Our providers
| Vendor | Service | Data involved | Processing location | Added / changed |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, private storage, and server-function hosting (runs on cloud infrastructure providers; see Supabase's own subprocessor list) | Service data, including letter content (encrypted in transit and at rest), account data and private photos | Primary project region: US East, Northern Virginia (us-east-1). This does not establish US-only processing for every support, edge, log or downstream service | November 4, 2026 |
| Google LLC (Google Workspace) | Email hosting for theloveenvelope.net, including support correspondence; custom SMTP used by Supabase Auth for verification, sign-in and recovery emails | Email addresses, message content and metadata; authentication codes or links. Auth email never carries letter content; support correspondence contains what the sender submits | Locations depend on Google's applicable terms, service and configured Workspace data-region coverage; US-only processing is not asserted | November 4, 2026 |
| Expo (650 Industries, Inc.) | Notification registration/renewal and push relay (Expo Push Service); build/credential service (EAS) | Installation identifier, native push token/type, app/project identifiers and development-service flag for registration; Expo push tokens and content-free notification payloads; app builds and platform credentials used by EAS, not letter content | Locations under Expo's applicable service and subprocessor terms; US-only processing is not asserted | November 4, 2026 |
| Apple Inc. | Push delivery (APNs); iOS distribution and platform services | Push tokens and content-free notifications; device and distribution information handled by Apple. The current app has no in-app purchases | Locations under Apple's applicable service terms; US-only processing is not asserted | November 4, 2026 |
| OpenAI (Sites), using Cloudflare infrastructure | Public website hosting and delivery; separate from the mobile letter service | Website request information such as IP addresses, requested pages, browser information and request time. The website does not connect to private letter accounts or collect letter submissions | Provider infrastructure and processing locations; see OpenAI's subprocessor list and Cloudflare's privacy policy. US-only website processing is not asserted | November 4, 2026 |
External links
This version of the app does not offer place search. Some date ideas, and places saved on plans, open Google Maps or another provider through a link. Opening one sends the visit's request information directly from your device to that service, which handles it under its own terms and privacy policy. These services are not our service providers.
We use no advertising, analytics, crash-reporting, or data-brokerage vendors. Material changes to this list are posted here with the date and, where required, notified in-app.
Your questions deserve a clear answer.
Contact us