Current providers
| Provider | What it does for Hearn | What it receives |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting and network (Workers), project storage (Durable Objects, R2), email sending, rate limiting, security, and Workers AI for Marginalia | Your writing and pictures in signed-in projects, account and session data, request metadata, and email addresses for sign-in codes. For Marginalia, only the text each check needs |
| Neon, Inc. (USA) | Managed Postgres database for accounts, sessions, project registry, membership, sharing and publishing records | Account and project metadata, not the body text of your pages |
| RevenueCat, Inc. (USA) | Subscription and entitlement management across iOS, Android and web | Your account ID, product, purchase and renewal status |
| Stripe, Inc. (USA) | Payment processing and tax calculation for web purchases (through RevenueCat Web Billing) | Payment details you enter at checkout, billing country and postal code, email |
| Apple Inc. (USA) | Sign in with Apple, App Store purchases, and push delivery (APNs) on iOS | What you share when signing in (name, email or relay address, ID); purchase data; push token |
| Google LLC (USA) | Sign in with Google, Google Play purchases, and push delivery (FCM) on Android | What you share when signing in (name, email, ID); purchase data; push token |
Providers used only if a feature is on
- Expo (650 Industries, Inc.): relays mobile push notifications to Apple and Google, only when push notifications are enabled. It receives a push token and the notification's short title, never your manuscript text.
- Ghost and WordPress sites you connect: they receive the text and images you choose to publish. You control them; they are not our subprocessors.
- A web search provider for Marginalia fact checks: receives short queries, not your manuscript. Named here before Marginalia launches.
Sign-in providers we plan to add
We are planning optional sign-in with LINE, Kakao, NAVER and WeChat for readers and writers in Japan, Korea and China-speaking regions. Each would receive what is needed to sign you in and would be added to the list above before launch.
How we choose and manage providers
We use providers that offer data protection commitments appropriate to the data they handle, limit what each one receives to what its role needs, and use contracts that restrict them to providing services to us. For transfers out of the EEA, UK and Switzerland we rely on their Standard Contractual Clauses or equivalent safeguards.
Questions about a provider, or a request for the data processing terms we have with one, go to write@hearn.app. See the Privacy Policy for how your information is used and your rights.