Sub-processors
Who else touches your data
Last reviewed: June 8, 2026
A “sub-processor” is any company we hire to do part of the work of running Belong — storage, AI inference, payments, sign-in, and so on. We try to keep this list as short as the product allows.
Each entry below tells you what the sub-processor receives, where they run it, why we use them, how long they keep it, and whether they train AI models on what we send. If the answer to the last column is anything other than “No,” we’ll say so plainly.
None of these companies are advertising networks or data brokers. We do not use ad networks, attribution SDKs, or third-party trackers anywhere in the app or on the website.
Current sub-processors
| Name | What they get | Where | Why | Retention | Trains on it? |
|---|---|---|---|---|---|
| Anthropic | Your transcripts, synthesized profile, recent chat context, and relevant memory snippets — sent at the time of each AI request, when you have selected Claude as your AI provider. Also used regardless of provider choice for the Day 7 challenge profile extraction and the Day 7 capstone reflection. | United States | Generates reflections, reports, chat responses, and memory extractions via the Claude API. | Up to 30 days under Anthropic’s standard commercial API terms, retained for safety and abuse monitoring then auto-deleted. (We are pursuing a Zero Data Retention agreement; this row will be updated when it is in effect.) | No — commercial API terms prohibit training on customer data. |
| Your transcripts, synthesized profile, recent chat context, and relevant memory snippets — sent at the time of each AI request, when you have selected Gemini as your AI provider. Free-tier accounts default to Gemini. Never receives data for the Day 7 challenge profile extraction or the Day 7 capstone reflection (those always use Claude). | United States | AI reflections, reports, chat, and memory extractions when the user selects Gemini, via the Google Gemini API. | Per Google’s standard Gemini API terms for paid usage, content may be retained for a limited period for abuse monitoring, then deleted. | No — per Google’s Gemini API terms for paid usage, prompts and responses are not used to train Google’s models. | |
| Supabase | Account, profile, journal entries, transcripts, audio recordings, AI content, embeddings, and logs. | United States (us-west-1) | Primary database, file storage, authentication, and edge functions. | Life of your account; encrypted backups roll off after 30 days. | No. |
| RevenueCat | An anonymous app-user identifier and Apple StoreKit transaction metadata (state, dates). | United States | Manages subscription state across devices and reinstalls. | Life of your subscription, plus their internal log retention. | No. |
| Apple — WhisperKit (on-device) | Your audio, processed on your iPhone. In almost all cases transcription is fully on-device; only if it fails is the recording sent to OpenAI Whisper as a fallback (see OpenAI below). | Your device | Transcribes voice to text on-device, without sending audio to a server except for the rare fallback case. | None on-device — nothing leaves your device for transcription unless the fallback is triggered. | No. |
| Apple — Sign in with Apple | Your Apple ID identifier and (only if you choose to share it) your email and name. | United States | Authenticates you without us seeing a password. | Per Apple's policy. | No. |
| Apple — Push Notification Service (APNs) | A device push token and a generic notification payload (e.g., "Your reflection is ready"). Payloads never contain entry, reflection, or chat content. | United States | Delivers push notifications to your iPhone. | Token rotates on reinstall or revocation; per Apple's policy otherwise. | No. |
| Google — Sign-In | Your Google account identifier and your email and name. | United States | Authenticates you without us seeing a password. | Per Google's policy. | No. |
| OpenAI — Embeddings, TTS & fallback transcription | Your chat messages, short summaries/excerpts of your entries, and extracted memory snippets (for embeddings used in memory search); AI-generated reflection text (for text-to-speech); and — only if on-device transcription fails — the audio recording for that entry (for fallback transcription). OpenAI does not generate your reflections or chat, and does not receive the full text of your journal entries (only short summaries/excerpts). | United States | text-embedding-3-small produces vectors used for memory search; gpt-4o-mini-tts produces audio playback for reflections; whisper-1 provides backup transcription when on-device speech-to-text fails. | Up to 30 days under OpenAI's commercial API abuse-monitoring policy, then deleted. | No — commercial API terms prohibit training on customer data. |
| Resend | Recipient email address, subject line, and email body for transactional messages (deletion confirmations, beta-feedback acknowledgements). | United States | Sends transactional email from noreply@belongjournal.ai. No marketing tracking pixels. | Send logs retained for proof of delivery; per Resend's policy. | No. |
| Vercel | Aggregate, cookie-less page-view counts on belongjournal.ai. No per-user identifiers, no cross-site tracking. | United States | Hosts the marketing site and provides aggregate analytics. | Per Vercel's policy. | No. |
Notice before we add a new sub-processor
Before we route customer data to a new sub-processor that handles journal content, transcripts, AI inference, audio storage, embeddings, or push notifications, we will:
- Update this page at least 30 days in advance, with the new entry and the planned go-live date.
- Update the “Last reviewed” date at the top.
- Post a dated changelog entry below describing what changed and why.
- Send a one-time email via Resend to the address on file for active accounts when the change is material (i.e., adds a new vendor that touches journal content or AI inputs).
Adding an infrastructure provider that does not touch journal content (e.g., a CDN, status-page host, or error-monitoring tool processing only non-content metadata) will be reflected on this page but may not trigger a 30-day email notice.
Changelog
- May 4, 2026 — Initial publication of this page.
Questions about any sub-processor on this list? Email matthewericesposito@gmail.com.