Legal
Service Providers
The companies that help us run Novash, and exactly what each one receives. Last updated: 15 October 2026.
None of them can read your vault
Who helps run Novash
Each provider below processes data only to deliver its part of the service, under its own security and privacy commitments. We do not sell data to anyone, and none of these providers receives data for advertising.
Supabase
- Purpose
- Database, sign-in, and server functions
- Receives
- Your account, your encrypted vault, devices, activity history, and settings
- Location
- Database in Frankfurt, Germany (EU)
Apple
- Purpose
- App Store distribution, subscription payments, and push notification delivery
- Receives
- Your purchases and push tokens (your payment details stay with Apple and never reach us)
- Location
- United States and worldwide
RevenueCat
- Purpose
- Checking whether your subscription is active
- Receives
- Purchase records from Apple, linked to a random account ID (not your email)
- Location
- United States
Zoho ZeptoMail
- Purpose
- Sending verification codes and security alerts
- Receives
- Your email address and the content of those emails
- Location
- United States
Cloudflare
- Purpose
- Bot checks in the app (Turnstile), and hosting and protecting this website
- Receives
- IP address and technical browser or device signals
- Location
- Worldwide network
Google Firebase
- Purpose
- Push notifications (Cloud Messaging) and crash reports (Crashlytics)
- Receives
- Push tokens, and crash details with device model, system and app version, and an installation ID
- Location
- United States
Have I Been Pwned
- Purpose
- Breach check, only when you start it
- Receives
- The first five characters of a password’s SHA-1 hash, never the password itself
- Location
- Australia, served worldwide
Slack
- Purpose
- Receiving the feedback you send from the app
- Receives
- The topic and message you write, and a shortened account ID
- Location
- United States
Transfers outside your country
Some providers process data in the United States or other countries. Where European law requires a safeguard, we rely on the one each provider offers, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Ask us at support@novash.app if you want details.
Changes
We keep this list up to date and change the date above whenever a provider is added or removed. Read our Privacy Policy for the full picture.