| Service | Purpose | Data categories | Health data | Region | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase | Database, authentication, file storage | Account & profile, all health/fitness records, messages, photos & voice notes (storage) | Yes | United States | Standard Contractual Clauses + transfer impact assessment (UK Addendum)intended — not yet confirmed; residency choice still open |
| Stripe | Payments, subscriptions, coach payouts | Name, email, billing details, card brand & last four, transaction status | No | US / global | EU-US Data Privacy Framework / SCCs (per Stripe DPA)intended — not yet confirmed |
| Vercel | Web hosting, edge delivery, product analytics | IP address, request & usage data | No | US / global | EU-US Data Privacy Frameworkintended — not yet confirmed |
| Cloudflare | DNS, network security, Turnstile bot check | IP address, bot-challenge token | No | US / global | EU-US Data Privacy Frameworkintended — not yet confirmed |
| OpenAI | "Nora" assistant, voice transcription, text-to-speech | Coaching text that can include recovery, sleep, weight, body-fat, mood and training context; meal-note voice audio | Yes | United States | Standard Contractual Clauses (OpenAI API)intended — not yet confirmed; zero-retention / no-training terms unconfirmed |
| Google Firebase Cloud Messaging | Push notifications | Device push token, notification content | No | US / global | EU-US Data Privacy Framework / SCCs (Google DPA)intended — not yet confirmed |
| Resend | Transactional & (opt-in) marketing email | Name, email, message content | No | United States | Data Privacy Framework / SCCs (Resend DPA)intended — not yet confirmed |
| Instacart | Grocery-list hand-off (only when you use it) | Grocery list items | No* | United States | Per Instacart terms |
| Apple (HealthKit / MusicKit) | Health import on iOS; music playlists | Health metrics you authorize on your device; playlist references | Yes | On-device + US | Apple platform terms |
| Spotify | Playlist sharing (in-workout audio) | Basic profile, playlist references | No | US / global | Per Spotify terms |
| Strava / Garmin / Whoop / Oura | Wearable import (only the ones you connect) | Activities, heart rate, HRV, sleep, recovery, calories | Yes | US / global | Per provider terms |
| Radio.co | Streams Shape Radio (non-interactive internet radio) | IP address and user agent of the listening device; no account details and no health data | No | US / global (content delivery) | Per Radio.co terms |
| Sentry | Error and crash reporting, so we can find and fix faults | Error details and technical context (device, app version, page); your user ID and role where you are signed in | No* | US / global | Standard Contractual Clauses (Sentry DPA)intended — not yet confirmed |
| Jitsi (meet.jit.si) | Video calls for coaching consultations | Audio and video of the call, IP address, display name | Yes* | US / global | Per Jitsi/8x8 terms — see the note below this table |
| FormSubmit.co | Relays the web sign-up and coach-application forms to our inbox | Everything on the submitted form — for the client questionnaire this includes injuries, medical conditions, medications, allergies and an emergency contact | Yes | US / global | Per FormSubmit terms — see the note below this table |
| Google (Android backup) | Disabled. Android's operating-system backup is switched off for the Shape app, so your app data is not copied to your Google Drive, and every data category is also excluded from Android's device-to-device transfer | None — the app opts out of OS cloud backup, and excludes every data category from device transfer | No | — | Not applicable; listed so you know we considered it. Switching cloud backup off does not by itself govern device-to-device transfer on Android 12 and later, so that is excluded separately, category by category, in the app's data-extraction rules |
| USDA FoodData Central | Food and nutrition search | The food search terms you type. No account details | No | United States | US government public API |
| Open Food Facts | Food, brand and barcode search | The food search terms or barcode you enter. No account details | No | EU (France) | Open database, public API |
| Google Fonts | Serves the typefaces used on our web pages | IP address and user agent, when your browser requests a font file | No | US / global | Google terms — we intend to self-host these; see the note below this table |
| SoundHelix | Serves the sample audio clips on the legacy coach preview pages | IP address and user agent, when your browser requests a clip | No | US / global | Per provider terms |
| unpkg, esm.sh | Content-delivery networks that serve JavaScript libraries our web pages use | IP address and user agent, when your browser requests a file | No | US / global | Per provider terms |
| YouTube, Vimeo, Unsplash | Plays embedded video (for example a coach's form clip) and serves images | IP address and user agent, only on pages where such media loads or you press play | No | US / global | Per provider terms (YouTube: Google) |
* Instacart receives the items on a grocery list you choose to send, which can reveal dietary information. Sentry can incidentally include health-related content if it appears in an error report. Jitsi carries whatever you say and show on a coaching call, which is why it is marked yes. Android backup is not listed here because it is switched off in the app and receives nothing, as the row above records.
We would rather explain these than let a table imply everything is settled.
meet.jit.si service. We are moving this to a dedicated instance under a data processing agreement so that call media is covered by contract rather than by a public service's general terms.Shape is available worldwide, and our infrastructure is hosted in the United States, so your data is processed in the U.S. and in the other locations listed for each service above. For people in the EEA and the UK, the safeguard we intend for each recipient is the EU-US Data Privacy Framework where that recipient is certified, or European Commission Standard Contractual Clauses (with the UK International Data Transfer Addendum) and a transfer impact assessment where it is not. That work is not finished, and this page is where we say so rather than imply otherwise. The safeguard column above is marked recipient by recipient: where it says provider terms, that is what is in place today, and where a framework or clauses are named but carry “intended — not yet confirmed”, that is the safeguard we are putting in place, not one we have already verified. An unmarked entry is one we hold. Completing the outstanding clauses and assessments is in progress, and this page is updated as each one lands. If the safeguard for a specific recipient matters to you, ask us at privacy@theshapecommunity.com.
Shape Radio is the one part of Shape we limit by territory, for music-licensing reasons: we will offer it only where the relevant webcasting licenses are in place, which at launch means the United States and United Kingdom, and we will not stream to a territory before those licenses cover it. The rest of Shape is not limited that way.
When we add, remove, or materially change a subprocessor, we update this page and the "Last updated" date above. For material changes that affect how your data is handled, we also give notice as described in the Privacy Policy. Questions: privacy@theshapecommunity.com.