Subprocessors
The third parties that handle data on our behalf, what each one does, and where.
Last updated 29 July 2026
Draft. This document has not yet been reviewed by a lawyer and should not be relied on. It describes how the site currently works and will be finalised before launch.
In use today
| Provider | What it does | Data | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account details, gameplay records, guesses, ratings | United States |
| Vercel | Website hosting, content delivery, and cookieless audience measurement | Request logs, IP address, approximate country; page views and load speed, with nothing stored on your device | United States, with global edge locations |
| Sign-in with Google | Email address, name and profile picture, at sign-in | United States |
Contracted but not yet in use
These are set up but process nothing at present. We will move them to the list above, and update the date on this page, before they start.
| Provider | What it does | Data | Where |
|---|---|---|---|
| Resend | Streak reminder and account emails | Email address | United States |
| Google (AdSense and Privacy & messaging) | One advertisement on the result screen, and the consent banner | IP address, advertising cookies and identifiers, your consent choice | United States |
Transfers
All of these providers process data in the United States, so using Exprand involves transferring your data outside the UK and EEA. Those transfers are covered by Standard Contractual Clauses, and we hold a data processing agreement with each provider.
Changes
We update this page when a service is added or removed, not at audit time. If you want to be told when it changes, email privacy@exprand.com.
What we collect and why is set out in our privacy policy.