Subprocessors
Last updated: August 2026
These are the service providers ("subprocessors") that process personal data on Hangpost's behalf to operate the service. Each is bound by contract to use the data only to provide its service to us, and may not use it for its own advertising. This list is referenced by our Privacy Policy.
We do not use any third-party advertising, ad-targeting, or cross-app tracking providers; there are none on this list because they do not exist in the product.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Clerk | Authentication & account management | Phone, email, name, auth identifiers, IP addresses | United States |
| Neon | Primary database (Postgres) | All app data: profile, home-base setting, posts, connections, logs | United States |
| Render | Application / API hosting | All app data in transit and processing | United States |
| Vercel | Website hosting | IP addresses, request logs | United States |
| Upstash | Session store & rate limiting | Session tokens, user identifiers | United States |
| Cloudflare R2 | Photo & file storage | Photos you upload | United States |
| Sentry | Error & crash diagnostics | IP addresses, device info, request context (personal data scrubbed before sending) | United States |
| Grafana Cloud | Performance metrics | Pseudonymous identifiers only (no raw personal data in telemetry) | United States |
| Anthropic | Offline match-quality evaluation (training labels) | Profile-derived structured text, pseudonymous identifiers (no contact information) | United States |
| AWS Rekognition | Automated image moderation on uploaded photos, and photo verification | Uploaded avatar images; verification selfies, compared against your avatar by facial geometry (the selfie is deleted after the check) | United States |
| Expo | Push notification delivery | Push tokens, device identifiers, notification content | United States / global |
| Apple, Google | App distribution & push notifications | Push tokens, device identifiers | United States / global |
| Canadian Centre for Child Protection (Project Arachnid Shield) | Checking uploaded images against databases of known child sexual abuse material | Uploaded image bytes | Canada |
| NCMEC | Mandatory child-safety (CSAM) reporting where legally required | Report contents required by 18 U.S.C. § 2258A | United States |
Changes. We update this page before any new provider begins handling your data. Questions: privacy@hangpost.app.