Subprocessors
Last updated June 2, 2026
Current subprocessors
We engage the following third-party processors to deliver Pawpy. Each processor handles only the data necessary for the listed purpose.
| Vendor | Purpose | Data categories | Jurisdiction | DPA |
|---|---|---|---|---|
| Google (Firebase Analytics) | Analytics (Android only today) | Anonymous device IDs, screen visits, named typed in-app interaction events (no free-text fields) | US (with EU Standard Contractual Clauses) | Firebase DPA |
| Google (Firebase Crashlytics) | Crash reporting (Android only today) | Anonymous device IDs, OS version, stack traces from crashes, non-fatal error reports caught by the app | US (SCCs) | Firebase DPA |
| Google (Firebase Cloud Messaging) | Marketing re-engagement push notifications (Android only today, opt-in) | Anonymous device push token, audience signal that triggered the campaign, campaign identifier | US (SCCs) | Firebase DPA |
| Hetzner Online GmbH | Product telemetry, account data, hosting | All product telemetry, account email and auth tokens | Helsinki, Finland (EU) | Hetzner DPA |
How we update this list
When we add, swap, or remove a vendor:
- Update this table.
- Update the "Last updated" date at the top.
- Update Play Store Data Safety form and Apple App Privacy form if the change introduces a new data category, sharing destination, or lawful basis.
- Re-submit both store builds with the updated forms.
- Notify users via in-app banner if the change is material (new purpose, new category).
Removed subprocessors
When a vendor is removed, we move its row here with the date of removal so the audit trail is preserved.
| Vendor | Period engaged | Reason removed |
|---|---|---|
| (none yet) | ||