ThriveOS™Legal
Service Providers and Subprocessors
This shared directory identifies the services supporting the ThriveOS website and our applications, including future applications that link to these policies, what they do, and the information involved. Read it with our Privacy Policy.
A provider receives data only for the applications and features it supports. Reusing this directory does not mean every provider receives data from every app. Examples naming Start-ish describe that app; provider use in another app depends on its enabled features and disclosures. Some act as processors on our behalf; others, such as app stores, have independent responsibilities. A provider's own infrastructure suppliers may also process data under its contractual arrangements.
Providers processing data for our services
Supabase
Applies to: ThriveOS applications and website where backend services are used, including Quotella
Purpose: Account authentication, backend functions, application data storage where offered, public content and website waitlists.
Data: Account identifiers, email and authentication information; user content stored for cloud features where offered or passing through AI functions; network and request information; waitlist addresses and sign-up source. Start-ish task history is stored locally rather than synchronized to a Supabase task database.
Processing location: Database: Mumbai, India. Other infrastructure processing depends on the service.
OpenAI
Applies to: Applications with OpenAI-powered features, including Start-ish. Not used by Quotella.
Purpose: AI processing for the enabled feature, such as suggestions, image analysis, summaries, reflections and generated speech.
Data: Relevant text, selected images and context, progress summaries, reflection text, language/tone preferences and derived safety identifiers as required by the feature.
Processing location: May be processed in the United States and other locations used by OpenAI.
Anthropic (Claude)
Applies to: Quotella (“In your own words”). Not used by Start-ish.
Purpose: AI suggestions and other AI features when enabled and disclosed for the relevant feature.
Data: The text the user types for the feature (up to 280 characters) and our list of themes. Not stored by us.
Processing location: May be processed in the United States and other locations used by Anthropic.
RevenueCat
Applies to: Applications using RevenueCat subscriptions, including Start-ish and Quotella
Purpose: Subscription entitlements, purchase validation and restoration.
Data: Subscriber/account identifiers, purchase and transaction information, entitlement status and SDK technical information. A subscriber ID can be linked to your account.
Processing location: International processing under RevenueCat’s service arrangements.
Upstash
Applies to: Application backends using rate limits, including Start-ish. Not used by Quotella.
Purpose: Request rate limiting and abuse prevention.
Data: Derived installation, account or network identifiers and request counters. Our rate-limit calls do not include brain dump text, task images or reflection content.
Processing location: Hosting depends on the configured database and service infrastructure.
TelemetryDeck
Applies to: Applications with TelemetryDeck analytics enabled, including Start-ish. Not used by Quotella.
Purpose: Understand feature use and improve the product.
Data: Event names, counts, durations, outcomes, app/device metadata and SDK-generated identifiers. We do not intentionally send task text, images, brain dumps or account email addresses as event properties.
Processing location: Provider-managed analytics infrastructure; see its privacy documentation.
PostHog
Applies to: Quotella
Purpose: Product usage analytics.
Data: Event names and limited properties, app/device metadata and a random installation identifier. Client IP addresses are discarded. We do not send quote text, typed text or theme titles.
Processing location: Per PostHog’s service arrangements.
Sentry
Applies to: Applications with Sentry diagnostics enabled, including Start-ish and Quotella
Purpose: Crash reporting and error investigation.
Data: Crash traces, errors and technical app/device context. Client IP addresses are discarded for Quotella. Default personally identifying information forwarding is disabled; technical reports may still contain identifiers or contextual data.
Processing location: United States ingestion endpoint in the current integration.
Resend
Applies to: ThriveOS account emails where configured, including Quotella
Purpose: Deliver sign-in, confirmation and password-reset emails.
Data: Recipient email, message content and delivery information.
Processing location: United States and supporting service infrastructure.
Platform and payment providers
- Apple: distribution of our iOS applications, in-app billing, Sign in with Apple and iOS services. Apple may process purchase records, Apple Account information, speech audio when server recognition is used, diagnostics and data associated with enabled system services. Apple acts independently for its platform services. See Apple's privacy information.
- Google: distribution and payments for ThriveOS applications available through Google Play. This does not apply to the native Start-ish or Quotella iOS apps. See Google's privacy policy.
- Paddle: merchant of record for web purchases where offered, processing billing identity, address, tax information and payment details as an independent controller. It does not process Start-ish or Quotella App Store payments. See Paddle's privacy policy.
Other ThriveOS application infrastructure
Some other ThriveOS applications use Expo for builds, updates and, where enabled, push delivery. Relevant services may process app/device information and push tokens. The native Start-ish iOS app does not use Expo. See Expo's privacy policy.
Website delivery and network infrastructure also process connection information needed to serve pages securely. The providers above are not a claim that every service receives every category of data.
AI training and retention
We do not use AI inputs or outputs for model training or authorize our AI providers to do so. Our AI providers exclude commercial API content from model training by default. We do not opt user content into voluntary training or data-sharing programs. AI providers can still retain information for service delivery, safety, abuse prevention and legal obligations.
OpenAI's abuse-monitoring retention is generally up to 30 days, subject to exceptions. Disabling response storage does not remove all provider retention. Anthropic's retention is governed by its Commercial Terms, applicable data-processing agreements and service-specific policies, including safety-enforcement and legal exceptions. These details are subject to the applicable service terms; see the linked provider documentation and our retention section.
Changes and questions
We update this page when our provider arrangements materially change. Listing a planned provider does not replace any required notice or consent before data sharing begins. Processing locations can extend beyond a provider's headquarters or your database region; applicable transfer safeguards are described in our Privacy Policy.
For questions about a provider, retention, safeguards or your data, email support@thriveos.app.