Always active
These run for every account, because the app cannot work without them. Each is engaged under a data processing agreement under Article 28 GDPR.
- OpenAI, L.L.C. (United States) and Cloudflare, Inc. (United States) — private-preview and public website hosting, deployment, and content delivery. They process ordinary web request metadata and serve public pages and assets.
- Convex, Inc. (United States) — database, file storage, and server functions. Processes all account, profile, wallet, and moderation data.
- Apple Inc. (United States) and Google LLC (United States) — app distribution, optional sign-in, and payment processing. Card details never reach us.
- RevenueCat, Inc. (United States) — purchase receipt verification and subscription state. Processes store transaction identifiers and an app user identifier.
- OpenAI, L.L.C. (United States) — automated moderation of images, video frames, and profile text. Content is sent to the moderation endpoint only and is not used for model training.
Active only in specific circumstances
Each of these stays inactive until the circumstance in question arises.
- Resend (United States) — sends the six-digit sign-in code, and therefore receives your email address. Active only if you sign in by email rather than with Apple or Google.
- Sightengine SAS (France) — second-opinion moderation of borderline images. Active only when a first-pass score lands in the borderline band and the check is enabled.
- OneSignal, Inc. (United States) — push notification delivery. Active only after you allow notifications.
- Functional Software, Inc. dba Sentry (United States) — crash reporting. Active only after you consent in Settings.
- PostHog, Inc. (analytics data held in the European Union) — product analytics. Active only after you consent in Settings.
Transfers outside the European Economic Area
Processors established in the United States are engaged under the European Commission’s standard contractual clauses of 4 June 2021, together with a transfer impact assessment, and under the EU–US Data Privacy Framework where the recipient is certified. Analytics data is held in the European Union.
Changes
We will update this list before engaging a new processor. If you object to a new processor, you may delete your account before the change takes effect.
Questions: privacy@podium.lol.