Subprocessors
Every third party involved in operating our apps and this website, what each receives, and where it is.
- Last updated
This is the complete list of third parties involved in operating our apps and this website. It is referenced by the Data Processing Addendum as Annex III, and by our Privacy Policy.
This page is updated at least 30 days before a new subprocessor begins processing customer personal data. To be notified of changes, email contact@leapstudio.dev.
Which apps use which
| Subprocessor | Cloister AI | Auto Brightness Clock | Bilingual Baby | Jesus — WWJD | Best Dad | Website |
|---|---|---|---|---|---|---|
| Apple | Yes | Yes | Yes | Yes | Yes | — |
| RevenueCat | — | — | — | Yes | — | — |
| Amplitude | — | — | — | Yes | — | — |
| ElevenLabs | — | — | — | Optional | — | — |
| Vercel | — | — | — | Yes | — | Yes |
| Hugging Face | Optional | — | — | — | — | — |
| DuckDuckGo | Optional | — | — | — | — | — |
Bilingual Baby and Best Dad use no subprocessors beyond Apple’s role as app distributor. Neither app makes a network request. Every entry in the Cloister AI column is a feature you switch on; by default it contacts none of them.
“Optional” means the feature must be switched on or triggered by the user.
The list
Apple Inc.
- Role — App Store distribution, payment processing, and (for Auto Brightness Clock) the WeatherKit service.
- Data — Purchase and subscription records; your Apple ID relationship is with Apple, not with us. For WeatherKit, an approximate location at city-level accuracy, sent by the device directly to Apple.
- Location — United States and global infrastructure.
- Note — Apple does not provide us with your name, email address or payment details. We receive anonymised sales reports. Apple is a controller in its own right for its relationship with you.
- Terms — apple.com/legal/privacy
RevenueCat, Inc.
- Role — Subscription state and receipt validation.
- Data — An anonymous, app-generated identifier, purchase receipts, subscription status, country, and basic device model and OS version. No name, email address or payment details.
- Location — United States.
- Used by — Jesus — WWJD.
- Transfer mechanism — Standard Contractual Clauses.
- Note — Cloister AI does not use RevenueCat. Its subscriptions are verified on the device by StoreKit, so no purchase record leaves the device.
- Terms — revenuecat.com/dpa
Amplitude, Inc.
- Role — Product analytics.
- Data — Usage events: which mode was used, response length and latency, how many citations were returned, which paywall variant was shown, which card theme was shared, plus a pseudonymous device identifier, country and OS version. Never the content of a question or an answer.
- Location — United States.
- Used by — Jesus — WWJD only.
- Transfer mechanism — Standard Contractual Clauses.
- Note — The only analytics SDK in any of our apps. Events are limited to structural facts about a session, not its subject matter. See that app’s privacy policy.
- Terms — amplitude.com/legal/dpa
ElevenLabs Inc.
- Role — Text-to-speech for Voice mode.
- Data — The text of a generated answer, so it can be spoken. Never your question, and never your recorded voice — speech-to-text happens on your device.
- Location — United States.
- Used by — Jesus — WWJD, only when a Pro subscriber turns Voice mode on.
- Transfer mechanism — Standard Contractual Clauses.
- Note — Requests are relayed through a proxy that holds the API credential; it stores nothing and logs no content. With Voice mode off, the app uses Apple’s on-device speech synthesis and makes no request.
- Terms — elevenlabs.io/dpa
Vercel Inc.
- Role — Hosting for this website, and for the text-to-speech proxy above.
- Data — Standard server request logs: IP address, requested URL, user agent, timestamp.
- Location — United States, with a global edge network.
- Note — Vercel Web Analytics and Speed Insights are not enabled. This site sets no cookies — see the Cookie Policy.
- Transfer mechanism — Standard Contractual Clauses.
- Terms — vercel.com/legal/dpa
Hugging Face, Inc.
- Role — Distribution of open-weights AI models and voice assets.
- Data — A file request, carrying an IP address as any download does. No personal information is sent, and no account is used.
- Location — United States.
- Used by — Cloister AI, only when you choose to download an additional model.
- Note — The app ships with a working model. Downloads are optional and user-initiated.
- Terms — huggingface.co/privacy
DuckDuckGo, Inc.
- Role — Web search results.
- Data — The search query, and an IP address as with any web request.
- Location — United States.
- Used by — Cloister AI, only when a Pro subscriber enables web search.
- Note — Off by default. Enabling it is the only circumstance in which text entered into Cloister AI leaves the device.
- Terms — duckduckgo.com/privacy
Not used
- No advertising or attribution networks — no Meta SDK, no Google Ads, no AppsFlyer, no Adjust, no Branch, no ad identifier collected anywhere.
- No cloud AI providers — no OpenAI, Anthropic, Google or AWS Bedrock. All inference is on-device. Text-to-speech for one app is the sole exception.
- No crash reporting — no Sentry, no Bugsnag, no Crashlytics. We rely on Apple’s own aggregated, opt-in crash reports.
- No customer data platform, CRM or marketing automation.
- No cloud database or object storage holding user content.
- No website analytics.
Sub-subprocessors
Our subprocessors use their own infrastructure providers, typically AWS, Google Cloud or Cloudflare. Each publishes its own list, linked above.
Contact
contact@leapstudio.dev. Security questionnaires are answered within 15 business days — see section 11 of the DPA.