◈ Legal
Everything you agreed to,in one place.
The terms of service, the privacy notice, the data processing addendum, the subprocessor list and the acceptable use policy.
Subprocessors
Everyone outside this company who touches any part of the service.
§ 01
The list
8 companies touch the service. None of them receives file contents, because we never receive file contents.
| Name | Purpose | Region | What they receive |
|---|---|---|---|
| Railway | Application hosting | US | Digests, metadata, audit logs |
| Neon | Database | US | Digests, metadata, account info |
| Stripe | Billing | US | Payment details, optional recovery email, invoice data |
| hCaptcha | Guest abuse prevention | Global | Browser, network, and challenge data |
| Cloudflare | Site delivery and sign-up abuse prevention | Global | Browser and network data, Turnstile challenge data |
| Alchemy | Base L2 RPC provider | Global | Anchoring transactions (digest only) |
| Resend | Transactional email | US | Email addresses and email contents |
| Sentry | Error monitoring | US | Error reports and request metadata |
§ 02
Thirty days’ notice
We publish a change to this list thirty days before it takes effect. Notice goes to the address on your account, and the date at the top of this document is the date the list last moved. If you use the service without an account, this page is the notice.
§ 03
Subprocessor Purposes
Railway. Runs the application service and background workers. Everything the service processes passes through Railway infrastructure: digests, record metadata, request logs, and audit trails.
Neon. The primary data store. Holds service records — digests, opted-in file metadata, timestamps — plus account email addresses and credit balances. Credentials are hashed before they reach it.
Stripe. Processes every card payment. Card details go to Stripe directly and never reach us; we see the payment outcome and invoice records. A guest checkout may share an optional recovery email with Stripe.
hCaptcha. Guards guest checkout against automated abuse. When you complete a challenge, hCaptcha processes the browser, network, and challenge signals it needs to score it, under its own terms.
Cloudflare. Serves this website and the console, and runs the Turnstile check on sign-up. As the host of the pages you are reading, it sees the browser and network facts any web host sees.
Alchemy. The primary route for broadcasting anchoring transactions to Base. It receives the signed transaction — which carries the digest and nothing else about your file — on its way to the public chain.
Resend. Sends service email: sign-up verification, guest receipts, notices. It receives the recipient address and the message contents, which for a receipt include the record reference.
Sentry. Receives error reports from the service: stack traces and the request metadata attached to a failure. Never file contents, because the service never has file contents to leak.
Additional Disclosures. If Alchemy is unavailable, we send the signed transaction and its digest-only payload to Base's public endpoint, operated by Coinbase. Once included on Base, the transaction and digest are public and readable by anyone.
We keep this list current.
We publish changes 30 days before they take effect so you can see which providers process service data.