skriblioprocessor register and retention schedule
POPIA section 21 (operators) and GDPR article 28 and 30 both want this table. Kept current by whoever adds a service. Published in short form at skriblio.com/privacy/processors.
Processors (operators)
| processor | what they receive | why | where | agreement |
|---|---|---|---|---|
| Supabase Inc | all account, journal, circle and consent data; photographs in the vault bucket | database, auth, storage, edge functions, cron | Frankfurt, Germany (one project, ref qrpoauexqrfcgiyimyxd) | Supabase DPA, accepted in the dashboard |
| Anthropic PBC | photographs of journal pages, per request | handwriting transcription | United States | Anthropic commercial terms and DPA; no training on API inputs |
| RevenueCat Inc | app user id, purchase receipts from Apple and Google | subscription status | United States | RevenueCat DPA |
| Expo (650 Industries) | push token, notification payload (banana line only, never journal text) | push delivery to APNs and FCM | United States | Expo terms and DPA |
| Apple Inc | purchase, push delivery; email (or private relay) when you use Sign in with Apple | payments, notifications, sign in | worldwide | Apple developer agreement |
| Google LLC | purchase, push delivery (FCM); email when you use Google sign in; anonymous analytics (page views on skriblio.com, screen names in the app). advertising signals off. | payments, notifications on Android, sign in, product analytics | worldwide | Google Play developer agreement, Firebase terms, Google sign-in terms, Google Ads Data Processing Terms |
| Meta Platforms Ireland | friend WhatsApp number, template message with first names and the banana line | WhatsApp Business Cloud API | Ireland, United States | WhatsApp Business terms, Meta data processing terms |
| PostHog Inc | user id, screen and event names, device type, app version | product analytics | EU host https://eu.i.posthog.com, org Skriblio, project skriblio (id 268846). the other steady labs org on that account was deleted 2026-09-08. Replay, autocapture and GeoIP off. 12 month retention | PostHog Cloud DPA |
| Functional Software Inc (Sentry) | crash stack traces, device model, OS, app version | crash reporting | United States, org steady-labs-holdings, project skriblio-mobile. IPs scrubbed. the other steady labs mobile project was deleted 2026-09-08. Code never sends journal text | Sentry DPA |
| GitHub Inc | nothing personal; static pages only | hosts skriblio.com pages | United States | none needed, no personal data |
| Resend Inc | email address, one time code | sign in mail from our domain | Ireland (eu-west-1) | Resend DPA |
Not processors: Apple and Google as payment providers act as independent controllers for the payment itself.
What we never send anywhere
Journal text to any processor except Supabase (storage) and, as an image, Anthropic (transcription). Journal text never reaches push, analytics, crash reports or WhatsApp. scripts/check-names.js and the _shared/push.ts helper make this a code rule, not a promise.
Retention schedule
| data | kept | then |
|---|---|---|
| account (email, ids) | life of the account | deleted on account deletion, same request |
| journal entries, titles, ratings | life of the account | soft deleted entries purged after 30 days; all purged on account deletion |
| photographs (originals and derived) | life of the entry | removed from storage on entry purge or account deletion (storage first, then rows) |
| transcripts | life of the photograph | deleted with the photograph, or alone on request |
| banana state, care log | life of the account | deleted on account deletion |
| circle friend name and number | until removed or muted | purged 30 days after removal or mute |
| consent record (number, time, wording, IP hash) | while in circle | purged 30 days after removal or mute |
| silence streaks | rolling | rows older than 12 months purged by cron |
| push token | until app uninstall or sign out | replaced on next sign in |
| analytics events | 12 months | PostHog retention setting |
| crash reports | 90 days | Sentry retention setting |
| database backups | 30 days rolling | Supabase point in time recovery window |
| auth logs | 90 days | Supabase default |
Cron jobs that implement the purges are part of milestone 10 (review readiness). Until then, deletion on request is manual through the Supabase dashboard and completes within the 30 day promise.
Sub-processors of processors
Each of the above publishes its own list (mostly AWS and Google Cloud). We rely on their DPAs for that layer.
Breach procedure
Within 24 hours of noticing: stop the leak, then work out what was reached. If personal data was likely accessed: notify the Information Regulator and affected users as soon as reasonably possible (POPIA s22), within 72 hours for EU and UK users (GDPR art 33). Template mail lives with this file when needed. Record every incident, even ones that turn out to be nothing, in docs/legal/incidents.md.
also here: privacy, terms, processors. questions to info@skriblio.com.