Subprocessors
Effective Date: July 2026
A subprocessor is a third party that processes customer data on our behalf. This is the complete list for Timestamp It. Each provider is bound by its own contractual confidentiality and security obligations, and we do not sell customer data to any of them.
Current subprocessors
| Provider | Purpose | Data Involved | Processing Location |
|---|---|---|---|
| Supabase | Primary infrastructure — application database, authentication, file storage for photos and videos, and backend functions. | All account records, project and team data, photos, videos, notes, and usage events. | United States — AWS US East (Ohio), us-east-2 |
| Resend | Delivery of transactional email (account activation, project and team invitations, collaborator notifications) and product email. | Recipient email address, display name, message contents, and delivery/open/click events. | United States |
| RevenueCat | Subscription entitlement management — tracking whether a subscription is active. | Account identifier and subscription lifecycle events. No payment card data. | United States |
| Apple | iOS app distribution, in-app purchase processing, and push notification delivery (APNs). | Purchase records and push notification tokens. | United States (global infrastructure) |
| Android app distribution, in-app purchase processing, and push notification delivery (FCM). | Purchase records and push notification tokens. | United States (global infrastructure) |
⚠ NEEDS INPUT: confirm Resend and RevenueCat processing regions against their current DPAs before sending this to a government or enterprise buyer
What we do not use
Reviewers usually want to know what is absent as much as what is present:
- No advertising networks or ad SDKs. We do not run ads and do not share data with advertising platforms.
- No data brokers. We do not sell, rent, or trade customer data.
- No AI or machine-learning providers. Customer content is not sent to any AI model, and no customer data is used to train models.
- No offshore data storage. We operate one production region, in the United States.
- Usage analytics stay in-house. Product usage and diagnostic events are written to our own database rather than to a third-party analytics vendor.
Changes to this list
We update this page when we add or remove a subprocessor. Customers on a team or enterprise plan who would like advance notice of changes can request it at team@timestampitapp.com.