The same architecture underlies every app, and it is the reason the privacy claims are short.
What is true of every app
- There is no Wells Code account. There is no separate Wells Code username or password.
- There is no Wells Code app-content sync server. Your private libraries do not pass through Wells Code infrastructure. Watchlist uses two limited Wells Code services for a channel lookup and an embedded-video check when you choose those features.
- Sync is your own private iCloud. Each app has its own iCloud container in your account.
- No tracking, no analytics profile, no ads.
Per app
- Echo stores synced entry text in standard CloudKit fields in your private iCloud database. Apple encrypts it in transit and on its servers; Echo does not currently provide end-to-end encryption for synced entry text. Optional Apple Intelligence features are processed on your device. See Echo’s privacy in practice.
- Circle never stores names, numbers, addresses, photos or birthdays. Apple Contacts holds those, and Circle reads them live. Only circles, stars, frequencies and interactions are synced. See What Circle syncs.
- Beacon requests feeds directly from publishers, with no proxy in between. Settings ▸ General ▸ Load article images controls whether remote images are fetched at all.
- Watchlist touches YouTube, so it has the most connections to explain, all of them disclosed in the app before you start. See Watchlist, YouTube and your data.
- Aurora draws every wallpaper on your device and makes no network requests of its own. Collections sync through your private iCloud, with wallpaper names and designs in encrypted fields. On iPhone and iPad it asks only to add pictures to Photos; it cannot read your photo library. See What Aurora syncs.
- Orbit keeps everything in your own library and iCloud container by default. AI client connections are optional and off until you create one. Each client gets its own revocable, profile-scoped credential to read and make Orbit’s bounded task and Space changes; the connected AI provider then becomes an additional privacy boundary for the profiles you selected. See Connect Orbit to an AI client.
Where the real boundaries are
These protections have limits:
- Your Apple Account controls access to iCloud sync and backups. Protect it with two-factor authentication.
- An unlocked device is unlocked data. Echo offers a journal lock; the other apps rely on your device passcode.
- Exports are plain files. They are deliberately readable so other software can read them. Store them accordingly.
- Purchases go through Apple. Apple, not Wells Code, handles payment; we never see your payment details.
- Optional integrations change the perimeter. If you deliberately connect Orbit to an AI client, that client may send selected task data to its own provider. Orbit explains this before the connection is created and lets you revoke each credential locally.
The full policy is at wellscode.com/privacy.