Sub-processors.
Last updated 7 November 2026.
These are the companies that process data on our behalf, what each one sees, and where. Each works under a written data processing agreement that stops it using the data for anything of its own. We update this page before adding anyone; if you want to be told, email us and we will.
| Who | What for | What it sees | Where |
|---|---|---|---|
| Supabase, Inc. | Database, servers, the encrypted vault for provider keys | Everything Thumbmail keeps: account, mailbox address, message headers and previews, what it worked out about each message, drafts until sent, push tokens, logs | Ireland (EU) |
| Anthropic, PBC | The language model that sorts mail and drafts replies | Sender, subject and preview of each message; a body excerpt of the few messages that look like they carry an action; the thread and your transcript when drafting a reply. Not used for training; deleted on Anthropic's retention schedule, currently 30 days | United States (UK Addendum to the EU SCCs) |
| Apple Inc. | Sign in with Apple, push notifications, App Attest | Your Apple ID identifier; the contents of each notification; the device's attestation | Global |
| Google LLC | Gmail API and the change notices that tell our server your mailbox changed | Your mailbox address and a change number in each notice; mail is read by our server directly from Gmail with your permission | United States (UK Addendum to the EU SCCs) |
| Microsoft Corporation | Microsoft Graph and its change notices | As for Google | Global |
| Vercel Inc. | Hosting this website and counting its visits | Requests to the site; no cookies, no IP addresses given to us | Global |
Wireside Studios Ltd itself is in the United Kingdom. Nobody else sees your data. There are no analytics or advertising companies in the app.