Ormy · Last reviewed 13 September 2026
These are essential. Ormy cannot function without them.
| Provider | Purpose | Personal data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Convex Privacy terms |
Database, server functions, scheduled jobs. This is where Ormy's data lives. | Account details, reminders (including the coordinates and radius of any place pinned to one), chat messages, check-ins, activity log, recaps, push tokens, subscription status | United States | SCCs + UK Addendum |
| Clerk Privacy terms |
Authentication, session management, Sign in with Apple. | Name, email address, authentication credentials, session and device metadata, IP address | United States | SCCs + UK Addendum |
| Anthropic Privacy terms · Trust centre |
Asks one question in the heads-ups Ormy sends, and suggests a next step when a reminder is ticked off. Never the reminders themselves. | The title of the reminder involved, and for a heads-up how many days away it is. Never the user’s name or location. Not used to train models. | United States | SCCs + UK Addendum |
| Expo Privacy terms |
Push notification delivery, over-the-air app updates, build infrastructure. | Push notification tokens and the content of notifications sent to a device | United States | SCCs + UK Addendum |
| Apple Privacy terms |
App distribution, Apple Push Notification service, payment processing, Sign in with Apple. | Push tokens, notification content, purchase and subscription records, Apple ID identifiers | United States and global | Apple's own transfer framework |
| RevenueCat Privacy terms |
Subscription state, entitlement checks, purchase receipts. | An app-generated anonymous user identifier, purchase receipts, subscription status. No name, no email, no reminder content. | United States | SCCs + UK Addendum |
| Provider | Purpose | Personal data processed | Location |
|---|---|---|---|
| GitHub Site policies |
Hosting for these legal pages. | Standard web server logs, including IP address | United States |
| Email provider | Support and account correspondence. | Your email address and whatever you write to us | United Kingdom / EEA |
Named explicitly, because their absence is the point:
Before a provider gets access to personal data we confirm that it:
We review this list at least annually, and whenever we change any part of the stack.
Adding or replacing a sub-processor is a change to how your data is handled, so we treat it as one.
To ask about a specific provider, request evidence of a transfer safeguard, or object to a change, email kyle.orm@turbolt.co.uk.