function logs (IP-anonymized within 7 days — see Section 5) |
| Crash and error events (stack trace, device model, Android version) | To find and fix bugs | Google Firebase Crashlytics |
We do not send to our backend:
- Your scan history (lives only on your device)
- Your household member profiles (live only on your device)
- Your reaction log (lives only on your device)
- The ingredient panel images you captured (live only on your device)
- Your name, email, address, phone number — we don't collect any of these
Sent when you subscribe to Welwa Premium
| Data | Why | Who receives it |
|---|---|---|
| Subscription purchase token, product ID, anonymized device ID | To deliver Premium features and validate your subscription | RevenueCat (our subscription-management system) and, underneath it, Google Play Billing (which is what actually charges your Google account on Android) |
Sent to advertising services in the free tier
| Data | Why | Who receives it |
|---|---|---|
| Google Advertising ID, approximate location (city-level), device model | To show banner advertisements in the free tier of the app | Google AdMob and its ad-mediation partners (AppLovin, Meta Audience Network) |
If you subscribe to Premium, the app no longer shows advertisements and stops sending data to AdMob.
What we do not collect
- We do not request GPS or precise-location permission.
- We do not collect your contacts, phone number, browsing history, microphone data, or health-app data.
- We do not collect any data from the Camera permission beyond the ingredient-panel images that stay on your device.
- We do not require an account to use the basic scanning features. Reading a barcode + getting allergen + dietary verdicts works without sign-in.
3. Who we share with
Welwa uses the following third-party services. Each only gets the data it needs to do its job. We do not sell your data to anyone, and we do not share it with data brokers or marketers beyond the AdMob ad-serving integration in the free tier.
| Service | What they receive | Purpose |
|---|---|---|
| Google Firebase (Cloud Functions, Crashlytics, Hosting, App Check) — see Google Privacy Policy | Barcode lookups, anonymized IP, crash reports | Our backend — runs the product lookup, reports crashes, hosts welwaapp.com |
| RevenueCat (our subscription-management system) — see RevenueCat Privacy Policy | Purchase token, anonymized device ID, subscription state | Manage Premium entitlements, validate receipts, handle restore + refunds, prevent fraud |
| Google Play Billing (the Android in-app payment system RevenueCat uses underneath) — see Google Privacy Policy | Purchase token, product ID | Charge your Google account and confirm payment to RevenueCat |
| Google AdMob (free tier only) — see Google Privacy Policy | Advertising ID, approximate location (city-level), device model | Show ads in the free version of the app |
| AdMob Mediation Partners (AppLovin, Meta Audience Network — free tier only) — see AppLovin Privacy Policy and Meta Privacy Policy | Same as AdMob | Fill ad inventory when AdMob's own demand is unavailable |
| USDA FoodData Central (public-domain API) — see USDA.gov privacy | The barcode number you scanned | Look up nutrition + ingredients + allergens from the USDA database |
| Open Food Facts (community database, ODbL license) — see Open Food Facts privacy | The barcode number you scanned | Look up product details from the community-maintained database |
| FatSecret Platform API (US dataset only) — see FatSecret Privacy Policy | The barcode number you scanned | Look up nutrition + dietary attributes + brand-supplied allergen data. Per FatSecret's terms, this query goes server-to-server from our backend, never from your device |
| UPCItemDB (fallback for non-food products) — see UPCItemDB privacy | The barcode number you scanned | Identify non-food products that other sources don't carry |
We use Open Food Facts under the Open Database License (ODbL) and credit the project on welwaapp.com and inside the Welwa app.
We use FatSecret under their Platform API license; our app and website display the attribution "Powered by fatsecret nutrition API" as their license requires.
4. Where your data lives
- Data that stays on your device (scan history, household profiles, reaction log, captured images): on your Android phone. We have no access to it.
- Data that goes to our backend (barcode lookups, anonymized IPs, crash reports, subscription tokens): on Google Firebase servers in the United States.
5. How long we keep data
- On-device data (scan history, profiles, reaction log, images): until you clear app data, uninstall the app, or delete an item yourself from inside the app. We never see it and never delete it for you.
- Server-side barcode lookups: the product details we return are re-fetched live for each lookup. We keep an in-memory cache for up to 24 hours to reduce upstream load, then drop it. We do not keep a per-user record of which barcodes you scanned on our servers.
- Server logs (Cloud Functions): request logs are kept for 7 days, then automatically deleted. IP addresses are truncated to country level within those logs.
