| Service | Purpose | Data categories | Health data | Region | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase | Database, authentication, file storage | Account & profile, all health/fitness records, messages, photos & voice notes (storage) | Yes | United States | Standard Contractual Clauses + transfer impact assessment (UK Addendum) |
| Stripe | Payments, subscriptions, coach payouts | Name, email, billing details, card brand & last four, transaction status | No | US / global | EU-US Data Privacy Framework / SCCs (per Stripe DPA) |
| Vercel | Web hosting, edge delivery, product analytics | IP address, request & usage data | No | US / global | EU-US Data Privacy Framework |
| Cloudflare | DNS, network security, Turnstile bot check | IP address, bot-challenge token | No | US / global | EU-US Data Privacy Framework |
| OpenAI | "Nora" assistant, voice transcription, text-to-speech | Coaching text that can include recovery, sleep, weight, body-fat, mood and training context; meal-note voice audio | Yes | United States | Standard Contractual Clauses (OpenAI API) |
| Google Firebase Cloud Messaging | Push notifications | Device push token, notification content | No | US / global | EU-US Data Privacy Framework / SCCs (Google DPA) |
| Resend | Transactional & (opt-in) marketing email | Name, email, message content | No | United States | Data Privacy Framework / SCCs (Resend DPA) |
| Instacart | Grocery-list hand-off (only when you use it) | Grocery list items | No* | United States | Per Instacart terms |
| Apple (HealthKit / MusicKit) | Health import on iOS; music playlists | Health metrics you authorize on your device; playlist references | Yes | On-device + US | Apple platform terms |
| Spotify | Playlist sharing (in-workout audio) | Basic profile, playlist references | No | US / global | Per Spotify terms |
| Strava / Garmin / Whoop / Oura | Wearable import (only the ones you connect) | Activities, heart rate, HRV, sleep, recovery, calories | Yes | US / global | Per provider terms |
* Instacart receives the items on a grocery list you choose to send, which can reveal dietary information.
Shape is operated from the United States, so data is processed in the U.S. For people in the EEA and the UK, transfers to the U.S. rely on the safeguard listed for each service above — the EU-US Data Privacy Framework where the service is certified, or European Commission Standard Contractual Clauses (with the UK International Data Transfer Addendum) and a transfer impact assessment where it is not. We maintain SCCs as a fallback even for Data-Privacy-Framework-certified services.
When we add, remove, or materially change a subprocessor, we update this page and the "Last updated" date above. For material changes that affect how your data is handled, we also give notice as described in the Privacy Policy. Questions: privacy@theshapecommunity.com.