Subprocessors
The companies below process personal data for us. Last changed: 7 November 2026. We add a new one here 30 days before it starts; write to privacy@chillcode.net to be told by email.
Processors
| Company | Does | Data | Where |
|---|---|---|---|
| Supabase, Inc. | Database and sign-in | Accounts, teams, templates, sessions while they are kept | EU — Ireland (AWS eu-west-1) Data stored in the EU. Supabase is a US company; access from outside the EU is covered by its DPA with Standard Contractual Clauses. |
| Fly.io, Inc. | Application hosting | Everything passing through a live session; open sessions are held in memory | EU — Frankfurt (fra) Machines run in the EU. Fly.io is a US company; access from outside the EU is covered by its DPA with Standard Contractual Clauses. |
| Cloudflare, Inc. | DNS and email forwarding | Emails you send to our addresses (support, privacy, security) pass through it to our mailbox | Global network Cloudflare is a US company; covered by its DPA with Standard Contractual Clauses and the EU-US Data Privacy Framework. |
| Google LLC (Gmail) | Our mailbox | Emails you send to our addresses and our replies | US and EU Google is a US company; covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. |
Not processors, for completeness
| Company | Does | Data | Role |
|---|---|---|---|
| Paddle.com Market Ltd | Reseller and merchant of record for paid plans | The buyer’s name, email, address, VAT number and payment details. We never see the card. | Independent controller: Paddle sells the subscription to you under its own buyer terms and privacy notice. |
| Google LLC, GitHub, Inc. | Sign-in, if you choose it | They tell us your name, email and avatar when you sign in. They receive nothing from sessions. | Independent controllers: you hold the account with them. |
| jsDelivr (Prospect One) | Public CDN for the code runners | When someone presses Run in Python or TypeScript, their browser downloads the runtime from cdn.jsdelivr.net. jsDelivr sees that browser’s IP address, not the code. | Not a processor: no session data is sent to it. |