This list is published by Derive Notes Pty Ltd (ACN 696 859 597), 2/290 Boundary Street, Spring Hill QLD 4000, Australia, and is the list the Privacy Policy refers to. We update it when a provider is added, changed or removed. Questions go to matt@derivenotes.com.
Unless a row says otherwise, "United States" means the provider runs the service from there and your data is transferred there to be processed. Where a provider publishes a data processing agreement, we link it beside its privacy page.
Where your notebooks live
| Provider | What it does | What it receives | Where it processes | Its privacy or DPA page |
|---|---|---|---|---|
| Supabase | Sign in, database, file storage, and all our server logic | Account details, notebooks, page images, uploaded files, recognised text, billing state, email records | App: Singapore (AWS ap-southeast-1). Separate marketing website project: Australia (AWS Sydney, ap-southeast-2) | supabase.com/privacy, supabase.com/legal/dpa |
| Cloudflare | Runs the network edge in front of Supabase's API gateway, so every request from the app passes through it | IP address, connection metadata, and request contents in transit | Global edge network | cloudflare.com/trust-hub/gdpr |
| Vercel | Hosts the Derive web app shell and the marketing website, and answers the app's country lookup | IP address, request logs, pages requested | United States and Vercel's global edge network. We do not pin a region | vercel.com/legal/privacy-policy, vercel.com/legal/dpa |
AI providers
These providers receive an image of the part of the page you wrote on, the recognised text around it, and, on a practice page, the question you are working on. They do not receive your name, your email address or your account id. The AI disclosure explains which feature sends what.
| Provider | What it does | What it receives | Where it processes | Its privacy or DPA page |
|---|---|---|---|---|
| OpenRouter | Routes handwriting recognition requests to the three model hosts below, in the order Modal, Fireworks, DeepInfra | Rendered image of your handwriting, surrounding page text | United States | openrouter.ai/privacy |
| Modal | Runs the recognition model | Rendered image of your handwriting, surrounding page text | United States | modal.com/legal/privacy-policy |
| Fireworks | Runs the recognition model, on its US-only endpoint | Rendered image of your handwriting, surrounding page text | United States | fireworks.ai/privacy-policy |
| DeepInfra | Runs the recognition model | Rendered image of your handwriting, surrounding page text | United States | deepinfra.com/privacy |
| Recognition fallback, tutoring, page and image reading, and the search index | Rendered image of your handwriting, page text, page titles, images you add, typed questions | Google's global service endpoint. We use the "global" location rather than a named region, so Google may serve the request from any of its regions | cloud.google.com/terms/cloud-privacy-notice, cloud.google.com/terms/data-processing-addendum | |
| OpenAI | Summaries, page titles, practice questions, diagrams, image and code extraction, assistant chat, and a last fallback for recognition | Recognised handwriting, typed page text, page titles, your questions, source code | United States | openai.com/policies/privacy-policy, openai.com/policies/data-processing-addendum |
| Judge0, reached through RapidAPI | Runs code you write in the app and choose to run | Your source code and any input you supply with it | United States | rapidapi.com/privacy |
Retention at AI providers. On the handwriting recognition path we send an instruction with every request telling OpenRouter to refuse any model host that would keep or train on the request, and to use only the three hosts named above. Other requests that may be routed through OpenRouter, such as reading a photo you add or choosing which lines of the page are relevant, do not currently carry that instruction. Nothing in our code requests zero data retention from OpenAI or from Google, so those two run on their standard API terms.
If you connect Derive to Claude
| Provider | What it does | What it receives | Where it processes | Its privacy or DPA page |
|---|---|---|---|---|
| Anthropic | If you connect Derive to claude.ai or Claude Desktop as a connector, Claude can search your notes, list your recent pages, read a page and download a page image | Recognised page text, page titles and structure, rendered page images | United States | anthropic.com/legal/privacy, anthropic.com/legal/commercial-terms |
This only happens if you set the connector up yourself. Nothing is sent to Anthropic otherwise. Once your notes reach Claude, Anthropic's terms govern what happens to them, not ours.
Setting up your account
| Provider | What it does | What it receives | Where it processes | Its privacy or DPA page |
|---|---|---|---|---|
| Research Organization Registry (ROR) | Looks up your university when you type its name during setup | The text you type into the institution box, and your IP address, sent directly from your browser | United States | ror.org |
This request goes from your browser to ROR directly, so ROR sees your IP address. It only happens if you are asked for an institution and you start typing.
