Subprocessors and service providers for Something
This page lists the companies that process personal data for BAARS DESIGN to run Something. It is the subprocessor list the Privacy Policy and Annex 3 of the Data Processing Agreement refer to.
Changes. We update this page before we add or replace a subprocessor. Customers with a signed DPA get an email at least 30 days before the change and may object as the DPA describes. Anyone can ask to be told about changes by emailing privacy@changesomething.app with the subject “Subprocessor updates”.
Transfer mechanisms are as each provider states them on its own pages, read on 2026-10-30.
Our own server
The billing and account service, its database and its backups run on a server that BAARS DESIGN owns and operates in Norway. It is not a subprocessor. It holds accounts, organisations, seats, subscriptions, devices, the audit log, contact-form messages and the waitlist. Nightly database backups are kept on the same server for 30 days.
In use
| Provider | Purpose | Data | Location | Transfer mechanism | Links |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Runs DNS for baars.design and stores the images (img.baars.design) of the apps.baars.design page, the website’s earlier address |
Visitor IP address and browser details, when that page loads its images | United States company; served from Cloudflare’s global network | Cloudflare states it complies with the EU-U.S. DPF; its DPA (version 6.4, effective 2026-04-03) applies the EU SCCs (2021/914) if that lapses | DPA · Privacy |
| Vercel Inc. | Hosts the website’s earlier address, apps.baars.design/something | Visitor IP addresses and request details in access logs. The website sets no cookies; form submissions go to our server, not to Vercel. | United States company; served from Vercel’s global network | Vercel DPA (updated 2026-03-17, effective 2026-03-31): EU SCCs (2021/914) | DPA · Privacy |
| Mapbox, Inc. | Serves a style sheet that the apps.baars.design page around the website’s earlier address loads | Visitor IP address and browser details, when the page is opened | United States | Mapbox is not engaged to process data for Something; it receives the request directly from the visitor’s browser | Privacy |
| Oracle Corporation (Oracle Cloud Infrastructure) | Hosts BAARS DESIGN’s own mail server (mail.baars.design), used for support email and for email we send. The same server serves the website at changesomething.app and passes all traffic between the internet and our own server on to it (api.changesomething.app), over an encrypted connection |
Email addresses, names and the content of email sent to or from us. For the website and the API: visitor IP addresses and request details in access logs, and everything sent to our server (sign-in and plan requests, contact-form and waitlist submissions), which it decrypts to pass on | Amsterdam, Netherlands. Oracle is a US company. | Oracle’s Data Processing Agreement for Oracle Services (SCCs) | Privacy · Contracts · DPA |
| GitHub, Inc. | Hosts the public release feed and installers (github.com/the-baaron/something-releases) that installed copies fetch when they look for updates |
IP address and user-agent of the Mac looking for updates. No account data. | United States | GitHub states it complies with the EU-U.S. DPF, UK Extension and Swiss-U.S. DPF, and relies on SCCs (2021/914) otherwise | Privacy Statement · DPA · GitHub’s subprocessors |
When sign-in and payments are switched on
Sign-in and payments are not switched on yet. These providers process data from the day they are.
| Provider | Purpose | Data | Location | Transfer mechanism | Links |
|---|---|---|---|---|---|
| Supabase Pte. Ltd (when accounts are enabled) | Account sign-in (Supabase Auth): Google, Apple and email-code sign-in, user records, session tokens | Email, name, sign-in provider id, sign-in IP and times, hashed tokens | Project data hosted on AWS in Stockholm, Sweden (eu-north-1). Supabase Pte. Ltd is in Singapore. Supabase’s own subprocessors are on its list. |
Supabase DPA v1 (2026-08-01): EU SCCs (2021/914) with UK and Swiss addenda | DPA · Privacy · Subprocessor list |
| Stripe Payments Europe, Limited (Ireland), with Stripe, LLC (US) and affiliates (when payments are enabled) | Payments, subscriptions, invoices, tax calculation (Stripe Tax), the customer billing portal | Billing name, address, email, VAT number, card details (entered on Stripe’s pages; we never receive the full number), payment history | Ireland; data is also processed in the US | Stripe DPA (2026-09-28) with Data Transfers Addendum: EU SCCs (2021/914). Stripe, LLC states it is certified under the EU-U.S. DPF, Swiss-U.S. DPF and UK Extension. Stripe is our processor for our services and an independent controller for fraud prevention and compliance. | DPA · Privacy Policy · Privacy Center |
| Google LLC | Sign-in provider, if you choose “Sign in with Google” | Google sends us your email, name, profile picture and a user id (openid, email, profile scopes). Google learns that you signed in to Something. |
United States | Google is an independent controller for the sign-in, not our processor. Google LLC states it is certified under the EU-U.S. DPF, UK Extension and Swiss-U.S. DPF. | Privacy · Frameworks |
| Apple Distribution International Limited (Ireland) | Sign-in provider, if you choose “Sign in with Apple” | Apple sends us a unique identifier, the name you choose to share, and your email or a Hide My Email relay address | Ireland; Apple Inc. in the US | Apple is an independent controller for the sign-in. Apple’s Privacy Policy says EEA transfers are covered by SCCs. | Privacy Policy · Sign in with Apple & Privacy |
Enterprise only, by agreement
| Provider | Purpose | Data | Location | Transfer mechanism | Links |
|---|---|---|---|---|---|
| WorkOS, Inc. | Single sign-on (SAML, OIDC) and directory sync (SCIM) for an Enterprise organisation that asks for it | Employee identifiers, emails, names and group membership sent by the customer’s identity provider | United States | WorkOS DPA (SCCs). Added per customer, with that customer’s agreement. Not in use today. | DPA |
Not subprocessors
These services receive data from your Mac because you chose them. BAARS DESIGN does not engage them and is not the controller for that data.
| Service | Why it is listed | Links |
|---|---|---|
| Anthropic (Claude Code CLI, Anthropic API) | Your own AI engine; prompts and code go from your Mac to Anthropic under your own account | Privacy |
| OpenAI (Codex CLI, OpenAI API) | The same, for OpenAI | Privacy |
| Google (Gemini CLI, Gemini API) | The same, for Google | Gemini API terms |
| GitHub (your account and repositories) | Repositories, branches and pull requests are yours; the app uses your own GitHub token and GitHub CLI. Our only relationship with GitHub here is the release feed above and the Something GitHub App registration. | Privacy Statement |
Change log
| Date | Change |
|---|---|
| 2026-10-30 | First published version. |