Subprocessor list

• Hosting provider (Hetzner Online GmbH): application, database and Redis hosting, and storage for data exports and encrypted backups. Redis holds sign-in blocklist and rate-limit state. Servers and storage are in Germany.
• Cloudflare: domain name service, forwarding of mail sent to our role addresses, and an encrypted copy of database backups kept in its EU storage.
• Resend: sends transactional mail to caregivers, such as the verification link. Addresses are caregiver personal information, so a data processing agreement is required. Resend stores message content, delivery logs and account records in the United States.
• Sentry: crash reporting. Identifiers such as the child profile id are removed before a report is sent.

• RevenueCat: purchase receipts and entitlements only. No purchases are available in the beta.
• Stripe: purchase receipts and entitlements, and caregiver billing identifiers. No purchases are available in the beta.

Clinician and organization services, which could involve health information, are not part of the beta. If they launch, this list and the agreements behind it will be updated first.

Our plan is to give 30 days' notice before a new subprocessor goes live and to review this list every quarter. This page does not claim that either step has been completed.