Subprocessors
Effective Date: July 2026
A subprocessor is a third party that processes customer data on our behalf. This is the complete list for Timestamp It. Each provider is bound by its own contractual confidentiality and security obligations, and we do not sell customer data to any of them.
Current subprocessors
| Provider | Purpose | Data Involved | Processing Location |
|---|---|---|---|
| Supabase | Application database, authentication, and backend functions. | Account records, project and team data, captions, notes, and usage events. | United States — AWS US East (Ohio), us-east-2 |
| Backblaze B2 | Cloud object storage for the photos and videos you capture or import. | Stamped photos, videos, and thumbnails uploaded from your account. | United States — US West (Sacramento and Phoenix) |
| Resend | Delivery of transactional email (account activation, project and team invitations, collaborator notifications) and product email. | Recipient email address, display name, message contents, and delivery/open/click events. | United States |
| RevenueCat | Subscription entitlement management — tracking whether a subscription is active. | Account identifier and subscription lifecycle events. No payment card data. | United States |
| Umami | Privacy-focused website analytics — page views and referrers on timestampitapp.com. Not used inside the app. | Aggregate page view data. No cookies and no cross-site tracking. | United States |
| Apple | iOS app distribution, in-app purchase processing, and push notification delivery (APNs). | Purchase records and push notification tokens. | United States (global infrastructure) |
| Android app distribution, in-app purchase processing, and push notification delivery (FCM). | Purchase records and push notification tokens. | United States (global infrastructure) |
Processing locations were last verified against each provider's published subprocessor list and data processing addendum in July 2026.
What we do not use
Reviewers usually want to know what is absent as much as what is present:
- No advertising networks or ad SDKs. We do not run ads and do not share data with advertising platforms.
- No data brokers. We do not sell, rent, or trade customer data.
- No AI provider in our own stack. We do not send your photos, videos, notes, or project data to any AI model, and no customer data is used to train models. Note that our email and subscription providers do list AI vendors among their own subprocessors for their internal operations — we mention it because it is public on their subprocessor pages, not because your content is routed there.
- No third-party form or survey services. Contact and pricing inquiries submitted on this site are handled by our own backend and delivered by our email provider. They do not pass through an external form relay.
- No offshore data storage. Every provider above processes customer data in the United States. We operate no storage or database replicas outside the country.
- In-app usage analytics stay in-house. What you do inside the app — projects, captures, feature usage — is recorded in our own database, not sent to a third-party analytics vendor. Our marketing website uses a privacy-focused analytics tool for page views, listed above; it is not present in the app and never sees your photos or project data.
Changes to this list
We give 30 days advance notice before a new subprocessor begins processing customer data. This page is updated at the same time, and account holders are notified by email. If you object to a change, contact us at team@timestampitapp.com before it takes effect.