This draft says how the Wellslip family is designed to handle information. It is here so a lawyer can review it before anything is published as a policy.
Wellslip is made by Kay Software Works LLC. There are three products: Wellslip Desktop, a desktop app; Wellslip Mobile, an iPhone app; and Wellslip Sync, an optional paid add-on that is not available yet.
This website
wellslip.com is a static site. The pages are files. There is no account, no newsletter, and no form that sends us what you type. The site does not use advertising, and it does not set analytics cookies.
A normal visit still produces the usual server log data any website receives, such as an IP address and the page requested. This draft does not set a retention period for those logs. That has to be written down before a policy is published.
A mailing address and a privacy contact address are not published in this draft either. Both are for the legal review to fill in.
Wellslip Desktop
Wellslip Desktop is the free desktop app for Mac and Windows, formerly called Stowe. It is open source under the MIT license. Current builds are the Stowe releases on GitHub. The downloaded app may still be named Stowe.
The app stores your expenses and receipt files on the computer where you run it. On macOS that folder is ~/Library/Application Support/Stowe/. On Windows it is %LOCALAPPDATA%\Stowe\. It does not have a Wellslip account. It does not upload those receipts to us.
The packaged app is built to listen only on that computer (127.0.0.1). The Stowe project states that the packaged app does not include analytics or telemetry, and that opening it does not fetch scripts, fonts, or stylesheets from the internet. Treat that project’s notes as the detail for the build you download. If a later build changes this, this draft should change first.
If you run the app from source, setup can download language packages over the internet. That download is not your receipt database. The database still stays on the computer.
We do not hold a copy of Wellslip Desktop’s data. Deleting it means deleting that folder on the computer. Uninstalling the app does not, by itself, remove the folder.
Wellslip Mobile
Wellslip Mobile is a free iPhone app. It is not on the App Store yet. There is no download link until it is listed. The places on this site that say “Coming soon” do not go anywhere.
Wellslip Mobile is designed to store receipts on the phone, without a Wellslip account, and without Wellslip Sync. It is not shipped, so there is no Wellslip Mobile service receiving your receipts today. This section will be updated before the app is released if any of that changes.
When Wellslip Mobile is on the App Store, Apple’s own account and payment practices are Apple’s, not this page. This draft will name anything Wellslip itself receives before the app ships. Removing the app’s on-phone data is done on the phone. The exact steps will be written down before release.
Wellslip Sync
Sync is a paid add-on. It is not available yet, and this site does not list a price. The intended pieces are end-to-end encrypted sync between Mobile and Desktop, and a web vault at vault.wellslip.com. Both are coming soon. There is no sign-up for Sync on this website.
Sync is optional. Wellslip Desktop and Wellslip Mobile are meant to keep working, with the receipts already on the device, if you never turn Sync on. Turning Sync off on the phone has to leave the phone’s own receipts usable.
When Sync is on, the design is:
- You sign in with a code sent to your email. That email is stored on the server.
- A Sync passphrase, separate from that email code, unlocks the receipts. The passphrase is not sent to the server.
- A recovery code of 24 words is the other way to unlock them. If you lose both the passphrase and the recovery code, we cannot read the receipts, and we cannot reset that key for you.
- Receipt text and images are encrypted on the device before upload. On the web vault, that encryption happens in the browser. The server stores ciphertext.
The readable contents — merchant, amounts, the date on the receipt, category, notes, and the image — are what that encryption covers. Sync times stored on the server are not the same thing as the date printed on a receipt.
The server still sees some information, because sync needs it:
- The account email.
- Item identifiers, and whether an item is a receipt, a claim, or a setting.
- Ciphertext sizes, and a hash of the stored ciphertext.
- Times and version numbers used to sync.
- Whether an item was deleted.
- Device names.
- The storage path of an encrypted image. The file at that path is ciphertext, not a viewable picture.
We do not sell that metadata. We do not use it for advertising. The design has no ads. The server is built so one account cannot read another account’s rows. A database compromise is not supposed to reveal receipt contents without the key. That is a design goal, not a promise that no bug will ever exist.
Deleted receipts stay as tombstones long enough for your devices to learn about the deletion, and are then removed, with their image files, after 30 days. Deleting the account removes the wrapped key, the ciphertext rows, the image files, and the sign-in.
Sync is not launched. Treat this section as the design a lawyer still has to review, not as a description of a service you can open today. It is not a HIPAA analysis, and Wellslip is not offered as a medical service.
What we do not do
- We do not sell your personal information.
- We do not take payment on this marketing site, and there is no form here that posts your information anywhere.
- We do not ask the free apps to create a Wellslip account.
- Receipt contents are not an advertising product. Wellslip Desktop does not send them to us. Wellslip Mobile, as designed, keeps them on the phone. Sync encrypts them before upload.
Children
Wellslip is a record-keeping tool for your own health expenses. It is not directed at children under 13, and we do not knowingly collect their personal information.
Requests
Access, correction, and deletion rights depend on where you live. Those steps are not finalized in this draft. The products that would hold an account are not launched, and a lawyer has not reviewed this page. For Wellslip Desktop, the practical deletion step today is to delete the data folder on that computer, because we do not have the receipts.
Tax and health rules
Wellslip is not tax advice. Keeping a receipt here does not decide whether an expense is qualified. That question belongs to you, the IRS, and your own advisor. IRS Publication 969 is the usual starting point. This draft is not a determination under HIPAA or any other health-privacy statute.
Changes
This page is a draft. After legal review, a published policy would replace it, and the page would say when it took effect. If a product’s behavior changes before launch, this draft should change first. Until that review happens, the note at the top stands: draft, pending legal review, not in effect.
Contact
Kay Software Works LLC. A contact address for privacy requests is not published yet. Questions about the open-source desktop app can go to the Stowe issue tracker.