Draft for legal review. Nothing here is final until this notice is gone; items in [brackets] are still to be decided.

Subprocessors.

The companies that help us run Wonder and, in doing so, process personal data for us. None of them can read your journal: it reaches them, if at all, as ciphertext. Each is under a data processing agreement with us.

Company	What for	What they get	Where	Agreement
Supabase	Database and sign-in	Your account (name, email, password hash), the encrypted journal and its wrapped keys, session hashes, subscription state	[region]	[DPA link]
Vercel	Hosting the server, website and web app	Everything our server handles, in memory only; request logs without content	[region]	[DPA link]
Anthropic	Wonder’s notes and reflections	The day’s or week’s material you share, for the length of each request, under zero data retention	[region]	[DPA link]
Stripe	Subscriptions and payments	Your name, email and payment details	[region]	[DPA link]
[Email provider]	Account emails (password resets, sign-in links)	Your email address and the message	[region]	[DPA link]
Sentry	Error reports, unless you turn them off	Error type, a scrubbed message and where in the code it happened; never journal text, your name or your email	[region]	[DPA link]

Not subprocessors

What you connect: your calendar, Granola, and agents such as Claude Code, Cursor, Claude or ChatGPT. Your Mac talks to them, with your permission; what they hold is under your own agreement with them.
Google Fonts, which serves the website’s typefaces: it sees your IP address when a page loads, and nothing about your account or journal. The apps don’t use it.

Changes

We tell account holders by email at least [30] days before a new subprocessor starts processing their data, and record it here. If you object, write to [privacy contact email]; if we can’t address the objection, you can cancel and we’ll refund any unused period.

Date	Change
[date of publication]	First published.

Last updated [date of publication].