Legal
Service providers
Last updated: August 20, 2026
These are every third party that can touch data from Dumpling, what each receives, and where it runs. It's a short list on purpose — most of the app runs on servers we operate ourselves. This page is referenced by our Privacy Policy and kept current as the list changes.
Always involved
These handle data for every account, because the service can't run without them.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| OVHcloud | Hosting — the servers our application and database run on | Everything, as the infrastructure it sits on. OVHcloud does not access it | US (Virginia) |
| Cloudflare | R2 object storage for off-site backups, and DNS | Backups only, encrypted before they leave our server. Cloudflare holds no key | US |
| Purelymail | Sending and receiving email | Your email address and the contents of messages we exchange with you | US |
| Sentry | Crash and error diagnostics | Error reports: stack traces, app version, device and OS type. Both the app and the server are configured to attach no personal information and no account identifier, and never your content | US |
Only if you use the feature
These receive nothing until you turn something on or buy something.
| Provider | Triggered by | What it receives | Where |
|---|---|---|---|
| OpenRouter | Using the AI assistant, auto-connections, or semantic search | Only the categories you enabled in Settings, plus your question. Routed on to a model provider (such as Google or OpenAI). Our account is set to zero-data-retention models only, with prompt logging and model training disabled, so nothing is kept after the answer is returned | US |
| Stripe | Subscribing to Pro | Your card details, directly from you — they never pass through our servers — plus your billing email and subscription record | US |
| Connecting Google Calendar | The OAuth access we requested, used only to read and write the calendar events you asked for. See Google user data | US | |
| Google Firebase | Enabling push notifications on Android | A device push token and the notification we send you | US |
| Apple | Enabling push notifications on iOS or macOS | A device push token and the notification we send you | US |
| Open-Meteo | Turning on the weather widget | The coordinates of the city you typed — requested by our server, not your device, so it never sees your IP address or anything identifying you | EU |
What isn't on this list, and why
- Analytics. Website analytics run on cookieless software we host on our own infrastructure, and in-app usage events stay in our own database. No analytics vendor receives Dumpling data.
- Advertising and marketing platforms. None. We don't run ads, retarget, or feed anything to an ad network.
- Support desk software. None — support is plain email.
- Session replay, heatmaps, A/B tooling. None.
How this list changes
Adding a provider that handles personal data is a change to how we treat your data, so we treat it as one. We'll update this page with the new date, and for any provider that receives your content we'll also tell you in the app before it starts.
Every provider here is bound by a data processing agreement limiting them to processing on our instructions. For transfers out of the EEA or UK we rely on Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified. Ask us at support@getdumpling.app and we'll tell you which applies to a given provider.