- Crash and error logs (Firebase Crashlytics): kept for 90 days, then automatically deleted.
- Subscription records: kept for the life of your subscription plus 7 years after cancellation, in line with Michigan and IRS retention requirements for taxable transactions.
6. Your rights
You can do any of these at any time:
- Access the data we hold on you. Email us at support@welwaapp.com and we'll send you everything we have within 30 days. For most users this will be a small file containing a hashed anonymous device ID, subscription history (if any), and recent crash reports.
- Delete your on-device data. Use Android's app-info screen → "Clear data" to wipe everything Welwa stores on your phone. There is also a "Clear all my data" action inside the app's Settings.
- Delete your subscription record. Email us at support@welwaapp.com. We will close any active subscription on your behalf (you can also cancel directly in Google Play) and delete the subscription record after the legally-required retention period.
- Export your data. Email us. The Settings screen also offers an in-app JSON export of your local scan history and household profiles.
- Object to processing. Email us.
If you live in California, Colorado, Connecticut, Utah, or Virginia, you have additional rights under your state's privacy law. To exercise them, email us at support@welwaapp.com with your state's name in the subject line. We respond within the timeframes your state's law requires (typically 30–45 days).
7. Children
Welwa is not intended for children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has used Welwa or shared information with us, please email support@welwaapp.com and we will delete any associated data we hold. When you add a household member to Welwa (for example, a child's allergen profile), that profile lives on the device only — we never see it. The age requirement applies to the device user, not to the household members the device user is tracking.
8. Allergen profiles and reaction logs (sensitive data, kept on-device)
The household member allergen profiles you create and the private reaction logs you keep are sensitive — they describe health-related information about you or the people in your home. We designed Welwa so that this information never leaves your phone. We do not store it on our servers, we do not back it up to the cloud, and we do not aggregate it with other users' data.
You may share Welwa's verdict for a specific scan with a doctor, school nurse, or camp counselor (Premium feature in Tier 2). When you do, the exported document is generated on your device and sent through your own email or messaging app — Welwa servers do not see the recipient or the contents.
9. Airplane Mode (you control how much we see)
Welwa includes an Airplane Mode toggle in Settings → Privacy. When ON:
- All calls to our backend are disabled.
- Welwa uses only on-device data plus direct calls to public free APIs (USDA, Open Food Facts, UPCItemDB).
- Our Cloud Function never sees your barcode lookups.
- FatSecret data is not available — but the rest of the app still works.
We show a banner inside the app while Airplane Mode is on so it's clear what's happening. You can switch it off any time.
10. Reaction reports (Premium feature, V1.1 and later — not active in V1)
Welwa V1 does not collect or share aggregated user reaction data. The "private reaction log" referred to in Section 2 stays entirely on your phone.
A future Welwa release (V1.1 or later) may introduce an opt-in feature that lets you contribute reaction reports to a community pool. It will be opt-in only, with an explicit consent screen, and is not active in V1. When it ships, we will update this Privacy Policy, prompt you for fresh consent, and add a dedicated Section in this document describing exactly how it works. Until then, your reaction log is private and lives only on your device.
When this feature ships, it will follow ten structural safeguards described in our public documentation, including: manufacturer labels always presented as primary, a minimum threshold of independent users before any aggregate display, manufacturer dispute mechanism, time-limited display (12 months), and a persistent disclaimer that user reports are anecdotal and not medical advice.
11. Welwa is not a medical device
Welwa helps you read product labels — it does not diagnose, treat, or prevent any medical condition. Always read product labels yourself before consumption, especially for severe allergies. Consult a medical professional for any allergy diagnosis or management plan. If your verdict says SAFE, that is Welwa's best read of the product's published ingredient information; manufacturers can reformulate, ingredient panels can be wrong, and Welwa can make mistakes.
If your verdict says UNKNOWN, treat it as "we don't have enough information" — not as "safe."
12. Changes to this policy
When we change this policy in any meaningful way, we update the "Last updated" date at the top, post the new version at welwaapp.com/privacy, and (if you have an active subscription with a record on file) email you a one-line summary of what changed. Minor changes — typos, formatting, link updates — are posted without notice.
The complete revision history is available at welwaapp.com/privacy/history.
13. Contact us
- Email: support@welwaapp.com
- Mail: Pacio LLC, PO Box 144, Davison, MI 48423, United States
Welwa is a trademark of Pacio LLC. Pacio LLC is a Michigan limited liability company and a subsidiary of Craney Holdings LLC.