Subprocessors
Last updated July 18, 2026
Ask AI to explain
Get a quick, plain-language summary of this page without all the jargon.
Tockly is operated by Iluvatar LLC. To run the product we rely on the third parties below, each of which processes some customer data on our behalf. This list is the companion to our privacy policy, which describes what we collect in the first place.
Tockly records screenshots and per-minute activity, so “where does this data actually go” deserves a real answer rather than a sentence buried in a policy. Each entry says what the vendor does and what it can see, because those differ a great deal: analytics events and screenshots of your screen are not the same disclosure.
Current subprocessors
- Supabase (Supabase Pte. Ltd.): Database, private object storage, and authentication. Processed in United States (Oregon). Can see: Account data, per-minute activity, screenshots, agent events, billing records.
- Vercel (Vercel Inc.): Website, dashboard, and ingest API hosting. Processed in United States. Can see: All data in transit, plus request metadata such as IP address.
- Cloudflare (Cloudflare, Inc.): Storage and delivery of desktop app downloads and updates. Processed in United States. Can see: IP address and request metadata when downloading or updating the app.
- Google (Google LLC): Sign-in, only if you choose to sign in with Google. Processed in United States. Can see: Your Google account identity (email address and account identifier).
- Stripe (Stripe, LLC): Payment processing and subscription billing. Processed in United States. Can see: Billing contact details and payment method (card details go to Stripe, never to us).
- Resend (Plus Five Five, Inc.): Transactional email, including sign-in and account email. Processed in United States. Can see: Email address and the contents of the messages we send you.
- Mixpanel (Mixpanel, Inc.): Product analytics, including session replay of our own web dashboard. Processed in United States. Can see: User ID, email address, and product usage events.
- Sentry (Functional Software, Inc. d/b/a Sentry): Error and performance reporting. Processed in United States. Can see: User ID, email address, and diagnostic data attached to errors.
- Better Stack (Better Stack, Inc.): Uptime monitoring and application log storage. Processed in United States. Can see: Application and request logs, which can include user IDs and IP addresses.
Some of these vendors contract through a regional entity depending on where a customer is located. The entities above are the ones that contract with us.
Services that are not subprocessors
We use these too, and they are left off the list above on purpose rather than by oversight: none of them process customer data.
- Apple and Microsoft Azure: Code signing and notarization of the desktop apps. They sign our software; they receive no customer data.
- GitHub: Source code hosting and build automation. Our code, not your data.
- Porkbun: Domain registration for tockly.app. No access to product data.
Changes to this list
When we add or replace a subprocessor, we update this page and its date, and we notify account holders by email before the change takes effect so that customers acting as data controllers have the opportunity to object. If you want to be told about changes directly, email hello@tockly.app and we will add you to the notice list.
Iluvatar LLC · hello@tockly.app