Sub-processors
Who else touches your data
Last reviewed: May 4, 2026
A “sub-processor” is any company we hire to do part of the work of running Belong — storage, AI inference, payments, sign-in, and so on. We try to keep this list as short as the product allows.
Each entry below tells you what the sub-processor receives, where they run it, why we use them, how long they keep it, and whether they train AI models on what we send. If the answer to the last column is anything other than “No,” we’ll say so plainly.
None of these companies are advertising networks or data brokers. We do not use ad networks, attribution SDKs, or third-party trackers anywhere in the app or on the website.
Current sub-processors
| Name | What they get | Where | Why | Retention | Trains on it? |
|---|---|---|---|---|---|
| Anthropic | Your transcripts, synthesized profile, recent chat context, and relevant memory snippets — sent at the time of each AI request. | United States | Generates reflections, reports, chat responses, and memory extractions via the Claude API. | Up to 30 days under Anthropic’s standard commercial API terms, retained for safety and abuse monitoring then auto-deleted. (We are pursuing a Zero Data Retention agreement; this row will be updated when it is in effect.) | No — commercial API terms prohibit training on customer data. |
| Supabase | Account, profile, journal entries, transcripts, audio recordings, AI content, embeddings, and logs. | United States (us-west-1) | Primary database, file storage, authentication, and edge functions. | Life of your account; encrypted backups roll off after 30 days. | No. |
| RevenueCat | An anonymous app-user identifier and Apple StoreKit transaction metadata (state, dates). | United States | Manages subscription state across devices and reinstalls. | Life of your subscription, plus their internal log retention. | No. |
| Apple — WhisperKit (on-device) | Your audio, processed on your iPhone only. | Your device | Transcribes voice to text without sending audio to a server. | None — nothing leaves your device for transcription. | No. |
| Apple — Sign in with Apple | Your Apple ID identifier and (only if you choose to share it) your email and name. | United States | Authenticates you without us seeing a password. | Per Apple's policy. | No. |
| Apple — Push Notification Service (APNs) | A device push token and a generic notification payload (e.g., "Your reflection is ready"). Payloads never contain entry, reflection, or chat content. | United States | Delivers push notifications to your iPhone. | Token rotates on reinstall or revocation; per Apple's policy otherwise. | No. |
| Google — Sign-In | Your Google account identifier and your email and name. | United States | Authenticates you without us seeing a password. | Per Google's policy. | No. |
| OpenAI — Embeddings & TTS | Memory snippets (for embeddings) and AI-generated reflection text (for text-to-speech). Never your raw entries or chat messages. | United States | text-embedding-3-small produces vectors used for memory search; gpt-4o-mini-tts produces audio playback for reflections. | Up to 30 days under OpenAI's commercial API abuse-monitoring policy, then deleted. | No — commercial API terms prohibit training on customer data. |
| Resend | Recipient email address, subject line, and email body for transactional messages (deletion confirmations, beta-feedback acknowledgements). | United States | Sends transactional email from noreply@belongjournal.ai. No marketing tracking pixels. | Send logs retained for proof of delivery; per Resend's policy. | No. |
| Vercel | Aggregate, cookie-less page-view counts on belongjournal.ai. No per-user identifiers, no cross-site tracking. | United States | Hosts the marketing site and provides aggregate analytics. | Per Vercel's policy. | No. |
Notice before we add a new sub-processor
Before we route customer data to a new sub-processor that handles journal content, transcripts, AI inference, audio storage, embeddings, or push notifications, we will:
- Update this page at least 30 days in advance, with the new entry and the planned go-live date.
- Update the “Last reviewed” date at the top.
- Post a dated changelog entry below describing what changed and why.
- Send a one-time email via Resend to the address on file for active accounts when the change is material (i.e., adds a new vendor that touches journal content or AI inputs).
Adding an infrastructure provider that does not touch journal content (e.g., a CDN, status-page host, or error-monitoring tool processing only non-content metadata) will be reflected on this page but may not trigger a 30-day email notice.
Changelog
- May 4, 2026 — Initial publication of this page.
Questions about any sub-processor on this list? Email matthewericesposito@gmail.com.