Overview
To run Perco, LightRoast Studio (KvK 98824546) uses a small number of trusted service providers ("subprocessors") that may process your personal data on our behalf, under contract and only on our instructions. We do not sell your data to anyone.
Current subprocessors
Each entry is in the form provider — role — data it handles — location — transfer safeguard:
- Supabase — database, authentication and file storage — account, profile, coffee data, social data, uploaded photos — European Union (Frankfurt) — within the EEA.
- Vercel — application hosting and cookieless web analytics — technical/request data and aggregated, non-identifying analytics — United States — Standard Contractual Clauses.
- Sentry — error monitoring and (with consent) session diagnostics — technical error data and, with consent, recordings of app sessions in which what you type into fields is masked — data ingested in the EU region (de.sentry.io); corporate entity in the United States — EU hosting, with Standard Contractual Clauses for any US control-plane access.
- Resend — sending email such as password resets, service notices and what's-new emails about new versions, and receiving the email you send us — email address and message content — United States — Standard Contractual Clauses.
- Cloudflare — bot protection (Turnstile) when you sign in, create an account, continue as a guest or reset your password, on the website and in the app — IP address and browser or device signals such as the user agent — United States — EU-US Data Privacy Framework and Standard Contractual Clauses. Cloudflare also uses these signals as an independent controller to improve its bot detection.
- RevenueCat — processing in-app purchases made in our mobile apps — your account identifier whenever you are signed in to the iPhone app, and the purchase/receipt data the App Store or Google Play returns; card details are handled by Apple or Google and never reach RevenueCat or us — United States — Standard Contractual Clauses.
Apple and Google, and why they are not on the list above
Apple and Google handle a few things for Perco, and in each of them they act as independent controllers under their own terms rather than as our subprocessors. They are named here because that distinction is easy to get wrong from the outside, not because we are withholding them from the list.
- The App Store and Google Play — distributing the app and selling any subscription in it. Each store is the merchant of record for that sale: it takes the payment, holds the card details, issues the receipt and handles refunds under its own privacy policy. We never see a card number. What reaches us is the entitlement — which plan you hold and until when — by way of RevenueCat, which is a subprocessor and is listed above.
- Sign in with Apple, and signing in with Google — verifying who you are when you choose one of those buttons instead of an email and password. The provider tells us that the sign-in succeeded and gives us an identifier and, if you allow it, an email address. It decides for itself what to record about that, which is what makes it a controller rather than a processor. Sign in with Apple can also hide your real address behind a private relay, and Perco works normally either way.
- Apple Maps, in the iPhone app — finding cafés when you add one or log a visit. The café name you type goes to Apple to run the search, and so does your location if you allow location access. We never receive or store your location.
- Apple Push Notification service, in the iPhone app — delivering the notifications you allow. Apple receives your phone's push token and the text of each notification, which can include the name of the person who liked, commented on or followed something of yours, and the first words of their comment. Reminders about your streak or your beans are scheduled on your phone and do not go through it.
For what each of them does with your data, see Apple's and Google's own privacy policies.
Changes
We review this list and update it as our providers change. When we add or replace a subprocessor that handles personal data, we will update this page and its "Last updated" date and, where appropriate, notify account holders. To be notified of changes, or if you have questions, contact privacy@perco.app.