Subprocessors
Every third party involved in operating our apps and this website, what each receives, and where it is.
- Last updated
This is the complete list of third parties involved in operating our apps and this website. It is referenced by the Data Processing Addendum as Annex III, and by our Privacy Policy.
This page is updated at least 30 days before a new subprocessor begins processing customer personal data. To be notified of changes, email contact@leapstudio.dev.
Which apps use which
| Subprocessor | Cloister AI | Auto Brightness Clock | Bilingual Baby | Jesus — WWJD | Best Dad | Website |
|---|---|---|---|---|---|---|
| Apple | Yes | Yes | Yes | Yes | Yes | — |
| RevenueCat | — | — | — | Yes | — | — |
| Amplitude | — | — | — | Yes | Yes | — |
| ElevenLabs | — | — | — | Optional | — | — |
| Vercel | — | — | — | Yes | — | Yes |
| Hugging Face | Optional | — | — | — | — | — |
| DuckDuckGo | Optional | — | — | — | — | — |
Bilingual Baby uses no subprocessors beyond Apple’s role as app distributor and makes no network request. Best Dad also uses Amplitude for the limited product analytics described in its app-specific privacy policy. Every entry in the Cloister AI column is a feature you switch on; by default it contacts none of them.
“Optional” means the feature must be switched on or triggered by the user.
The list
Apple Inc.
- Role — App Store distribution, payment processing, and (for Auto Brightness Clock) the WeatherKit service.
- Data — Purchase and subscription records; your Apple ID relationship is with Apple, not with us. For WeatherKit, an approximate location at city-level accuracy, sent by the device directly to Apple.
- Location — United States and global infrastructure.
- Note — Apple does not provide us with your name, email address or payment details. We receive anonymised sales reports. Apple is a controller in its own right for its relationship with you.
- Terms — apple.com/legal/privacy
RevenueCat, Inc.
- Role — Subscription state and receipt validation.
- Data — An anonymous, app-generated identifier, purchase receipts, subscription status, country, and basic device model and OS version. No name, email address or payment details.
- Location — United States.
- Used by — Jesus — WWJD.
- Transfer mechanism — Standard Contractual Clauses.
- Note — Cloister AI does not use RevenueCat. Its subscriptions are verified on the device by StoreKit, so no purchase record leaves the device.
- Terms — revenuecat.com/dpa
Amplitude, Inc.
- Role — Product analytics.
- Data — Allowlisted feature interactions and performance timings, plus a pseudonymous SDK device identifier. For Best Dad, names, birth or due dates, profile choices, SOS use, photos, extracted text, notification text and Coach text are excluded. For Jesus — WWJD, question and answer content is excluded.
- Location — United States.
- Used by — Jesus — WWJD and Best Dad.
- Transfer mechanism — Standard Contractual Clauses.
- Note — Events are limited to structural facts about app use, not user content. See the app-specific policies for Jesus — WWJD and Best Dad.
- Terms — amplitude.com/legal/dpa
ElevenLabs Inc.
- Role — Text-to-speech for Voice mode.
- Data — The text of a generated answer, so it can be spoken. Never your question, and never your recorded voice — speech-to-text happens on your device.
- Location — United States.
- Used by — Jesus — WWJD, only when a Pro subscriber turns Voice mode on.
- Transfer mechanism — Standard Contractual Clauses.
- Note — Requests are relayed through a proxy that holds the API credential; it stores nothing and logs no content. With Voice mode off, the app uses Apple’s on-device speech synthesis and makes no request.
- Terms — elevenlabs.io/dpa
Vercel Inc.
- Role — Hosting for this website, and for the text-to-speech proxy above.
- Data — Standard server request logs: IP address, requested URL, user agent, timestamp.
- Location — United States, with a global edge network.
- Note — Vercel Web Analytics and Speed Insights are not enabled. This site sets no cookies — see the Cookie Policy.
- Transfer mechanism — Standard Contractual Clauses.
- Terms — vercel.com/legal/dpa
Hugging Face, Inc.
- Role — Distribution of open-weights AI models and voice assets.
- Data — A file request, carrying an IP address as any download does. No personal information is sent, and no account is used.
- Location — United States.
- Used by — Cloister AI, only when you choose to download an additional model.
- Note — The app ships with a working model. Downloads are optional and user-initiated.
- Terms — huggingface.co/privacy
DuckDuckGo, Inc.
- Role — Web search results.
- Data — The search query, and an IP address as with any web request.
- Location — United States.
- Used by — Cloister AI, only when a Pro subscriber enables web search.
- Note — Off by default. Enabling it is the only circumstance in which text entered into Cloister AI leaves the device.
- Terms — duckduckgo.com/privacy
Not used
- No advertising or attribution networks — no Meta SDK, no Google Ads, no AppsFlyer, no Adjust, no Branch, no ad identifier collected anywhere.
- No cloud AI providers — no OpenAI, Anthropic, Google or AWS Bedrock. All inference is on-device. Text-to-speech for one app is the sole exception.
- No crash reporting — no Sentry, no Bugsnag, no Crashlytics. We rely on Apple’s own aggregated, opt-in crash reports.
- No customer data platform, CRM or marketing automation.
- No cloud database or object storage holding user content.
- No website analytics.
Sub-subprocessors
Our subprocessors use their own infrastructure providers, typically AWS, Google Cloud or Cloudflare. Each publishes its own list, linked above.
Contact
contact@leapstudio.dev. Security questionnaires are answered within 15 business days — see section 11 of the DPA.