Disclosure matrix for indie app stacks.
A service-by-service map across Apple Privacy Details, Google Data Safety, GDPR processor notes, and cookie-banner decisions.
Yes
Usually disclose this surface when the service is present.
Check
Depends on setup, region, or SDK behavior.
No
No direct disclosure trigger found for the common setup.
Scroll sideways to read all four disclosure surfaces.
| Service | Apple Privacy Details | Google Data Safety | GDPR processor list | Cookie banner? |
|---|---|---|---|---|
| Stripe Payments. Server-side calls; tokenized on the client when using Stripe.js or PaymentSheet. | Yes example wording Apple Privacy Details → Purchases (Purchase History) and Identifiers (User ID) — typically Linked to user, used for App Functionality. | Yes example wording Google Data Safety → Financial info → Purchase history and Payment info — Collected, encrypted in transit; data shared with Stripe as a processor. | Yes example wording List Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (US) as processors; link Stripe Privacy Policy. | Check example wording Stripe.js may set fraud-prevention cookies (m, __stripe_mid) — review whether EU traffic triggers a consent banner under your local guidance. |
| Supabase Postgres + Auth + Storage. Self-hosted or hosted on supabase.com. | Yes example wording Apple Privacy Details → Contact Info (Email), Identifiers (User ID) — Linked to user when using Supabase Auth. Other categories depend on your tables. | Yes example wording Google Data Safety → Personal info (Email, User IDs) — Collected and shared with Supabase Inc. as a processor. Add other categories that map to columns you store. | Yes example wording List Supabase, Inc. as a processor. Note your selected region (US, EU, etc.). | Check example wording Supabase Auth uses local storage / cookies for session tokens. Functional cookies may be exempt from consent; review your jurisdiction's rules. |
| PostHog Cloud Product analytics, session replay, feature flags. EU or US cloud. | Yes example wording Apple Privacy Details → Usage Data and Identifiers (Device ID) — typically Linked to user when you call posthog.identify(); used for Analytics. | Yes example wording Google Data Safety → App activity (App interactions, In-app search history) and App info and performance (Crash logs) — Collected and shared. | Yes example wording List PostHog Inc. (US) or PostHog B.V. (EU). State whether session replay is enabled and that DOM masking is configured. | Yes example wording PostHog sets analytics cookies (ph_*). Treat as non-essential — a consent banner is typically required for EU traffic. |
| Resend Transactional email API. | Yes example wording Apple Privacy Details → Contact Info (Email Address) — Linked to user, used for App Functionality. | Yes example wording Google Data Safety → Personal info (Email) — Collected and shared with Resend as a processor. | Yes example wording List Resend, Inc. as a processor handling email delivery. | No example wording Server-side only; no client cookies from Resend itself. |
| OpenAI API Server-side LLM calls (chat, embeddings, transcription, etc.). | Yes example wording Apple Privacy Details → User Content (whatever the user submits to your AI feature) — Linked to user. Disclose how prompts are used. | Yes example wording Google Data Safety → Messages (Other in-app messages) or App info (Other actions) — Collected and shared with OpenAI L.L.C. as a sub-processor. | Yes example wording List OpenAI, L.L.C. (US) — Standard Contractual Clauses are typically referenced in the OpenAI DPA. Disclose whether you opted out of training (API default since 2023). | No example wording Server-side only. |
| Anthropic API Server-side Claude calls. | Yes example wording Apple Privacy Details → User Content — Linked to user; used for App Functionality. Treat inputs the same way you would treat any LLM provider. | Yes example wording Google Data Safety → Messages or App info → Other actions — Collected and shared with Anthropic, PBC as a sub-processor. | Yes example wording List Anthropic, PBC (US). Reference the Anthropic Commercial Terms and DPA. Note Anthropic states API inputs are not used to train models by default. | No example wording Server-side only. |
| Vercel Hosting + edge runtime + Vercel Analytics + Speed Insights. | Yes example wording Apple Privacy Details → Identifiers (IP address routed via Vercel edge) and Usage Data (if Analytics enabled) — typically Linked to user. | Yes example wording Google Data Safety → Web app and device IDs — Collected. If Vercel Analytics is on, also disclose anonymized usage data. | Yes example wording List Vercel, Inc. as a processor. Disclose region if you use a regional edge. | No example wording Vercel Analytics is cookieless by design. Vercel itself may set short-lived security cookies — review their current docs. |
| Cloudflare CDN, DNS, R2, Workers, Turnstile. | Yes example wording Apple Privacy Details → Identifiers (IP address) and Usage Data (request logs) — Linked to user where Cloudflare can correlate. | Yes example wording Google Data Safety → App info and performance (Crash logs, Diagnostics) when using Cloudflare Logs/Analytics — Collected. | Yes example wording List Cloudflare, Inc. as a processor. Reference Cloudflare's DPA. If using Cloudflare Turnstile, disclose it replaces a CAPTCHA challenge. | Check example wording Cloudflare may set the __cf_bm bot-management cookie. Review whether it counts as strictly necessary in your jurisdiction. |
| Sentry Error monitoring. | Yes example wording Apple Privacy Details → Diagnostics (Crash data, Performance data) — usually Not Linked to user if you strip PII; Linked if you attach user context. | Yes example wording Google Data Safety → App info and performance (Crash logs, Diagnostics) — Collected and shared with Functional Software, Inc. (Sentry). | Yes example wording List Functional Software, Inc. dba Sentry as a processor. | No example wording Server-side or SDK; no analytics cookies from Sentry by default. |
| Google Analytics 4 Web analytics. Subject to GA4 EU-region settings, Consent Mode v2. | Yes example wording Apple Privacy Details → Usage Data and Identifiers (Device ID) — Linked to user; used for Analytics and Third-Party Advertising depending on settings. | Yes example wording Google Data Safety → App activity and Device or other IDs — Collected and shared with Google LLC. Disclose Google Signals if enabled. | Yes example wording List Google LLC and Google Ireland Limited. Reference Google Ads Data Processing Terms and your Consent Mode v2 setup. | Yes example wording GA4 sets _ga and _ga_* cookies. A consent banner is typically required for EU traffic before GA fires. |
| Apple Sign In Identity provider. | Yes example wording Apple Privacy Details → Contact Info (Email, possibly a relay address) and Identifiers — Linked to user. | Yes example wording Google Data Safety → Personal info (Email, User IDs) — Collected; shared with Apple as auth processor. | Yes example wording List Apple Distribution International Ltd. as a processor. Note that the email may be Apple's private relay address. | No example wording Native flow on iOS/macOS; web flow may set short-lived session cookies — review Apple's docs. |
| Mixpanel Event analytics. EU residency option. | Yes example wording Apple Privacy Details → Usage Data and Identifiers — typically Linked to user when distinct_id is identified; used for Analytics. | Yes example wording Google Data Safety → App activity (App interactions) — Collected and shared with Mixpanel, Inc. as a processor. | Yes example wording List Mixpanel, Inc. Disclose chosen data residency (US or EU). | Yes example wording Mixpanel sets analytics cookies (mp_*). Treat as non-essential — consent typically required for EU traffic. |
Primary references include Apple's App Privacy Details and Privacy Manifest docs, Google Play's Data Safety guidance, GDPR Art. 13 / 14, CCPA notice-at-collection rules, and vendor privacy or DPA pages. Access dates are tracked in Synthrek's source ledger.
View sources