Subprocessors

Last updated: October 8, 2026

These companies process Avaan user data on our behalf. The Privacy Policy explains when each one receives data. We update this page before we send data to a new provider.

Infrastructure

Cloudflare

Purpose: Hosts the website and API (Workers), stores each account's synced data (Durable Objects), caches entitlement and catalog lookups (KV), stores opt-in Note audio, shared stats images, and app downloads (R2), and relays AI requests (AI Gateway).
Data: Everything that passes through the Avaan API, including audio in transit for transcription, Note text, and opt-in Note audio. AI Gateway logging and caching are turned off for the requests Avaan sends, so the gateway keeps no copy of prompts, audio, or responses.
Region: Cloudflare's global network
Their policy: https://www.cloudflare.com/privacypolicy/

PlanetScale

Purpose: Hosts the Postgres database for accounts and sessions.
Data: Email address, name, profile image URL, sign-in provider identifiers and tokens, session records (IP address and user agent), and newsletter subscriber addresses. It holds no transcripts or audio.
Region: United States (US East)
Their policy: https://planetscale.com/legal/privacy

Speech to text

Meta (Muse)

Purpose: Primary cloud transcription model, for dictation, file transcription, and speaker labeling.
Data: Audio you send for cloud transcription, and Note audio when you have turned on audio upload and a conversation Note needs speaker labels.
Region: Chosen by the provider
Their policy: https://www.meta.com/legal/privacy-policy/

OpenAI

Purpose: Fallback cloud transcription and the live voice conversation over your memories.
Data: Audio for fallback transcription. For a voice conversation, your speech and the Note excerpts Avaan retrieves to answer it.
Region: Chosen by the provider
Their policy: https://openai.com/policies/privacy-policy/

AssemblyAI

Purpose: Cloud transcription when speaker labels or word timings are requested.
Data: Audio for those requests, including Note audio when audio upload is on.
Region: United States by default; the European endpoint for requests from Europe, Africa, and Asia
Their policy: https://www.assemblyai.com/legal/privacy-policy

Deepgram

Purpose: Cloud transcription fallback for word timings.
Data: Audio for those requests.
Region: United States by default; the European endpoint for requests from Europe, Africa, and Asia
Their policy: https://deepgram.com/privacy

Sarvam

Purpose: Speaker-labeling jobs and translation for Indian languages.
Data: Audio you submit for a speaker-labeling job, and text sent for translation.
Region: Chosen by the provider
Their policy: https://www.sarvam.ai/privacy-policy

Text AI

OpenRouter

Purpose: Routes text requests to language models: AI Modes and text editing, edit decisions, Note titles, tags and folders, Ask answers, weekly reflections, and Note suggestions.
Data: Transcript text and the context a dictation edit uses (app name, window title, custom vocabulary, and mode instructions). For Ask, reflections, and suggestions, excerpts of your Notes and memories. It never receives audio.
Region: Chosen by the provider
Their policy: https://openrouter.ai/privacy

Google

Purpose: Hosts the Gemini model OpenRouter currently runs for text editing, Ask, reflections, and suggestions.
Data: The same text OpenRouter receives for those requests.
Region: Chosen by the provider
Their policy: https://policies.google.com/privacy

TypeSafe

Purpose: Decision model that chooses between editing and keeping the verbatim transcript.
Data: Transcript text and the dictation context (app name and window title), sent through OpenRouter. It never receives audio.
Region: Chosen by the provider
Their policy: https://typesafe.ai/privacy

Memories

Supermemory

Purpose: Stores and searches your memories so Ask, reflections, suggestions, and related Notes can use them. Used only when you turn memories on.
Data: The title and transcript of each Note included in memories, with speaker labels for conversations, plus the Note's identifier, type, and recording date. It never receives audio. Each account has its own container.
Region: Chosen by the provider
Their policy: https://supermemory.ai/privacy

Billing and purchases

Autumn

Purpose: Plans, trials, usage allowance, and subscription state.
Data: Account identifier, email address, name, plan, and the seconds of cloud transcription you use.
Region: Chosen by the provider
Their policy: https://useautumn.com/privacy

Stripe

Purpose: Card payments and the customer portal for subscriptions bought on the web.
Data: Payment details you enter at checkout, which Stripe collects directly, and billing contact details. Avaan never sees your card number.
Region: Chosen by the provider
Their policy: https://stripe.com/privacy

Apple

Purpose: App Store purchases, Sign in with Apple, and App Attest checks that confirm requests come from a genuine Avaan app.
Data: Purchase receipts, the identity you share when you sign in with Apple, and device attestation tokens.
Region: Chosen by the provider
Their policy: https://www.apple.com/legal/privacy/

RevenueCat

Purpose: Validates App Store subscriptions in the iPhone app and reports them to Autumn.
Data: Your Avaan account identifier and App Store purchase receipts.
Region: Chosen by the provider
Their policy: https://www.revenuecat.com/privacy/

Email

Samva

Purpose: Sends account email (verification, password reset, welcome), billing notices, and the changelog newsletter if you subscribe.
Data: Email address, name, signup and subscription events, and the content of the messages sent to you.
Region: Chosen by the provider
Their policy: https://samva.dev/legal/privacy

Sign-in

Google, GitHub, and Apple sign-in

Purpose: Lets you sign in with an account you already have.
Data: The identifier, email address, and name the provider shares when you approve sign-in.
Region: Chosen by the provider
Their policy: https://policies.google.com/privacy

Diagnostics

Sentry

Purpose: Crash and error reports from the website, the API, and the Mac app.
Data: Stack traces, app version, device and operating system details, and diagnostic messages. The Mac app also attaches streaming timings and counters when you turn on diagnostics. Reports are built to omit audio and transcript text.
Region: United States
Their policy: https://sentry.io/privacy/

Axiom

Purpose: Stores one operational log event per API request for debugging and reliability.
Data: Request identifiers, your account identifier, plan, route, model, durations, text lengths, and error codes. Events omit audio and transcript text.
Region: Chosen by the provider
Their policy: https://axiom.co/docs/legal/privacy

Questions

Write to privacy@avaan.app to ask about a processor or to be told when this list changes.