Transparency
Subprocessors
Last updated: 2026-07-11
Aviator Archive is local-first: your logbook lives on your device, and most of it never touches a server. But a few narrow services help us run sign-in, licensing, payments, the optional AI Scan feature, and this website. Where those services may handle your personal data on our behalf, they're called subprocessors — and here's the whole list.
Each is engaged under a written data-processing agreement that binds it to handle your data only on our instructions. For the bigger picture — what we store, how deletion works, and your rights — see the privacy policy.
Sign-in & AI Scan
- Purpose
- Federated sign-in (OpenID Connect), and — for AI Scan — logbook-page image extraction via Google Cloud Vertex AI / Gemini.
- Data it receives
- Sign-in: your email, name, and a provider account id. AI Scan: the logbook-page image you choose to scan.
- Location & safeguards
- Google Cloud Data Processing Addendum; Google is certified under the EU–US Data Privacy Framework. AI Scan runs on Google's EU-resident endpoint for users in the EU/EEA, UK, or Switzerland, and in the US otherwise.
Apple
USSign in with Apple
- Purpose
- Federated sign-in on Apple devices.
- Data it receives
- Your email (shared on first sign-in only), name, and a provider account id.
- Location & safeguards
- Apple’s data-processing terms and Standard Contractual Clauses.
Cloudflare
Global edgeHosting, backend & website
- Purpose
- Runs our sign-in, licensing, and AI Scan services (Workers, D1, R2) and serves this website; provides cookie-free web analytics.
- Data it receives
- Account data (email, user id, device fingerprints), AI Scan images while in transit/processing, and request logs.
- Location & safeguards
- Cloudflare Data Processing Addendum with Standard Contractual Clauses.
RevenueCat
USIn-app purchase entitlements
- Purpose
- Validates App Store / Google Play receipts and manages your Lifetime / pack entitlement.
- Data it receives
- An app user id (your provider account id) and the store transaction identifier. Never your payment card.
- Location & safeguards
- RevenueCat Data Processing Addendum with Standard Contractual Clauses.
Lemon Squeezy
USPayments (Merchant of Record)
- Purpose
- Handles direct web purchases as the Merchant of Record, including card processing and global tax compliance.
- Data it receives
- Your payment details (which we never see) and, via webhook, your buyer email and transaction id.
- Location & safeguards
- Merchant of Record for the transaction; Lemon Squeezy’s data-processing terms.
Sentry
US / EUCrash reporting (opt-in)
- Purpose
- Receives anonymized crash diagnostics — only if you turn crash reporting on in Settings.
- Data it receives
- Error type and a technical stack trace, with personal and logbook details scrubbed before they leave your device.
- Location & safeguards
- Sentry Data Processing Addendum with Standard Contractual Clauses.
Standby AI providers
For reliability, a small number of alternative AI providers — Anthropic, Mistral, OpenRouter, and Cloudflare Workers AI — are configured as fallbacks for AI Scan. They are not active by default. Whenever one is actually used, the in-app disclosure names it before any image is sent, and each is engaged under its own data-processing agreement. If we promote one to the default, it moves up into the list above and this page is updated.
Your own backup storage
If you set up backups, your encrypted backup bundle goes to storage you choose — for example your own Google Drive or any WebDAV server. Those providers act for you, under your account and your agreement with them, not as our subprocessors. We never hold the backup or its password.
Changes to this list
We keep this page current. Before we add a new subprocessor that handles your personal data, we update this list; for AI Scan, the in-app disclosure always names the live provider and region before your first upload, so what you see is what's used.
Questions
Something here unclear, or want notice of changes? daniel [at] aviatorarchive [dot] com . A real human responds, usually inside 24 hours.