1. About this list
Offline Protocol uses the service providers below to operate the Services. Each is bound by a written agreement that requires it to protect personal data and to use it only to provide its service to us. The “Customer Data” column shows whether the provider processes data that Customer Applications send to our hosted services, which makes it a subprocessor under our Data Processing Addendum. The others process only Account Data or website data, for which Offline Protocol is the controller.
2. Infrastructure and hosted services
| Provider | Purpose | Data | Location | Customer Data |
|---|---|---|---|---|
| Railway Corp. | Hosting of the portal, APIs, hosted MCP server, website, databases, caches, and message queues | All data processed by the Services | Singapore (all databases and services); United States (relay servers) | Yes |
| Cloudflare, Inc. | DNS, content delivery, TLS, and DDoS protection; country lookup for telemetry | Request metadata including IP addresses; country code | Global network | Yes |
| Twilio Inc. (SendGrid) | Email delivery: sign-in codes, invitations, usage and billing notices | Email address, message content | United States | Yes (OfflineID sign-in codes) |
| Twilio Inc. (Twilio Verify) | SMS sign-in codes for OfflineID phone sign-in | Phone number, code | United States | Yes |
| Telnyx LLC | SMS delivery | Phone number, message content | United States | Yes |
| PostHog, Inc. | Product analytics: website analytics (with consent) and server-side sign-in and OfflineID events | Pseudonymous user IDs, application IDs, sign-in method, usernames and profile events for OfflineID; website usage | United States | Yes |
| Functional Software, Inc. (Sentry) | Error monitoring for backend services | Error reports and technical context; sending of default personal data is disabled | United States | Yes |
| Hetzner Online GmbH | Object storage for profile pictures and media | Uploaded images and files | European Union | Yes |
| Google LLC (Firebase Cloud Messaging) | Push notifications for relay deliveries, where the app enables push | Device push token, notification details | United States | Yes |
3. Sign-in providers
| Provider | Purpose | Data | Location | Customer Data |
|---|---|---|---|---|
| Google LLC | Sign in with Google for OfflineID, when an app offers it and the person chooses it | Email address and name returned by Google | United States | Yes |
| Horkos, LLC (Privy) | Sign-in through Privy, when an app offers it | Email or wallet identifiers returned by Privy | United States | Yes |
4. Business operations
| Provider | Purpose | Data | Location | Customer Data |
|---|---|---|---|---|
| Stripe, Inc. | Subscription billing, invoices, and card payments | Organization name, billing email, payment details (collected by Stripe) | United States | No |
| Mintlify, Inc. | Documentation hosting and analytics | Page views, search terms, feedback, IP addresses | United States | No |
| Web3Creative (Web3Forms) | Website contact form delivery | What you enter in the form | India, with hosting in the United States and other regions | No |
| Calendly LLC | Scheduling calls booked from the website | Name, email, meeting details | United States | No |
| Google LLC (Google Workspace) | Company email | Correspondence you send us, including privacy and support requests | United States | No |
5. Changes and notifications
We update this page before a new subprocessor starts processing Customer Data. For Customers who have asked to be notified, we also send an email at least 30 days before the change, except in an emergency affecting the security or availability of the Services, in which case we notify as soon as we can. To subscribe, email legal@offlineprotocol.com with the subject “Subprocessor updates”. Customers may object to a new subprocessor as described in the Data Processing Addendum.
The Ethereum Sepolia network is a public blockchain, not a subprocessor. Data written to it is public and permanent (see the privacy policy). Proof of Location transactions are submitted to that network through an Ethereum node access provider; they contain only the data that becomes public on-chain. Offline Protocol chooses the Proof of Location witness operators, which receive a submitted location to check the claim.
Questions about this document, privacy requests, and anything else policy related: email legal@offlineprotocol.com. Security vulnerabilities: security@offlineprotocol.com. All of our legal documents are listed on the legal page.