Sub-processors
Last Updated: September 2026 Version: 1.1
This page lists services and infrastructure that process personal information for Brainstretch. It complements the Privacy Policy and Cookie Policy.
Active Sub-processors
| Provider | Location | Purpose | Data Categories | Safeguards |
|---|---|---|---|---|
| DigitalOcean | European Union and other infrastructure regions | Hosting, database, networking, storage, container registry, and infrastructure operations | Account data, gameplay records, request logs, security logs, support records, and service metadata | Data Processing Agreement, provider security commitments, and EU hosting where configured |
| Postmark | United States | Transactional email for sign-in, account, privacy, security, and service messages | Email address, delivery metadata, and message content needed for transactional email | Data Processing Agreement and Standard Contractual Clauses where needed |
| Sentry | United States and applicable Sentry processing regions | Error tracking, crash diagnostics, and security/reliability investigation | Error events, stack traces, request metadata, device/browser information, affected account identifiers where needed to debug incidents | Data Processing Agreement, Standard Contractual Clauses where needed, access controls, and data minimization |
| Grafana Cloud | United States, European Union, and applicable Grafana processing regions | Metrics, traces, logs, dashboards, alerting, and service reliability observability | Technical telemetry, service logs, trace metadata, performance metrics, request metadata, and operational alerts | Data Processing Agreement, Standard Contractual Clauses where needed, access controls, and retention controls |
Analytics Infrastructure
Brainstretch uses first-party analytics infrastructure such as Umami at https://analytics.joinwith.com to understand public-page and guest-demo usage. This analytics infrastructure is operated for Brainstretch and is intended to be cookieless. It is separate from Google Ads and is not Google Analytics.
Umami analytics may process page URLs, referrers, approximate region or country derived from request data, browser, operating system, device type, visit timestamps, and basic event counts. It is not used for cross-site tracking, third-party advertising, or selling personal information.
Other Recipients and Independent Controllers
Google Ads is not included in the Active Sub-processors table for ordinary website campaign conversion measurement. When a player expressly allows this optional website feature, Google is a recipient and independent controller under the Google Ads Controller-Controller Data Protection Terms.
The purpose is campaign conversion measurement: attributing Confirmed registration and First engaged game completion to Google Ads campaigns and reporting or optimizing campaign performance. Brainstretch explicitly sends the conversion action and an opaque transaction token. The Google tag can additionally receive IP address and network data, date and time, full page URL and referrer, browser, device, operating-system and screen information, consent and tag configuration, ad-click data, Google identifiers, cookie identifiers, and the conversion milestone.
This information may be processed globally. Depending on the transfer, Google states that it may rely on applicable Data Privacy Framework programs, adequacy decisions, and/or Standard Contractual Clauses. See Google’s Ads transfer information and Google’s transparency information for data received from sites and apps.
Google’s Ads Data Processing Terms apply only if a processor service is enabled and brought within their scope. This rollout uses ordinary controller-service conversion measurement; enhanced conversions remain disabled, as do customer-data uploads and other Google Ads processor services. Google is not Brainstretch’s analytics provider for self-hosted Umami.
Planned or Conditional Providers
Brainstretch does not currently sell paid subscriptions, premium packs, paid accounts, or in-app purchases. If paid features launch, Brainstretch may add a payment processor, merchant of record, or app store provider to process billing metadata, receipts, tax information, invoices, and refund requests.
Before paid features are made available, Brainstretch will update this page, the Privacy Policy, and the Refund Policy where needed.
Changes to Sub-processors
Brainstretch may add, replace, or remove sub-processors as the service evolves. We will update this page and the Privacy Policy when material sub-processor changes occur and, where appropriate, notify users before materially new sub-processors process personal information.
Contact
Questions about Brainstretch sub-processors can be sent to privacy@brainstretch.ing.