Third Parties Who Process Your Information
This list names every third party that receives any of your information, and states for each one whether it is in use today. It is compiled against the product's own dated call receipts, not from memory. Entries marked as built but not reached are listed because they exist in the software and could become active; they are not receiving anything today.
We do not sell your personal information. We do not share it for advertising. Beyond the parties named below, we provide your information to no one, except where the law requires it, where it is necessary to protect someone's life or safety, or where you ask us to.
Processing that happens on your phone is not provision to a third party. In this version, speech transcription is computed on the phone, and pictures you take or select are handled there — so neither reaches any party on this list. If that changes, this list changes with it, before the change ships.
1. In use today
| Who | What they receive | Why | Where |
|---|---|---|---|
| Alibaba Cloud (infrastructure) |
The encrypted records, the database, object storage, and the operational and security logs the service depends on | Running the servers, database and storage the product is built on | US East 1 — Northern Virginia, United States. Encryption keys are not held by them; key management runs on Atween's own self-hosted service. |
| Alibaba Cloud DirectMail (email delivery) |
The email address you just typed, and the one-time sign-in code being sent to it | Delivering your sign-in code. This is the only email Atween sends. | US East 1 — Northern Virginia, United States |
| Alibaba Cloud Model Studio (Bailian — AI inference) |
The minimum text assembled for the current purpose — what is needed, still authorised, and not deleted — together with the request metadata that identifies the feature | Organising what you wrote, drafting the one sayable sentence, safety recognition, and generating the images described below | The workspace endpoint is in US East 1 — Northern Virginia. The provider's inference computation may take place elsewhere. |
| Cloudflare, Inc. (R2 object storage) |
Encrypted nightly backups of the main database | Disaster recovery. Restoring a backup is the only rollback path. | Cloudflare's global network |
| Apple Inc. (App Store, StoreKit 2) Google LLC (Google Play, Play Billing) |
Your store account identifier, the transaction and product identifiers, purchase and refund status, the receipt or purchase token, and whatever the store itself collects when you install or pay | Distributing the application, and taking, verifying and refunding the one-time purchase. We never see your card or bank details. | Apple's and Google's own infrastructure |
Which models we call
Text is processed by Qwen3.7‑Flash. A separate safety check uses Qwen3.5‑Flash. Images that the product generates from its understanding of you are produced by Wan2.6‑t2i, and edited — once, to your instruction — by Wan2.6‑image. These are the models actually called; if we change one, this list changes with it.
No third party is permitted to use your content to train or fine-tune any model, and we do not send it for that purpose.
The voice path
- Play Integrity attests the device before a transcript is submitted; every voice submission from a released build calls it.
- Object storage holds sealed transcript candidates; it holds no audio and no media.
2. Built into the software, but not reached today
These exist in the code and could become active. Nothing flows to them at present, and we will move them into section 1 before they do.
- Alternative model providers — the software can route inference to other providers in other regions. None is configured, and none has ever been called. Only Alibaba Cloud Model Studio, named above, is in use.
3. How this list is kept honest
Each entry in section 1 corresponds to a dated call receipt stored with the product's source, recording a real request to that provider and its response. An entry does not move from section 2 to section 1 on anyone's recollection; it moves when there is a receipt.
Providers change their own code, terms and regions. Where a change materially affects who processes your information, we will update this list and tell you.