This is the complete list of providers that process personal data on our behalf to operate Hoard. It forms part of the Privacy Policy and is kept current here so you can check it at any time.
Change notice: before adding a new sub-processor that handles user content, we will announce it on this page and by email at least 30 days in advance. If you are not comfortable with it, you may cancel and export your data before the change takes effect, with a pro-rata refund if you are a paying subscriber.
| Provider | Purpose | Data processed | Location | Since |
|---|---|---|---|---|
| Supabase Pte Ltd | Authentication | Email and account identifiers | Frankfurt, Germany (AWS) | 2026-01 |
| Cloudflare, Inc. — R2 | Snapshot storage | Save contents, encrypted at rest | European Union | 2026-01 |
| Cloudflare, Inc. — Turnstile | Web sign-in captcha | IP address and browser signals | Cloudflare global network | 2026-03 |
| Fly.io, Inc. | API and metadata database hosting | Account and save metadata, playtime and all API traffic | Paris, France | 2026-01 |
| Microsoft Corp. — GitHub Pages | Public site hosting | Site access logs | CDN network | 2026-01 |
| Polar Software Inc. | Merchant of Record: charging, VAT, invoicing | Payment and billing data | United States | 2026-04 |
| Resend, Inc. | Transactional email | Email address and message content | European Union | 2026-06 |
Self-hosting
If you run Hoard against your own server, none of these providers is involved: you are the controller and the sub-processors are whichever ones you choose.
Contact
For any question about this list or to request a copy of the processing agreements: [email protected].