Sub-processors

• Amazon Web Services (United States): application hosting, databases, queues, object storage, logs, and content delivery.
• Clerk (United States): authentication, connected identities, and account sessions.
• OpenRouter (United States): routing to AI model providers for character generation and application processing; zero-data-retention routing is required for user content.
• AI model providers accessed through OpenRouter include OpenAI, Anthropic, Google, xAI, DeepSeek, Moonshot AI (Kimi), Alibaba (Qwen), Z.ai, MiniMax, and Mistral. They process selected content for AI replies, content safety, interests, memories, and profile summaries after the user's separate AI processing permission.
• PostHog (United States): anonymous, content-free product analytics with autocapture and session recording disabled.
• Sentry (United States): error and performance monitoring with default personal-data collection disabled.
• Expo (United States): mobile builds, over-the-air updates, and push-notification routing.
• LiveKit Cloud (United States): live floor audio transport; floor audio is not recorded by RUB.
• Apple and Google: app distribution, platform push delivery, and connected sign-in when selected by the user.

We review providers before use and require them to process data only for contracted services. We update this list when a provider with access to personal data is added or replaced. DPA customers may request change notices and transfer documentation at hello@beardata.co.