Analytics, diagnostics, payments and email
| Provider | What it does | What it receives | Where it processes | Its privacy or DPA page |
|---|---|---|---|---|
| PostHog | Product events and, after an explicit age-eligible analytics opt-in, session recording | Random analytics identifier, validated onboarding choices, learner-profile identifier and feature events. Replays can include the canvas, handwriting, visible text and interactions; input text is not universally masked. Our relay removes the IP address before forwarding | European Union | posthog.com/privacy, posthog.com/dpa |
| PostHog | Usage analytics for the marketing website, only after you say yes to the cookie banner, plus the home page headline test | Pages viewed, clicks, scroll depth, campaign tags, and on waitlist signup your email address. A random visitor identifier for the headline test | United States | posthog.com/privacy, posthog.com/dpa |
| Sentry | Crash reports and performance diagnostics | Error details, your Derive account id, app version, platform, and a fully masked recording of the screen at the moment of an error. The canvas you write on is deliberately excluded. Your IP address is removed by our own servers before the data reaches Sentry | United States | sentry.io/privacy, sentry.io/legal/dpa |
| Amazon Web Services (SES) | Sends all of our email, from the app and from this website, and handles bounces and complaints | Your email address, the subject and body of the message, and delivery, bounce, complaint and open events | Australia (Sydney, ap-southeast-2) | aws.amazon.com/privacy, aws.amazon.com/compliance/gdpr-center |
| Stripe | Takes payment on the web, Mac and Windows. Under Stripe's managed payments, Stripe is the merchant of record and handles tax | Your email address, billing address, card details (we never see the card number), your Derive account id, and your subscription record | United States and Ireland | stripe.com/privacy, stripe.com/legal/dpa |
| Apple | Takes payment for subscriptions bought inside the iPhone and iPad app. Apple is the seller for those purchases | Purchase records. We receive no card details | United States | apple.com/legal/privacy |
| RevenueCat | Manages App Store subscriptions | Your Derive account id, purchase and subscription records, device/app metadata. Does not send your subscription to Meta | United States | revenuecat.com/privacy, revenuecat.com/dpa |
| Meta Platforms | Advertising measurement for the web app and the iPhone and iPad apps. On by default outside the EEA, UK and Switzerland, never for anyone known to be under 18, and switchable off | Page views, onboarding steps, sign ups, trial starts and payments with amount and currency. Web: IP address, browser user agent, advert click reference and, for declared adults only, hashed email. Apps: a random app identifier and basic device details, with no advertising identifier and no email. Never notebook content | United States | meta.com/privacy/policy, meta.com/legal/business-tools-terms |
| Google (Google Ads) | Advertising measurement for the web app, sent from our servers. No Google tag runs in your browser. Same rules as Meta, and only for visitors who are not signed in and accounts created on or after 3 October 2026 | That a click on a button that takes you to the Derive web app or the App Store, a sign up, a trial or a payment happened, with amount and currency, and the advert click reference Google put in the link (gclid, gbraid or wbraid). For declared adults only, hashed email. Never notebook content | United States | policies.google.com/privacy, business.safety.google/adsprocessorterms |
| Apple (Apple Ads) | Attribution for the iPhone and iPad apps through Apple's AdServices framework: which Apple Ads campaign, if any, led to the install. Same rules as Meta, and only for visitors who are not signed in and accounts created on or after 3 October 2026 | An attribution request from the app, made without the advertising identifier or a tracking permission. No email and no hashed email. Never notebook content | United States | apple.com/legal/privacy |
| Apple Push Notification service | Delivers notifications where you permit them in the native iPhone or iPad app | Device push token and notification payload | Apple infrastructure | apple.com/legal/privacy |
What Sentry can see in a diagnostic trail. Sentry is described above as receiving error details. In a small number of places our diagnostic log also carries an AI generated page title, the raw text of a maths expression being repaired, and the text you typed into search, so a crash report can include those fragments.
What is not on this list
- No ad exchange, no data broker, and no advertising network other than those listed above: Meta, Google (Google Ads) and Apple (Apple Ads). Each receives only what its row describes, and a new advertising platform is added here before it receives anything: we do not sell personal data, and the sharing we do for advertising measurement never covers anyone we know is under 18. Privacy policy section 13.6 sets it out, and B2.2 and B2.9 explain how to switch it off.
- No school, university or teacher. Derive has no institutional accounts and discloses no student's work to an institution. See Children and students.
- Apple is not asked for your age range. That integration is not used.
Related documents
Privacy Policy, Terms of Service, Cookies, Children and students, AI disclosure, Data processing addendum.