International Transfer Details
Destination countries and regions may vary depending on each provider’s infrastructure, subprocessors, user location, failover, and backup operations. The table lists the main countries and regions we can identify and notes why some locations may vary. For country-system summaries, see information published by Japan’s Personal Information Protection Commission. By using the service or relevant feature, you may be treated as consenting to storage or processing by these foreign providers. The operator reviews provider-published information, contractual terms, security features, subprocessor information, and applicable transfer mechanisms, and endeavors to confirm continuing safeguards where needed.
| Provider | Examples of information provided | Main destination countries / regions | System summary / reference | Privacy policy | Safeguards reviewed |
|---|---|---|---|---|---|
| Supabase | Account information, authentication data, shopping lists, stock, recipes, family group data, logs, and anonymized error reports | United States, EU, Singapore, etc. (varies by project settings and infrastructure) | Refer to information published by Japan’s Personal Information Protection Commission for country-system summaries | Supabase Privacy Policy | Encryption in transit, access controls, cloud infrastructure security features, and provider-published data protection measures |
| Google Firebase (FCM) | FCM registration tokens, device information, identifiers required for notification delivery, and logs | United States, EU, Japan, Singapore, etc. (varies by Google’s global infrastructure and processing locations) | Refer to information published by Japan’s Personal Information Protection Commission for country-system summaries | Google Privacy Policy | Google’s data protection measures, encryption in transit, and use limited to notification delivery needs |
| RevenueCat | App user IDs, purchase transaction IDs, receipt data, subscription plan and entitlement data | United States, EU, etc. (varies by RevenueCat infrastructure, subprocessors, and processing locations) | Refer to information published by Japan’s Personal Information Protection Commission for country-system summaries | RevenueCat Privacy Policy | Processing limited to subscription management needs, and provider-published security and data protection measures |
| Google AdMob / Google Mobile Ads | Advertising identifiers (IDFA / GAID), device information, ad impression and interaction data, coarse location, etc. | United States, EU, Japan, Singapore, etc. (varies by Google’s global ad delivery infrastructure and processing locations) | Refer to information published by Japan’s Personal Information Protection Commission for country-system summaries | Google Privacy Policy | ATT / consent management, personalized ads settings, and Google’s advertising data protection measures |
| Apple | Apple Sign In identifiers, App Store purchase information, subscription status, and store account information | United States, EU, Japan, etc. (varies by Apple’s global infrastructure and processing locations) | Refer to information published by Japan’s Personal Information Protection Commission for country-system summaries | Apple Privacy Policy | Apple ID / App Store privacy protections and payment processing under store terms |
| Google Sign In identifiers, Google Play purchase information, subscription status, and store account information | United States, EU, Japan, Singapore, etc. (varies by Google’s global infrastructure and processing locations) | Refer to information published by Japan’s Personal Information Protection Commission for country-system summaries | Google Privacy Policy | Google Account / Google Play privacy protections and payment processing under store terms |
The operator uses these external services only as needed to provide PantryMix after reviewing provider-published information, contractual terms, security features, subprocessor information, and applicable transfer mechanisms.