Sub-processors
Updated 2026-10-18
Sortly uses the third-party services listed below to deliver the product. We update this page within 30 days of any change. The same list is checked against our internal infrastructure register on every change; if you spot a discrepancy, please email privacy@getsortly.app.
Scroll across the table to see all details.
| Provider | Service | Data shared | Country of processing |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Account, household, children, friends, free time, playdates, photos, push tokens | United Kingdom (London, eu-west-2) |
| Vercel | Website hosting | Request metadata; waitlist email address and mail sent to our addresses, in transit | United Kingdom (London, lhr1); static files are served from Vercel's global edge |
| Namecheap DNS | DNS for getsortly.app | DNS queries for getsortly.app; no Sortly user data | Global (Namecheap-managed) |
| Twilio Verify | SMS sign-in codes | Phone number; one-time code | USA |
| Apple APNs | iOS push notifications | Push token; minimal notification payload | USA (Apple-managed) |
| Apple Maps Server API | Travel estimates between a child's playdates on the same day | Playdate venue addresses (street, town and postcode, which can be a friend's home), meeting places that include a full postcode, and coordinates derived from them; no names, children's details or account identifiers | USA (Apple-managed) |
| Resend | Verification codes, data-export links, playdate and friend-request updates for parents whose notifications are off, and the website waitlist; receives and stores inbound mail for hello@, privacy@ and safety@ (including safety reports sent from the app), which is forwarded to an Igloo Labs support mailbox (also on Resend) | Email address; message content (for playdate and friend-request updates: the other family's first names and last initials, the recipient's child's first name, and the playdate's day, time and place, never an address or a note between parents); sender details of inbound mail; for the waitlist, a consent record (page used, wording version, request and confirmation times) | Sending region Ireland (eu-west-1); account data, metadata, logs and primary processing in the USA (SCCs / EU-US DPF) |
| Sentry | Crash reports from the iOS app and error reports from our servers | App version, the type of error and where in the code it happened; server errors with email addresses, phone numbers and quoted values removed; no IP addresses stored | EU (Frankfurt, Germany) |
| GitHub | Source control and code review (no customer data) | Engineering source code only; no end-user data | USA |
| Doppler | Team secret store (no customer data) | Internal team credentials only; no end-user data | United States |
| GIAS (gov.uk) | UK schools reference data feed | One-way pull from gov.uk; no Sortly user data shared with GIAS | United Kingdom |
Calendar services you connect yourself (Apple, Google, Microsoft) aren't our sub-processors. The app sends your playdates to your own account at your request, and that provider handles them under your agreement with them.
How we vet sub-processors
We choose providers that (a) offer EU or UK data residency where possible, (b) have a published GDPR sub-processor agreement we can rely on, and (c) we can replace without re-architecting. New sub-processors require an internal review and an entry in the relevant ADR before we send them any user data.