Subprocessors
Last reviewed: 6 October 2026
Under GDPR Art. 28 we are required to tell you who we share user data with and why. This is the authoritative list. If you want the Data Processing Agreement with any specific subprocessor, email hey@startdoin.com.
Currently using
| Name | Purpose | Region | Transfer outside the EU |
|---|---|---|---|
| Supabase | Postgres database, authentication, private photo storage, Edge Functions. | EU-West Ireland | No transfer outside the EU. Standard contractual clauses are part of its data processing agreement. |
| Cloudflare | CDN, DDoS protection, hosting for our web app (Cloudflare Workers), and storage of generated result images (Cloudflare R2). | Global edge (automatic routing). Network data such as IP addresses is processed on its global network. | EU–US Data Privacy Framework; standard contractual clauses if it ceased to apply. |
| OneSignal | Mobile push notifications. Used only when a user opts in. | US / global. Only the minimum identifier needed to address a device. | Standard contractual clauses. |
| Resend | Transactional email: challenge invitations, account emails such as password reset, and safety alerts to our team. Receives the email address it sends to. | The provider is a US company; it processes the email address it sends to. | EU–US Data Privacy Framework and standard contractual clauses. |
What we are NOT using
- No analytics (Mixpanel, PostHog, Google Analytics).
- No crash reporting (Sentry, Bugsnag, Crashlytics).
- No advertising networks.
- No third-party tracking cookies.
If we add any of these in the future, they will appear in the "Currently using" table above first, and we will announce it in the app and on startdoin.com before activation.
Changes to this page
Every addition or removal is a material change to our processing. We announce it in the app and on startdoin.com. This page's git history is the audit log.
Questions? hey@startdoin.com