Sub-processors

The list

Supabase

• What it does - the database, file storage and sign-in.
• Where - Amazon Web Services, eu-west-1, Ireland. Inside the European Union.
• What it holds - everything: your account and password, your display name, trips, plans, expenses, splits, settlements, receipt photographs, trip photographs and profile pictures. Also the Android waitlist, if you joined it on this website - a first name, an email address and the date, and nothing else.
• Transfer out of the EU - none.

OpenAI

• What it does - reads the text off a receipt photograph or a booking screenshot so the items and amounts can be filled in for you.
• Where - United States.
• What it gets - the image, and a fixed instruction. No name, no email, no account identifier, no trip identifier and no other member's name is sent.
• Transfer mechanism - the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914), incorporated in OpenAI's data processing terms.
• Training - inputs and outputs sent to the API are not used to train OpenAI's models. This is the developer API, which is not the consumer ChatGPT product.

Expo (Expo Application Services)

• What it does - delivers push notifications to your device.
• Where - United States.
• What it gets - your device's notification token, and the content of each notification: the name of the member who added something, the trip name and the title of the expense or plan.
• Transfer mechanism - Standard Contractual Clauses.
• How to stop it - turn notifications off for Deline in iOS Settings. Nothing is sent after that.

Apple

• What it does - distributes the app, takes subscription payments, and delivers notifications for the last leg after Expo.
• Where - Apple's own infrastructure.
• What it gets - your payment details, which we never see; the notification payload for delivery; and it gives us aggregate install statistics that identify nobody.
• Note - for the subscription itself Apple is not acting on our behalf. It is the merchant, with its own relationship with you.

Resend

• What it does - delivers the two emails your account can generate: a link for setting a new password, and a link for confirming your email address when you sign up. It sends nothing else, and there is no newsletter or marketing mail.
• Where - Resend's European region, in Ireland.Inside the European Union.
• What it gets - your email address, and the message itself. The message contains a one-time link and nothing about your trips, the people you travel with or what anyone spent.
• What it does not get - your display name, your password, and no trip content of any kind.
• Transfer out of the EU - none.

PostHog

• What it does - product analytics: which screens are reached, which flows are abandoned, what breaks.
• Where - eu.posthog.com, in Deline's own project.Inside the European Union.
• What it gets - named product events, screen views by route pattern, app lifecycle events, a small allow-listed set of properties (counts, booleans, short fixed values), and standard device and app metadata: device type, model, operating system, app version and screen size. Tied to an opaque account identifier.
• And from this website, since 20 August 2026 - a page view, leaving the page, and a tap on a Download button, carrying the link parameters you arrived with. Tied to nothing: the site stores no identifier on your device, so a visit is anonymous and cannot be joined to another visit or to an app account.
• What it does not get - no email address or display name; no trip names, member names, place names, expense descriptions or amounts; no session replay; no autocapture; no location, because the network-address lookup that would infer one is switched off and IP addresses are anonymised on arrival.
• Retention - events are kept for 12 months.
• Transfer out of the EU - none.

Cloudflare

• What it does - serves deline.dev, this page included.
• Where - global edge network.
• What it gets - the technical details of a web request: IP address, user agent, the page asked for. It does not receive app data, trip content or expenses.

What is deliberately not on this list

Each of these was checked against the shipped build rather than assumed, because an inaccurate "we do not" is worth less than nothing:

• No crash reporting or diagnostics provider.
• No advertising analytics. PostHog is above, in the EU. In the app it is used for product analytics only, and receives nothing that could identify a person beyond an opaque account code. On the website it also records which shared link a visit arrived from, which is marketing measurement - but it is first-party, it is in the EU, and the visit is anonymous. It is not an advertising tool and no advertiser is involved.
• No advertising network, ad SDK or conversion pixel.
• No attribution or install-tracking provider.
• No data broker, and nothing is sold to anyone.
• No payment processor, because Deline never touches money - Apple bills subscriptions and nothing else is charged.

Changes to this list

If a processor is added or removed, this page changes in the same release as the code, not after it, and the date at the top moves. If the change is significant - a new company receiving your content, or a new transfer out of the EU - you will be told in the app as well.

Questions

support@deline.dev