| Service | What they receive | Purpose | Where |
|---|---|---|---|
| Nhost | Email, display name, phone number, sign-in identities, session data, auth tokens, sign-in codes, financial data, and a hashed password for an account that has one | Authentication, user management, database hosting | US (AWS us-east-1, Northern Virginia) |
| Amazon Web Services (via Nhost) | All data stored in the database, encrypted at rest | Infrastructure and storage | US (AWS us-east-1, Northern Virginia) |
| Railway, Railway Corp. | Data in transit through our API while it is processed, not stored | Hosting our API | US |
| Vercel, Vercel Inc. | Web app requests, including IP addresses and request logs, and data in transit through its server, only if you use the web app | Hosting the web app | US |
| Plaid, Plaid Inc. | Bank account and transaction data, only if you connect a bank | Bank aggregation in the US and Canada | US |
| Zerodha (Kite Connect), Zerodha Broking Ltd. | Investment-holdings data, only if you connect Zerodha | Holdings aggregation in India | India |
| Anthropic, Anthropic PBC | Your Chat question and the parts of the space’s records it needs; for sorting, merchant names and your category names. Only after you turn on AI features | Chat’s answers; sorting imported transactions | US |
| RevenueCat, RevenueCat, Inc. | An opaque customer identifier, device type and operating system, and the store’s purchase receipt or token, only if you subscribe | Subscription management | US |
| Apple, Google, Apple Inc.; Google LLC | Purchase and payment details, held by them, never by us; spoken audio and vocabulary hints while you dictate a Chat question on the phone; your name and email, returned to us when you sign in with them | In-app purchases; speech to text, on the device or with the provider; sign-in | Per Apple and Google |
| Resend, Resend, Inc. | Email addresses and transactional email content | Email, such as sign-in codes, invites and deletion confirmation | US |
| Expo (650 Industries, Inc.) | Device push token and notification content, once your phone allows notifications | Routing push notifications | US |
| PostHog, PostHog, Inc. | Pseudonymous usage events, stripped crash reports, an app-generated user identifier, and device and app metadata, with no financial data, only while analytics are on | Product analytics and error tracking | US (PostHog US Cloud) |
| Grafana Labs | Server traces, metrics and logs: opaque identifiers, timings and error codes, with no names, amounts or free text | Infrastructure monitoring | US (Grafana Cloud) |
| ExchangeRate-API | Currency codes only | Exchange rates | No personal data |
Your data
Subprocessors and third parties
Every outside service that receives data when you use Recontrol: who, what they receive, why, and where.
Last updated 22 October 2026.
The Privacy Policy governs: if this page ever differs, the policy holds.
No advertising SDKs, cross-app tracking or social-media pixels. PostHog, our only analytics, can be turned off in Settings (on the web, Your account › Preferences).
Your own AI tool’s provider is your choice, under your agreement with them, so it isn’t listed.