Subprocessors
Effective: May 30, 2026
Backtrack uses the third-party service providers below to operate the service. Each provider acts as a "subprocessor" under applicable data-protection law and is contractually bound to handle data only on our instructions.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Authentication, database, file storage | Account info, session metadata, subscription state, lifecycle events | United States |
| Stripe | Payments and subscription management | Billing details, payment method (handled by Stripe, not us), customer ID | United States |
| Klaviyo | Marketing and lifecycle email | Email address, marketing consent state, engagement events | United States |
| Vercel | Web hosting and serverless functions | Logs, IP addresses, request metadata | United States (global edge) |
| Resend | Transactional email (password reset, receipts, contact form) | Email address, message content | United States |
| PostHog (optional) | Anonymized product analytics — only with consent | Anonymized usage events, device type, browser | United States |
What we do NOT share
We do not share video, audio, or images from your camera with any provider. Pose detection runs entirely in your browser. The only data we transmit is the aggregate session metadata described in our Privacy Policy.
Changes
We'll update this page when we add or remove a subprocessor. For material changes affecting EEA or California users we'll provide advance notice.
Contact
Questions: privacy@back-track.app.