A "subprocessor" is a third-party service Beat Journal engages to process user data on our behalf. This page identifies every such party, what data they handle, and why.
This page is separate from the third-party services you authorize directly (Oura, Hevy) — those are described at the bottom for clarity.
1. Active Subprocessors
| Subprocessor | Purpose | Data Categories Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Anthropic, PBC | AI model inference (Claude). Generates weekly insights from the evidence pack assembled on-device. | Selected health metrics, journal excerpts, mood / stress / energy summaries — only when you enable AI Insights and grant separate consent. | United States | anthropic.com/legal/privacy |
| Cloudflare, Inc. | Hosts the Beat Journal AI relay (a Cloudflare Worker) that authenticates requests and forwards them to Anthropic. The relay does not store request or response bodies. | Pseudonymous installation identifier (UUID), session token metadata, request timing, prompt version, token counts, error category. No raw prompt or response content is logged. | United States and global edge | cloudflare.com/privacypolicy |
| Apple Inc. | iCloud sync (CloudKit) for journal entries when you enable iCloud on your device. Also provides HealthKit, EventKit, and WeatherKit APIs that operate on-device. | Journal entries (when iCloud sync is on). HealthKit, EventKit, and WeatherKit data is accessed on-device and not transmitted to Apple by Beat Journal. | United States | apple.com/legal/privacy |
Anthropic — additional notes
- Beat Journal uses Anthropic's commercial API, which by default prohibits training on inputs and outputs.
- Anthropic retains API inputs and outputs for up to 30 days for trust-and-safety review. Beat Journal is pursuing Zero Data Retention (ZDR) where eligible; this page will be updated if ZDR status changes.
Cloudflare — additional notes
- The relay code is open to inspection within the Beat Journal codebase.
- Beat Journal does not enable Cloudflare Logpush or Tail Workers in a way that captures request or response payloads.
2. User-Authorized Data Sources (not subprocessors)
The following services are accessed by you using credentials you provide. Beat Journal acts as the conduit; these services do not process data on Beat Journal's behalf, and Beat Journal does not transmit your data to them beyond the requests you authorize.
| Service | Purpose | Privacy Policy |
|---|---|---|
| Oura Health Oy | Reads sleep, activity, and recovery data using a personal access token you provide. | ouraring.com/privacy-policy |
| Hevy | Reads workout and training load data using an API key you provide. | hevyapp.com/privacy |
You may disconnect any of these services at any time in Settings › Data Sources. Disconnecting stops further data retrieval; previously retrieved data remains on your device until you delete it.
3. Voice Transcription
Voice journal entries are transcribed entirely on your device using either Apple's native Speech framework (iOS 26+) or WhisperKit's on-device models. Audio does not leave your device, and no third-party service processes your voice recordings.
4. How We Notify You of Changes
Beat Journal is an independent project operated by a single developer. We commit to:
- Updating this page before engaging any new subprocessor.
- Refreshing the "Last Updated" date at the top of this document when material changes are made.
- Notifying users in-app or by email if a change materially expands the categories of data processed by subprocessors.
We do not currently operate a separate change-notification mailing list. If you would like advance notice of changes, contact us at the address below.
5. Contact
Questions about subprocessor relationships or to request advance notice of changes:
Email: support@beatjournal.app