JouraLast updated: September 29, 2026. These are the service providers ("subprocessors") that process limited information on our behalf to operate Joura. Each acts under a written data-processing agreement or the provider's standard data-protection terms, and only processes information to provide its service to us. None of them receives the encrypted, on-device content described in our Privacy Policy (your moments, notes, or your child's information), except what you choose to send us, such as feedback or a moment you send so we can add a tip.
| Provider | What it does for us | Data it handles | Primary region | Transfer safeguard |
|---|---|---|---|---|
| PostHog | Product analytics (structural usage events) | Anonymous identifier + structural events; no content | United States | SCCs / UK IDTA via DPA |
| Supabase | Backend: analytics mirror, opt-in feedback, polls, newsletter, and optional accounts | Pseudonymous identifier; feedback text, poll answers, a moment you choose to send us, and an optional email you choose to give; newsletter email; your account email and sign-in ID, only if you save an account | United States | SCCs / UK IDTA via DPA |
| Sentry | Crash and error diagnostics | Structural crash data; no content; configured with personal identifiers off, so it does not store your IP | United States | SCCs / UK IDTA via DPA |
| RevenueCat | Subscription management | Purchase and subscription status tied to an anonymous identifier | United States | SCCs / UK IDTA via DPA |
| Vercel | Website hosting and privacy-conscious site analytics | Standard web request data; aggregate analytics | United States / global edge | SCCs / UK IDTA via DPA |
| Apple | App distribution and in-app purchases (iOS) | Purchase records under Apple's own policy | United States / global | Apple terms; SCCs where applicable |
| App distribution and in-app purchases (Android) | Purchase records under Google's own policy | United States / global | Google terms; SCCs where applicable | |
| Resend | Sends sign-in codes and the emails you ask for | Your email address and the email's content | United States | Resend's data-processing terms |
| Slack | Our team's internal feedback digest | The feedback you send, poll totals, and moments you sent us | United States | Slack's standard terms |
| Transactional email provider | Sends newsletter and reply emails | The email address you submit | United States | SCCs / UK IDTA via DPA |
Our standard
We keep this list current and short. We choose providers that support strong data-protection commitments, we sign a data-processing agreement with each, and we do not use vendors from jurisdictions we have chosen to avoid on security grounds. For international transfers we rely on the European Commission's Standard Contractual Clauses (and the UK IDTA), and on the EU-U.S. Data Privacy Framework where a provider is certified. See the EU / UK Privacy Notice for detail.
Changes
If we add, remove, or change a provider, we will update this page and the date above. Questions: support@heyjoura.com.