for usc students
subprocessors
every third party lecturemates sends data to, and exactly what each one receives. this list was compiled by reading the code that makes the calls, so a provider we no longer use disappears from it and one we add has to be written down.
| provider | purpose | data it receives | region | policy |
|---|---|---|---|---|
| Fly.io | Runs the API, and stores uploaded images on an attached volume. | Everything the API handles in memory while serving a request, plus uploaded avatars, chat images and event photos at rest. Request logs deliberately carry no client IP address. | United States (San Jose) | fly.io privacy |
| Neon | Managed Postgres — the primary database. | Everything the product stores: accounts, the .edu address, profiles, enrollments, messages, board posts, DMs, events, moderation records, analytics counts. | United States (AWS us-west-2, per our deployment notes) | neon privacy |
| Cloudflare | Serves this marketing site and the web app, terminates TLS, and reverse-proxies API requests to the origin. | Request metadata at the edge, including your IP address, and the full body of any request passing through to the API. Workers request logging is enabled. | Global edge network | cloudflare privacy |
| Apple | Push notification delivery (APNs) and Live Activities; App Store and TestFlight distribution; Maps in the iOS app. | A device push token and the notification payload. Most pushes carry no text at all — the device fetches the content itself over an authenticated channel — and a DM push is pinned to the literal words "New message", with no sender and no content. Some pushes do carry server-composed text: a class reminder (course code and time), a milestone count, and the daily campus digest sentence. Live Activities send course code and start/end time. Maps queries go from the device to Apple directly. | Global | apple privacy |
| SMTP2GO | Sends the one-time sign-in code by email. | Your .edu email address and the six-digit code, in a plain-text message. Nothing else — no name, no profile data, no other identifiers. | United States (sending region) | smtp2go privacy |
| OpenAI | Scans every uploaded image before it is stored. | The image itself, sent to the moderation endpoint (model omni-moderation-latest). No account id, no filename, no other context. Only a pass/fail verdict comes back. | United States | openai privacy |
| OpenRouter | Generates the greek board tag strip, the daily campus digest sentence, and trending-post summaries. | Recent anonymous board post bodies, each passed through a redaction step first that removes emails, phone numbers, @handles and name-shaped word sequences, plus the public list of greek organisations. No account id, no name, no email. Requests are routed to the configured model (currently a GLM model on OpenRouter’s free tier). | United States; routed to the configured model — currently nvidia/nemotron-3.5-lightning (NVIDIA, via OpenRouter). The model can change; this page is updated when it does. | openrouter privacy |
what is not on this list
- no analytics or crash-reporting sdk, anywhere. the iOS app ships no Sentry, Firebase, Crashlytics, Amplitude, Mixpanel or PostHog, and neither does the web app or the API. product analytics are our own, stored in our own database, with no user id column and a 90-day life.
- no advertising or ad-tech of any kind, and no data broker.
- no payment processor — the service is free and takes no payments.
- no sms provider and no captcha service. the only message we send you is the sign-in email.
- no separate object store yet. uploaded images live on the API host's own disk, reachable only through an authenticated route, not through a public file server. if that moves to a dedicated store, this page gains a row.
- the university's public schedule of classes is a source we read, not a place your data goes. the catalog crawler sends no student data — it fetches public course listings with an identified user agent.
changes
adding a subprocessor means adding a row here. if you want to know what any of them receives in more detail, the privacy policy describes each flow in context.
contact
TODO — contact address not yet published. a monitored mailbox will be named here before signup opens.