Subprocessors
This list is a structural placeholder pending counsel review before first public launch.
Fitquency uses the following third-party subprocessors to operate the platform. Each processes only the data needed for its function.
| Subprocessor | Purpose | Data category |
|---|---|---|
| Supabase | Database, sign-in and file storage | Account and application data |
| Stripe | Payments | Billing identifiers |
| Vercel | Hosting for the website and API | All requests to them, including IP address, and the server logs they produce |
| Upstash (through Vercel) | Rate limiting and short-lived caching | IP address or account ID as a rate-limit key |
| Brevo | Email delivery, including sign-in and account emails | Email address, name, message content |
| Twilio | SMS (invitations and two-factor codes) | Phone number, message content |
| Expo | Push notifications and over-the-air updates for the mobile apps | Device push token, notification text |
| Google Firebase Cloud Messaging | Push notifications on Android | Device push token, notification content |
| OpenAI | AI features | Prompt content (PII-redacted) |
| Anthropic | AI features | Prompt content (PII-redacted) |
| Sentry | Error and crash reports (website, API, mobile apps) | Diagnostic and error data, PII scrubbed |
| Cloudmersive (US region) | Malware scanning of files you upload (attachments, photos, documents, imports); Cloudmersive states it does not keep scanned files | The uploaded file |
| PostHog (PostHog Cloud, US region) | Product analytics: directly from the web app; from the mobile app only through our servers and Segment. On by default for signed-in members, who can turn it off, unless their browser sends Global Privacy Control; for visitors, only after they accept analytics | Pseudonymous account ID (never your name or email), IP address, usage events, and, on the web app only, session recordings with everything typed and all on-screen text masked, never on health, nutrition, progress or body-measurement screens |
| Segment | Product analytics for usage events sent to our servers, passed on to PostHog, under the same Product analytics switch | Pseudonymous account ID and event data, with names, emails and phone numbers removed |
| USDA FoodData Central | Food search | Search text or barcode only; never your identity |
| Open Food Facts | Branded foods and barcode lookups | Search text or barcode only; never your identity |
| FatSecret | Restaurant and chain menu items, only for organizations with restaurant foods turned on | Search text only; never your identity |
| Pexels | Stock photo search | Search text only; never your identity |
We update this list before adding a new subprocessor. Questions: privacy@fitquency.com.