Subprocessors — subprocessors guide, subprocessors explained, subprocessors tutorial

About this list

This page lists infrastructure providers and mobile services used for the features described here, their purpose and the data involved. Store operators also process purchase and payment data under their own policies.

This page describes what each subprocessor is used for and what data reaches it. For what we collect and why, see our Privacy page; for how long we keep it, see Retention; for the technical measures we actually have in place, see Security.

Privacy · Retention · Security · Data processing agreement · Cookies

Current subprocessors

Subprocessor	Purpose	Data processed	Location / notes
OVH	Infrastructure hosting. Our server and database run here.	Everything we store on the server: account data, analytics hits (including the stored IP address), session recordings, reviews, SEO history and support tickets.	Hosted in the EU. Backups are taken daily and stay on the same server, so no third-party backup or storage provider is involved.
Cloudflare	DNS, CDN, TLS termination and WAF. All traffic to astrina.io passes through Cloudflare.	Request metadata and IP addresses. We also read visitor country from Cloudflare's CF-IPCountry request header.	TLS is configured in Full (strict) mode, with a Let's Encrypt certificate on our origin server.
Payora	Payment processing for website balance top-ups, service invoices and approved cryptocurrency reward payouts.	Website top-ups and service invoices involve the payment data needed to complete them. For approved reward payouts, Payora receives the selected asset, destination wallet address, payout amount, any destination tag or memo, and payout references.	Website plans can be paid from your account balance. Payora handles website balance top-ups, service invoices and approved reward payouts; mobile store purchases are described below.
Have I Been Pwned (Pwned Passwords)	Checking a password against known public breaches.	Only the first 5 characters of a SHA-1 hash of the password. No personal data.	Uses k-anonymity: the password itself never leaves the browser or our server, and neither does any personal data. See the section below.
System speech recognition	Convert speech to text when you choose dictation.	Microphone audio and recognition results may be handled by the system provider, such as Apple on iOS. Remote processing depends on the device and service used.	You can refuse microphone or speech permission and type instead. The system provider's privacy information applies to its processing.

Mobile notification and purchase services

Apple Push Notification service (APNs): delivers iOS notifications using a push device token and notification content, including any links or other message data.
Google Firebase Cloud Messaging (FCM): delivers Android notifications using a Firebase installation identifier or a legacy registration token and notification content. Firebase Analytics is not enabled in this app configuration.
Expo Push Service: acts as an intermediary for existing Expo push registrations and receives the Expo push token and notification content.
Apple App Store and Google Play: handle purchases and subscriptions on their platforms. Astrina exchanges purchase and transaction identifiers, receipts or purchase tokens, product identifiers and purchase status with the relevant store to validate purchases and process renewals, restoration and refunds.

More on the Pwned Passwords check

This one deserves a plain explanation, because "we send your password to a third party" would be the wrong conclusion. We do not. The password is hashed with SHA-1 and only the first 5 characters of that hash are sent. This is the k-anonymity model. The password itself, and any personal data, never leave the browser or our server.

Public data sources we pull from

Our catalog also draws on public data sources. These are a one-way pull: we read from them, and they receive no personal data from us. They are listed here for transparency rather than because they process anything on our behalf.

Source	Purpose	Data processed	Location / notes
CoinGecko	Public catalog data.	None. We pull data from them; they receive no personal data from us.	One-way pull.
SteamSpy	Public catalog data.	None. We pull data from them; they receive no personal data from us.	One-way pull.
Open Food Facts	Public catalog data.	None. We pull data from them; they receive no personal data from us.	One-way pull.
IMDb datasets	Public catalog data.	None. We pull data from them; they receive no personal data from us.	One-way pull.

There is no email subprocessor

Outbound email from Astrina.io — verification links and password resets — is sent from our own Exim mail server as noreply@astrina.io, with DKIM configured. We do not use a third-party email provider, so no email delivery company receives your address from us.

Changes to this list

When the services described here change, we update this page and its last-updated date. Contact support@astrina.io with questions about a provider or a feature not described here.

If you want to be told when this list changes, email support@astrina.io and we will notify you.

Questions

For anything about this list — including objections to a subprocessor, privacy requests and data deletion requests — write to support@astrina.io. That is our only contact address.