Sub-processors
Last updated 27 May 2026
Quick Plays uses the third parties below to operate. Each one processes a narrow slice of data on our behalf, under a written Data Processing Agreement. We list them here so you know who sees what; changes are announced via the in-app notification bell before they take effect.
Supabase
supabase.com- Purpose
- Hosted Postgres + authentication + realtime subscriptions.
- Data shared
- Everything in your account: email, coaching content, roster, activity, events. Authentication tokens are scoped per request.
- Region
- us-west-2 (Oregon, USA)
Cloudflare Pages
pages.cloudflare.com- Purpose
- Static-asset hosting and CDN. Serves the JS bundle and the OG-card edge function.
- Data shared
- Request metadata (IP address, user agent, URL path) for routing and DDoS protection. No coaching content stored at Cloudflare; only fetched from Supabase at edge-request time.
- Region
- Global edge, origin US.
Sentry
sentry.io- Purpose
- Error and crash reporting. Pinned to @sentry/browser (no server runtime).
- Data shared
- Stack traces, breadcrumb logs (fetch URLs but not bodies; Authorization headers stripped; base64 audio blobs scrubbed). User identifier only — never email.
- Region
- Sentry SaaS (US).
PostHog Cloud US
posthog.com- Purpose
- Product analytics (event funnel, retention, feature flag delivery).
- Data shared
- Events from a frozen 14-name taxonomy (signup, play_created, etc.) plus the user id when signed in. No email, no roster names, no play content.
- Region
- us.i.posthog.com (US).
Object to a sub-processor
If your organization has a contractual right to object to specific sub-processors (typical in district / enterprise agreements), email [email protected] within 30 days of any change announced via the notification bell. We’ll work through alternatives or, where none exist, terminate the agreement with a pro-rated refund.