Third-Party Processors & Services Register
1. Purpose
This register lists every third party that processes WrindhaOS user data on our behalf, or that we integrate with, and what each one does. It supports our Privacy Policy, our Google Play Data Safety declaration, and our obligations under India's Digital Personal Data Protection (DPDP) Act, 2023 to know and document our data-processing chain.
2. Third-Party Processors & Services
The table below details all active processors, their specific roles, types of data processed, operational purposes, and hosting locations:
| Service | Role | Data Processed | Purpose | Data Location |
|---|---|---|---|---|
| Supabase | Backend-as-a-service processor (database, auth, storage) | All account and productivity data: profile, journal (encrypted), habits, goals, subjects, tasks, calendar, expenses, consent records, support tickets | Core application backend, authentication, and data storage/sync | Hosted on Supabase's managed cloud infrastructure |
| Google Play Billing | Payment processor for subscriptions | Purchase token, order ID, subscription plan/status, price, currency. Card/bank details are held by Google, not received by us. | Processing Premium subscription payments and renewals | Google infrastructure (per Google's own policies) |
| Google Play Console / Play Services | App distribution platform | App install/update metadata, device compatibility data, crash/ANR reports (platform-level) | Distributing the app and basic platform diagnostics | Google infrastructure |
| Push Notification Service (e.g., Firebase Cloud Messaging) | Notification delivery | Device push token, notification content metadata | Delivering habit, study, and expense reminders you enable | Managed cloud infrastructure |
| Crash Diagnostics SDK | Sub-processor | Device model, OS version, crash stack traces, anonymised usage events | App stability monitoring & product analytics | Managed cloud infrastructure |
3. Categories We Do Not Currently Share Data With
We maintain strict operational boundaries to ensure user privacy is not monetized:
🚫 No Ad Networks
No advertising networks or ad-tech SDKs are integrated into WrindhaOS.
🚫 No Data Brokers
We never sell, rent, or trade your personal data to brokers or resellers.
🚫 No Public AI Training
Your private journal entries, habits, and goals are never shared to train third-party AI models.
4. Internal Access Governance
Internal administrative access (by authorized team members) is role-based, heavily audited, and limited exclusively to:
- Account and subscription metadata
- Aggregate performance and system analytics
- Support-ticket handling and user inquiries
- Account-status management (such as handling requested deletions)
5. Data-Processing Agreements
We rely on Supabase's and Google's respective standard Data Processing Addendums (DPAs) and cloud service terms as part of utilizing their enterprise infrastructures, ensuring adherence to rigorous international data safety benchmarks and encryption in transit and at rest.
6. Review Cadence
This register is continuously monitored and formally reviewed/updated whenever a new third-party integration is introduced or retired, and at a minimum every 12 months.