Service Providers and Subprocessors
Beta version. In effect from 1 October 2026. We will email parents before we make any material change to it.
How to read this
A service provider processes data on our instructions and for no purpose of its own. Under COPPA, handing children's personal information to a third party for the third party's own purposes is a disclosure, and disclosure needs separate parental consent. The right-hand column is therefore the column that matters.
The list
| Vendor | What it does for us | Does it receive information about a child? | Exactly what | Where | Basis |
|---|---|---|---|---|---|
| Supabase | The entire backend — database, authentication, file storage, including serving the pre-recorded lesson audio. The browser talks to it directly. | Yes. This is the only service that holds a child's information. | First name, avatar number, age band, grade, chosen lessons; lesson progress, points, game-time settings; "didn't get it" taps; product events; crash records; the child's sign-in credentials | us-east-1 (read from the provider's API) | Service provider — integral to delivering the service |
| Supabase platform logs (same vendor, separate matter) | The provider's own request logging, outside our database schema | Yes, incidentally. Every request a child's device makes | IP address, user agent, and an approximate location derived from IP — city, region and country — on every request sampled, plus the signed-in account id on most | Same | Service provider. Outside our own retention jobs — see the Retention Policy |
| Vercel | Hosting and content delivery | Yes, incidentally. Request logs, and crash lines written to the console | IP address, request path, user agent; a crash line can carry a child's internal id and the page being viewed | Functions run in iad1, Washington, D.C., USA (confirmed from the Vercel dashboard, 24 September 2026) | Service provider — integral |
| Stripe | Subscription checkout, billing, the payment pages (including a bank's approval step) and receipts | No. Parent data only | The parent's email address; the card and billing details the parent enters on Stripe's pages; the plan, number of seats and billing dates; our internal id for the parent's account (never a child's) | United States | Service provider, parent data only |
| Resend | Delivers every email the service sends. The app sends its own emails through Resend directly — the sign-up email, the two consent emails and the cancellation notice — and Resend is also the SMTP relay behind the authentication service's mailer (password reset, change of email address). Every message a parent receives is delivered by Resend | No, unless a progress email is ever built that names a child — none exists | The parent's email address and the content of the message | United States: North Virginia, us-east-1 (confirmed from the Resend dashboard, 24 September 2026) | Service provider |
| Google Sign-In | Optional sign-in for adults | No. Adults only, by top-level redirect; we send nothing | — | — | Not a recipient of our data |
| GitHub Actions | Encrypted database backups, stored as a 30-day build artifact | Would — a backup contains everything | The whole database, encrypted | GitHub (github.com), United States; kept 30 days, set by our backup job | Service provider. Backups working again from 23 September 2026; a full restore was proven that day. See the Security Program. |
| Google Fonts | Nothing at runtime | No. The font files are kept in our own code and served from our own domain; nothing is fetched from Google, not even when the app is built (since 26 September 2026). Verified: 212 font files in the code, zero references to Google's font host in the built stylesheet | — | — | Not a runtime recipient |
Services that receive nothing about a child
No analytics provider. No error or crash monitoring provider. No advertising or tracking service. No AI or text-to-speech provider at runtime — every audio clip a child hears is a pre-recorded file, the same for every child, served from the file storage of our database provider (Supabase, listed above). The request for a clip names only the recording — never the child or the account. Some recordings are feedback on an answer (for example "Not quite"), so which clips a device asks for can reflect how a question went, but not who answered. Where a clip is missing the fallback is the browser's own on-device speech. No child's input is ever sent to an AI or audio vendor.
How this absence was established, so it can be checked again rather than taken on trust: no analytics package is installed; no external script, beacon, sendBeacon, WebSocket or tracking pixel exists in the source; the Content-Security-Policy served by production restricts connections to our own origin and Supabase, so the browser is structurally unable to reach an analytics host; and a real child session driven on production — module list, a full lesson with audio, practice problems — produced 56 requests to exactly one origin, our own, with zero third-party requests. The same capture shows the audio and page loads, which proves the capture was live rather than empty.
Questions about your child's data? Email support@radlor.com or call 1-888-812-9373. You can download or delete everything from the parent dashboard.