skriblioprocessor register and retention schedule
POPIA section 21 (operators) and GDPR article 28 and 30 both want this table. Kept current by whoever adds a service. Published in short form at skriblio.com/privacy/processors.
Processors (operators)
| processor | what they receive | why | where | agreement |
|---|---|---|---|---|
| Supabase Inc | all account and journal data; photographs, voice notes and drawings in the vault bucket; request logs for 7 days, which include the words someone searched for | database, auth, storage, edge functions, cron | Frankfurt, Germany (one project, ref qrpoauexqrfcgiyimyxd) | Supabase DPA, accepted in the dashboard |
| Anthropic PBC | photographs of journal pages, per request | handwriting transcription | United States | Anthropic commercial terms and DPA; no training on API inputs |
| RevenueCat Inc | app user id (the account id), a device identifier, purchase receipts from Apple and Google | subscription status; on iPhone and Android it also tells Meta when a trial starts or a plan is paid for, with Meta's anonymous install id | United States | RevenueCat DPA |
| Meta Platforms Ireland Ltd | iPhone and Android: that the app was installed and opened, an anonymous install id, and from RevenueCat trial starts and payments with that id. No advertising identifier (on Android the app does not hold the advertising id permission), no tracking permission asked, nothing from the journal | measuring skriblio's own Instagram ads | Ireland and United States | Meta Business Tools Terms and Data Processing Terms |
| Expo (650 Industries) | nothing at the moment: the app sends no push notifications from a server and stores no push token (2026-09-30; reminders are scheduled on the phone, nothing goes to Expo). When push is switched on: push token, notification payload (banana line only, never journal text) | push delivery to APNs and FCM | United States | Expo terms and DPA |
| Apple Inc | purchase; email (or private relay) when you use Sign in with Apple; push delivery once push is switched on (it isn't) | payments, sign in, notifications | worldwide | Apple developer agreement |
| Google LLC | purchase; email and name when you use Google sign in; analytics with a random id (page views on skriblio.com, screen names in the app), from which Google Analytics works out an approximate location without keeping the IP address. advertising signals off. Android only: ML Kit text recognition (bundled in the app) reads scanned pages on the phone; pictures and words are not sent to Google, but ML Kit sends usage metrics (device, app, latency, sizes, error codes) with no switch to turn that off. Android's own on-device speech recognition types up voice notes with no audio leaving the phone push delivery (FCM) once push is switched on (it isn't) | payments, sign in, product analytics, reading scanned pages and typing up voice notes on Android, notifications on Android | worldwide | Google Play developer agreement, Firebase terms, Google sign-in terms, Google Ads Data Processing Terms |
| PostHog Inc | user id, screen and event names with a few properties (which prompt, the day's rating, a voice note's length), device type, app version | product analytics | EU host https://eu.i.posthog.com, org Skriblio, project skriblio (id 268846). the other steady labs org on that account was deleted 2026-09-08. Replay, autocapture and GeoIP off. 12 month retention | PostHog Cloud DPA |
| Functional Software Inc (Sentry) | crash stack traces, device model, OS, app version | crash reporting | United States, org steady-labs-holdings, project skriblio-mobile. IPs scrubbed. the other steady labs mobile project was deleted 2026-09-08. Code never sends journal text | Sentry DPA |
| GitHub Inc | nothing personal; static pages only | hosts skriblio.com pages | United States | none needed, no personal data |
| Resend Inc | email address, one time code | sign in mail from our domain | Ireland (eu-west-1) | Resend DPA |
Not processors: Apple and Google as payment providers act as independent controllers for the payment itself.
What we never send anywhere
Journal text to any processor except Supabase (storage) and, as an image, Anthropic (transcription). Journal text never reaches push, analytics or crash reports. scripts/check-names.js and the _shared/push.ts helper make this a code rule, not a promise.
Retention schedule
| data | kept | then |
|---|---|---|
| account (email, ids) | life of the account | deleted on account deletion, same request |
| journal entries, titles, ratings | life of the account | soft deleted entries purged after 30 days; all purged on account deletion |
| photographs (originals and derived) | life of the entry | removed from storage on entry purge or account deletion (storage first, then rows) |
| transcripts | life of the photograph | deleted with the photograph, or alone on request |
| voice notes and their typed words | life of the entry | removed from storage on entry purge or account deletion; typing up happens on the phone (iPhone, and Android 13 and later with the language installed), no processor |
journal school and first week records (profiles.school, profiles.first_week: ids and dates only) | life of the account | in the export; deleted with the profile row on account deletion |
copy of each recording made on this phone (voice-local/, for typing up offline) | on the phone only | removed with the voice note, on entry purge, and on sign out or account deletion (src/features/voice/localCopy.ts) |
| kind of each day's save (typed, photo, voice, doodle) | on the phone only | cleared on sign out; never sent to the server or to analytics |
| banana state, care log | life of the account | deleted on account deletion |
| silence streaks | rolling | rows older than 12 months purged by cron |
| push token | not stored while push is off | replaced on each sign in once push is on |
| analytics events | 12 months | PostHog retention setting |
| crash reports | 90 days | Sentry retention setting |
| database backups | 30 days rolling | Supabase point in time recovery window |
| auth logs | 90 days | Supabase default |
| server request logs (paths, including search words) | 7 days | Supabase log retention |
The daily banana-tick job purges entries that have been in recently deleted for 30 days, with their files. A deletion someone asks for by email, because they no longer have the app, is done through the Supabase dashboard within the 30 day promise (skriblio.com/delete-account).
Sub-processors of processors
Each of the above publishes its own list (mostly AWS and Google Cloud). We rely on their DPAs for that layer.
Breach procedure
Within 24 hours of noticing: stop the leak, then work out what was reached. If personal data was likely accessed: notify the Information Regulator and affected users as soon as reasonably possible (POPIA s22), within 72 hours for EU and UK users (GDPR art 33). Template mail lives with this file when needed. Record every incident, even ones that turn out to be nothing, in docs/legal/incidents.md.
also here: privacy, terms, processors. questions to info@skriblio.com.