Sub-processors
1. Current sub-processors
These providers process personal data on cometpost's behalf. This list covers what is running today.
| Provider | What it does for cometpost | Data it receives | Used in |
|---|---|---|---|
| Railway | Hosting of the cometpost application (dashboard, API, MCP server, background worker), its PostgreSQL database, and the scheduling engine (self-hosted Temporal). Configured in Railway's sfo region. | Everything the application stores: your account email, name and profile picture from Google; your workspace, posts, captions and delivery history; encrypted platform tokens; hashed API keys; sign-up and product-step records. Request and application logs, which can include IP addresses. | Application |
| Cloudflare | Object storage for the media you upload (R2), DNS for cometpost.app, and hosting of this website (cometpost.app). | Media files you upload, and their storage keys. DNS queries. For this website, standard request data including IP address. | Application and website |
| Stripe | Payment processing and subscriptions, for paid plans. | You enter payment details directly on Stripe's pages. cometpost sends Stripe your workspace name, your email address and your workspace identifier. We keep Stripe's customer and subscription identifiers, your plan and your subscription status. | Application |
| Resend | Sending operational email: a connected account needs reconnecting, a delivery failed, a media-retention warning, an account-deletion receipt. | Your email address and the email's subject and text, which can include a platform name, an account handle and the error the platform returned. | Application |
| Sign-in with Google. | You authenticate with Google. We receive your email address, name and profile picture. Google handles that sign-in under its own privacy policy. | Application | |
| Sentry | Error monitoring: reports of unexpected errors in the application so we can fix them. | The error message and stack trace, the service name and release. Tokens, authorization headers, request bodies and post content are filtered by pattern before an error is sent, and Sentry is set not to store IP addresses. Hosted in Sentry's US region. | Application |
| Umami Cloud | Cookieless visit counts for this website. | Page views, the referring site and campaign tags. We ask Umami to respect Do Not Track. It is not used inside the application. | Website only |
If another vendor that receives personal data is added, it will be listed here before it is turned on.
2. Not sub-processors
- The social platforms you connect (Meta for Threads, Instagram and Facebook Pages; Google for YouTube; TikTok; X when it launches). They receive the posts you scheduled for them, as the point of the service, and handle them under their own policies. See the privacy policy.
- The scheduling engine is self-hosted by cometpost on Railway. It is not a separate vendor.
3. Changes and requests
The privacy policy says how we tell you about material changes. For a data processing agreement, email privacy@cometpost.app with “DPA request” in the subject line. For anything else about this list, write to privacy@cometpost.app.