Who handles your information
This page names every company that handles some part of your information on Churr's behalf, what each one does for us, what it receives, and where it is. Our privacy policy describes the kinds of company involved; this page is the list of names.
The two change on different clocks. This page changes whenever a company on it changes — we swap a push service, a crash reporter, a payment provider — and it does not need a new version of the privacy policy or your acceptance to change. The privacy policy changes only when the kind of processing changes, and that does ask you to accept it again. So if you want to know who, look here; if you want to know what and why, read the policy.
Some of the companies below handle your information only while a feature is switched on. Those rows say so, in the words "only when". A feature that is switched off sends nothing.
Under PIPEDA, a company that processes information for us is a use rather than a disclosure, and we stay accountable for what it does with what it receives. Companies outside Canada are transfers to another country; under GDPR they are transfers under Chapter V, made on each company's standard contractual clauses.
The list
| Who | What they do for Churr | What they receive | Where |
|---|---|---|---|
| Anthropic — AI model | Runs the models behind your twin: the interview, the overnight conversations, the daily check-in and the notes your twin writes about a plan. | Your twin profile, the interview transcript, check-in text, and the twin-to-twin conversations. Never your phone number, and never anything you marked private. | United States |
| Supabase — database and sign-in | Hosts the database, and runs the sign-in service that sends your one-time code. Everything stored lives in their ca-central-1 (Montréal) region. | Everything the app stores: your account, your twin, your plans, your chats. The sign-in service also holds your phone number in readable form, because that is where the code is sent; our own database keeps only a one-way hash of it. | Canada |
| Our sign-in provider’s SMS carrier — sign-in SMS | Delivers the one-time code by text message when you sign in. Not yet chosen: Twilio Verify is the one we intend to use, and this entry will name it when it is contracted. | Your phone number and the six-digit code, once per sign-in. Nothing else. | Not yet chosen |
| Expo — push notifications | Delivers push notifications to your phone. | The notification text and your device push token. The morning notification carries other people’s first names ("Your twin met 6 people last night"). | United States |
| Apple — push notifications | Distributes the app and carries push notifications to iPhones. Only when the feather store is on: takes payment for in-app purchases, so we never see your card. | Whatever the App Store holds about your download, and the push payloads. With the store on, the purchase receipt, which we keep as proof of what you bought. | United States |
| Sentry — crash reporting | Only when crash reporting is switched on for the build (it is off until a Sentry key is set). Collects crash reports from the app and the server so we can find out why something broke. | The error and where in the code it happened, your phone model and system version, and an opaque account id. Never your phone number, your name, or anything you or your twin wrote: those are removed by name before the report leaves the device or the server. | United States |
| Fly.io — hosting | Runs our server and the overnight worker, in Toronto. Keeps the server’s request logs for seven days; we keep no other copy. | Everything that passes through the server on its way to or from the database, and the request logs: which paths were called, when, with what result, your account id and the internet address your phone connected from. | Canada |
| Stripe — payments | Only when physical gifts or event sponsorship is on. Takes payment on its own page for a physical gift or an event sponsorship, so your card never reaches us. | Your card details, typed into their page and never ours, and what you are paying for. We are told the outcome, an amount and a reference, and keep those as the record of the purchase. | United States |
| Google (AdMob) — advertising | Only when network ads are on. Fills the ad slots with ads from its network, and chooses them using your device’s advertising identifier only if you allow tracking when iOS asks. | Whatever its software reads from your phone to serve an ad: the advertising identifier if you allowed it, and device details. It reads these itself; none of it passes through us, and we hold no advertising identifier. | United States |
| Ticketmaster — event listings | Only when the automatic events import is on. Supplies the concert and event listings in What’s on, which our server fetches each night. | Nothing about you. Our server asks them for listings in Toronto; nothing of yours is in the request, and tapping an event opens their site in your browser like any other link. | United States |
| Cloudflare — website | Serves churr.io, the website and these pages. The app itself never talks to it. | The internet address and browser details of anyone who opens churr.io, as with any website host. Nothing from your account, which the website cannot see. | United States |
What is not on it
Nobody you are introduced to is on this list, because they are not a company handling information for us: what another person's twin learns about you is what you marked shareable, and nothing else. There are no data brokers, no advertising networks unless the row above says one is on, and no analytics company: measuring how the app is used, if you switch it on, is done by us in our own database and shared with nobody.
Questions
[email protected] — for anything on this page, including a request to know exactly what one of these companies holds about you.