Subprocessors
These are the companies that process personal data on behalf of Kaiten Gaming LLC to run the Freero service at https://freero.app/. For organizations that use the service under our data processing addendum, they are our subprocessors. How we protect the data is in the security overview; what we collect and why is in the privacy policy.
If you run Freero yourself, none of this applies to you: your server uses the providers you choose, under your own agreements with them.
Subprocessors
The first six rows are filled in from this server’s own configuration when the page is served, so they always name what the service really uses.
| Provider and where | What it does | Personal data it handles |
|---|---|---|
| Railway Corporation (United States, US West region)Where: The region named, and the edge location nearest each visitor | Runs the application servers and the PostgreSQL database, and keeps request logs (up to 90 days) and database backups (up to 30 days). Connections reach the service through the provider’s edge network, which terminates TLS at its location nearest to you, which can be outside the region named. | Everything the service stores: accounts, boards, docs, comments, files’ index, the audit log, and request logs (IP address, account id, path) |
Railway Corporation (Railway Storage Buckets, run on Tigris Data's servers; United States, US West, California), S3-compatible object storage at t3.storageapi.devWhere: The region named | Stores uploaded files, board thumbnails, data-export archives and problem-report screenshots, encrypted at rest by the provider. | Files people upload (which can contain anything, including voice and video in walkthrough recordings), screenshots attached to problem reports |
Resend, Inc. (United States), the email delivery service at smtp.resend.com:465Where: United States | Delivers the service’s email: sign-in links, security notices, invitations, mentions and digests. | Recipients’ email addresses and names, and the message: a board’s title, who invited or mentioned you, an excerpt of a comment (up to 280 characters), links |
| AI model providerWhere: Where that provider runs the model | no AI model provider for the whole service: AI features are off. Team workspaces cannot connect providers of their own on this service. | When AI is on: the prompt and the board content an AI action reads. Freero stores neither |
| Error trackingWhere: Where that service runs | No error-tracking service is used: errors stay in the server’s own logs. | When on: the error, the request’s method and path, and the account id |
| AnalyticsWhere: Google may process it in the United States and elsewhere | Google Analytics (Google LLC), only if you accept analytics cookies | The kind of page you visit (no board or doc ids or titles), the referring domain, browser and device details, an approximate location from your IP address, and the events listed under Cookies |
| Porkbun (domain and DNS)Where: United States | Registrar and DNS host of the service’s domain name. It answers DNS queries and does not carry or store the service’s traffic. | None of the service’s data |
| Porkbun (email forwarding) and Google LLC (Gmail, the operator’s mailbox)Where: Porkbun in the United States; Google in the United States and the other countries where it keeps data | Porkbun receives mail sent to the service’s contact addresses (support, security, privacy) and forwards it to the operator’s Gmail mailbox, where it is kept. | Whatever you write to us: your address, name and message, and any attachment |
| Anthropic, PBC (Claude Code, the AI assistant the operator uses to sort problem reports)Where: Where Anthropic runs its models | Once a day on weekdays, a scheduled Claude Code task reads new Report a problem submissions through the operator API, with a token that reaches nothing but problem reports, to sort them and draft fixes. Issues it files in the public source repository carry no reporter data, board content or screenshots. It runs under Anthropic’s commercial terms, under which Anthropic may not train its models on the content it processes for us. | The note, screenshot and diagnostics of a problem report |
None of these providers receives your boards’ content unless the row says so, and none may use it for its own purposes. The service has no advertising partners and sells no personal data.
Services you choose to connect
These are not our subprocessors: they receive data only when you, or your workspace’s admins, decide to use them, and they handle it under their own terms with you.
- Sign-in providers: Google (“Continue with Google”) and your organization’s identity provider through single sign-on (SAML or OpenID Connect) or SCIM provisioning.
- Connected AI assistants and apps (Claude, ChatGPT and others) over the MCP server or the REST API: they receive what their requests return, within the permissions you granted.
- A workspace’s own AI provider, where this service lets team workspaces connect one (see the AI row above).
- Issue trackers (Jira, Linear, GitHub), webhooks and audit log streams to your SIEM at addresses your admins choose, and Slack link previews.
- Embedded content on a board (videos, design files, documents), which loads from its own site only after someone clicks it, and link previews, for which our server fetches the linked page.
How you hear about changes
- Before a new subprocessor starts processing personal data for the service, we add it here and change the date at the top, at least 30 days ahead except in an emergency (for example replacing a provider that failed).
- Owners of team workspaces are emailed about additions. Organizations under the data processing addendum may object as it describes.
- Every change to this page is public: it is a file in the service’s open-source repository (its history), and rows filled from the server’s configuration change when the configuration does.
- Questions: support@freero.app.