Privacy
How the Wellhead Field app handles information. Last updated 6 October 2026.
Wellhead Field is field-service software for well pump and pressure tank contractors. Every contractor runs it for its own technicians, customers and wells; the contractor, below, is the one whose work you are looking at. It replaces a paper job ticket: it records what was found at a well, what was done, and what was fitted.
Who uses it, and whose information it holds
These are not the same people, and it matters.
- The users are the contractor's own staff. The app is not available to the public — there is no sign-up, and a phone holds nothing and cannot be used until the contractor's office connects it with a code it issues.
- The information is mostly about the contractor's customers and their properties. Those customers do not use the app.
So if you are a customer of a contractor that uses Wellhead Field and you are reading this: the app is how the technician who visited you recorded the work. The section below on getting in touch applies to you.
What it records
- Where a well is. The app can take a precise satellite position, so the next visit can find the wellhead rather than knocking on a door. It asks for location only while it is open and in use; it never follows a phone in the background.
- Names, telephone numbers and addresses of customers and their properties.
- Photographs of equipment — the well cap, the pitless adapter, the pressure tank, the electrical panel. The app takes these with the camera. It never opens the phone's photo library and cannot see photographs it did not take.
- Notes about the property written by the technician: what the customer reported, how to get in, and hazards such as a dog.
- Signatures, as a photograph together with the name of the person who signed, when work or an estimate is approved.
- Measurements and equipment records — depths, pressures, what was fitted and what came out.
- Feedback, when someone chooses to send it — what they write and, if they attach it, a picture of one of the app's own screens, together with the app's version and the phone's operating system. The picture is of the app only: never the photo library, another app, or the rest of the phone. It can show whatever was on that screen, including a customer's details.
- A message sent from wellhead.io — the sender's name and email address, anything they choose to add for company and telephone, and the message itself. A short-lived internet address is used to enforce the form's rate limits and is not kept on the message.
Where it goes
From the phone, to the server run for the contractor, over an encrypted connection. The phone sends it nowhere else. The one thing that leaves by another road is a text message to a customer: the app writes it into the phone's own messaging app, and the technician sends it from there.
No advertising, no analytics, no tracking. The app and the office's pages contain no advertising, no analytics, no crash reporting and no tracking of any kind. Nothing is sold, and nothing is shared with anyone for their own purposes. Information is disclosed only where the law requires it — for example a water sample result that Wisconsin's well code obliges a licensed pump installer to report.
The app works offline, because a farm often has no signal. Work is stored on the phone and sent to the contractor's server when there is a connection.
Feedback travels the same way to the same server, but it is for the people who make Wellhead Field rather than for the contractor: they read it, to fix and improve the app, and the contractor's office does not see it. It is not sent anywhere else.
Public records the server looks up
Much of what a technician needs to know about a site is already on public record: the well the state has on file, whether a deeper casing is required there, the soil. The server asks the government services that hold those records, and the office's map is drawn from public map services. Each is sent only what it needs to answer, listed here. None of them is sent a customer's name, telephone number, photograph or notes.
- Wisconsin Department of Natural Resources (dnrmaps.wi.gov, apps.dnr.wi.gov): a site's map position, to find the wells, casing and landfill areas and the tax parcel there; the house number, street name and county of a site's address, to find the wells and the parcel the state files at that address; and a well's state well number, to find the state's record of it and fetch its construction report and water sample history.
- U.S. Census Bureau geocoder (geocoding.geo.census.gov): a site's street address, town and ZIP code, to place the site on the map from its address.
- U.S. Department of Agriculture soil survey (sdmdataaccess.sc.egov.usda.gov): a site's map position, to read the soil there.
- OpenStreetMap (tile.openstreetmap.org): the office's schedule map is drawn from its map images. The office's browser fetches the images for the area on screen, so OpenStreetMap receives that area, the office computer's internet address and the web address of the contractor's server, as any website would. The pins, names and jobs drawn over the map are not sent, and neither is the address of the office page showing it.
- OSRM road routing (router.project-osrm.org), when road times are switched on: the map positions of the contractor's yard and of a day's stops, as bare coordinates, to work out driving times and draw the route. Nothing else about the jobs is sent.
The phone does not contact any of these itself. They are asked by the contractor's server, or by the office's browser for the map, and every one of them is a public service that needs no account.
How long it is kept
A job record is a business and regulatory record. Wisconsin's well code sets duties that run for years after a visit, and a well's history is the point of the app — what a pump was drawing in 2026 is how somebody judges it in 2031. So records are kept, and removing one marks it as removed rather than erasing the history. Backups are held for seven days.
Feedback is kept in the same way. A picture sent with it is the exception: it can be erased, and then it is gone from the server, and from the backups within seven days.
A public contact message is kept only to answer it and operate Wellhead. It is removed no later than 12 months after it is marked handled. Spam-control attempt records are short-lived and are removed after 30 days.
Getting in touch
To ask what is held about you, to correct it, or to ask that it be removed, write to privacy@wellhead.io.
Changes
This page is part of the app itself and is updated in the same change as the behaviour it describes. The date at the top is the day its wording last changed.