Who touches your data
The companies that process personal data on our behalf, what each one does, and where it runs. We post a change here before a new provider starts.
| Provider | What it does for us | Where | Since |
|---|
| Render | Application hosting — runs the web server, the API and the scheduled jobs | United States (Ohio) | 2026-08 |
| Neon | Database — stores your records, encrypted at rest | United States (Ohio) | 2026-08 |
| Cloudflare | Network edge and off-provider backup storage — TLS, bot protection, and an encrypted nightly copy of the database in R2 | United States (global edge) | 2026-08 |
| Cloudflare Email Routing | Mail forwarding — passes mail sent to support@ and contact@, and messages from the contact form, to the support mailbox. Receives the sender’s address and the message | United States (global edge) | 2026-09 |
| Google (Gmail) | Support mailbox — where mail to support@ and contact@ is read and answered. Holds the sender’s address and the conversation; replies are sent through Resend | United States and other countries (Google’s data centers) | 2026-09 |
| Resend | Email delivery — verification, security notices, renewal reminders, messages from the contact form, and our replies from support@. Receives the addresses and the message; the app’s own emails carry no financial figures | United States | 2026-08 |
| Sentry | Error reporting — receives a stack trace when something breaks; personal data is stripped before it is sent | United States | 2026-09 |
Not a processor: Paddle
Paddle is our merchant of record. When you subscribe, Paddle sells you the subscription in its own name, takes your card, and handles tax and refunds. It holds that billing relationship as an independent controller under its own privacy notice, not as our processor. We never see your card number. Paddle receives your email address and which plan you chose, and nothing about your holdings.
Not on this list
Nobody else. There are no analytics providers, advertising networks, session-recording or chat tools on this site. The only code it runs from anyone but us is Cloudflare’s check that a visitor is a person, on the forms that ask for one, and Paddle’s checkout when you pay; the browser is told to refuse anything else. If that ever changes, it will appear here first.
Each provider above except Google has accepted a data processing agreement with us that includes the EU standard contractual clauses and the UK addendum, for the day we serve people there.
