Sub-processors
The service providers involved in running Leaves, the data they handle, and the third-party services your browser contacts.
This document is a draft pending legal review and approval. The provider details and service descriptions have been updated for the public beta. The status and version above show the current review state.
01 What this list is §
A sub-processor is a company that holds or handles personal data on our behalf so that Leaves can run. Every one of them is below, with what it handles and where it is.
Cloudflare hosts the public site and application. The API runs on a server operated by Leaves. Plausible analytics and the monitoring service are self-hosted; their software vendors do not receive data merely because Leaves runs their software.
Under that list is a second one, of parties nobody sends anything to but whose servers your browser reaches because a page asked it to. They are not sub-processors and calling them that would be wrong. Leaving them out would be worse: from where you are sitting, a third party learning your address is a third party learning your address.
02 Sub-processors §
Cloudflare, Inc.
- Handles
- Hosts the public website and application, provides DNS and configured proxy services, and receives visitor IP addresses and request metadata. Cloudflare R2 is supported for private uploaded media; when configured, it stores those files.
- Where
- Cloudflare, Inc. is based in the United States and serves traffic through its global network. Applicable processing locations and transfer arrangements need confirmation in the legal review.
- Since
- 2026-09-10
Stripe
- Handles
- Your name, your email address, the amount, the term and the payment method you pick, together with the identifiers it returns to us. Card and bank details are entered on Stripe’s own page and never touch our systems.
- Where
- The Stripe contracting entity, processing locations and transfer arrangements must be confirmed in the legal review.
- Since
- Start date awaiting confirmation
Mailtrap
- Handles
- Recipient addresses and messages such as registration confirmations, invitations, email-change confirmations, password resets and subscribed email updates. Mailtrap delivers these messages for Leaves.
- Where
- The applicable Mailtrap contracting entity, processing locations and transfer arrangements must be confirmed in the legal review.
- Since
- Start date awaiting confirmation
Komoot GmbH
- Handles
- The words you type into a place field when you use address lookup. Leaves makes the request from its API server, so Photon receives the lookup text and that server’s IP address.
- Where
- Germany.
- Since
- 2026-06-01
03 Third parties your browser reaches §
Neither of these is sent anything by us. Both are contacted directly by your own browser because a page references a file on their servers, which is enough for them to see the address you are reading from.
Google Ireland Limited — Google Fonts
- Sees
- Your address and browser when the application loads its typefaces. The public website serves its fonts directly from Leaves.
- Where
- Ireland, from servers worldwide.
- Why it is here
- The application still links to Google Fonts. The public website hosts its own font files and makes no font requests to Google. Self-hosting the application fonts remains outstanding.
OpenStreetMap Foundation
- Sees
- Your address, and which map squares were requested — which is to say, roughly which place you are looking at.
- Where
- United Kingdom and the European Union.
- Why it is here
- Map tiles, and only on a screen showing a place that has coordinates. No map, no request.
04 Analytics, diagnostics and your research §
How measurement and diagnostics differ from using your research for advertising or training.
- Analytics
- Plausible Analytics records page views, referrers, countries, public calls-to-action and application events such as imports, invitations and exports. Plausible does not record form values, record contents, heatmaps or recordings. It sets no cookies and creates no persistent identifiers.
- Error tracking
- Sentry-compatible browser and server error reporting is configured for the Leaves monitoring service. Events are sanitized to remove user context, request bodies, headers and query strings. Where enabled and supported, sampled browser replays mask text and inputs and block media.
- Advertising
- None, anywhere, in any form. No pixels, no remarketing, and nothing sold or shared for it.
- Model training
- Your research is not used to train any model, ours or anybody else's, and it is not handed to anyone who might.
05 How this list changes §
A new sub-processor appears here before it starts processing anything, with the date it starts. Where the change is material — a new place your research is stored, a new party that can see it — account holders are told by email as well as on this page.
The date at the top is the date this list last changed.