Subprocessors

FlowReader-operated services

These run under our own Firebase and Cloudflare projects. Everything we can pin to the EU is pinned to the EU: all Firebase storage and functions, and the newsletter rate-limiter storage on Cloudflare. What cannot be pinned is Worker execution itself, which runs at whichever edge location is nearest, and the queue that carries Flow work. The rows below say which is which rather than rounding it up.

• Google Firebase: Authentication, Cloud Firestore, Cloud Functions. Receives: account email, synced library data, entitlement records, contact form submissions in transit. Location: europe-west1, Belgium. Google Cloud is a US-headquartered provider; any transfer outside the EEA relies on the provider’s certification under the EU–US Data Privacy Framework, or on Standard Contractual Clauses where it is not certified.
• Cloudflare Workers and Turnstile: newsletter ingestion, subscription handling and server-side Flows, together with the queue that carries Flow work, the Durable Object that rate-limits newsletter aliases, and the Turnstile check that guards this site’s contact and vulnerability report forms. Receives: newsletter content addressed to your alias, subscription events, Flow execution data, and, when you submit a form, the Turnstile token and your IP address. Location: the rate-limiter storage is restricted to the EU; Worker execution and the Flow queue run on Cloudflare’s global network and may process data outside the EEA, relying on Standard Contractual Clauses.

Billing

Involved only if you subscribe to Pro.

• Stripe: subscription checkout, the billing portal, and payment processing for desktop, Chrome and Firefox. Receives: your email address, payment details you enter directly with them, and subscription state. We never receive full card numbers. Location: United States and Ireland; transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses, according to Stripe’s current certification.
• Apple: in-app purchases for the FlowReader mobile app. Receives: transaction data. Apple is the merchant of record for those purchases and acts as its own controller for them. Location: United States.

Email

Involved only if you send us a message.

• Resend: delivery of contact form and vulnerability report emails to our mailboxes. Receives: the name, email address, topic and message you typed into the form. Location: United States; transfers rely on Standard Contractual Clauses.

AI providers

These are chosen by you, run on your own API key, and are not proxied through us, so strictly they are your providers rather than our subprocessors. They are listed because the practical question is the same: where does the text go.

• Anthropic, OpenAI, Google, Hugging Face or OpenCode Go: receives the content you send when you use an AI feature. Location and terms are the provider’s own
• Brave, Perplexity, LangSearch, TinyFish or Tavily: receives the search query when an AI feature or a Flow searches the web. Location and terms are the provider’s own
• A SearXNG instance: receives the same queries, and is wherever you chose to point it
• Ollama or LM Studio: runs on your own machine. Nothing is transmitted anywhere

Integrations you connect yourself

These are your accounts with your own providers. We hold no data on their side and cannot see what is stored there.

• Dropbox: end-to-end encrypted sync files. Dropbox stores a file it cannot read
• Microsoft SharePoint: delegated, strictly read-only access to documents you already have. Tokens never reach a FlowReader server
• A local folder or your own storage: no third party involved at all

Changes to this list

We update this page when a provider is added, removed or replaced, and the date at the top reflects the current version. If you depend on the list staying stable, ask us and we will tell you before a change takes effect.

While this document is in draft, the transfer mechanism named against each provider is our reading of that provider’s current position rather than a confirmed one. Certification under the EU–US Data Privacy Framework is a matter of public record and each row will be checked against it before publication.