Sub-processors

Last updated 8 October 2026

CRITIXFIT LIMITED (Hong Kong, company no. 81235804) uses the companies below to run CritixFit. Each one handles personal data for us under a data processing agreement or the provider's standard data processing terms, and only to provide the service named here. We do not sell your data.

Providers that run the service

  • Supabase

    What it does for CritixFit
    Database, sign-in and file storage
    Data it handles
    Your account, profile and training data
    Where
    EU (Ireland)
    Safeguard
    Stays in the EU

  • Google Cloud (Google LLC)

    What it does for CritixFit
    Server hosting
    Data it handles
    All app data passes through our servers
    Where
    EU (Netherlands)
    Safeguard
    Google Cloud data processing terms

  • Google Cloud, Vertex AI

    What it does for CritixFit
    Runs the AI coaches: chat, plans, photo and voice features, live voice calls and coach voices
    Data it handles
    Training context without your name or email, the messages and photos you send a coach, your voice during a live call
    Where
    EU, US and Asia (Asia only as a back-up when other regions are busy)
    Safeguard
    Google data processing terms and EU Standard Contractual Clauses

  • Microsoft Azure (Speech)

    What it does for CritixFit
    Checks the quality of Hebrew coach voices
    Data it handles
    The coach reply as audio. No account details
    Where
    EU (West Europe)
    Safeguard
    Microsoft data processing terms and Standard Contractual Clauses

  • Cloudflare

    What it does for CritixFit
    Delivers the website and app, DNS and security
    Data it handles
    IP address and request details
    Where
    Worldwide network
    Safeguard
    Cloudflare data processing terms and Standard Contractual Clauses

  • Stripe

    What it does for CritixFit
    Card payments on the web
    Data it handles
    Email, billing details, payment method (held by Stripe)
    Where
    US and other countries
    Safeguard
    Standard Contractual Clauses

  • Resend

    What it does for CritixFit
    Sends emails such as sign-in and invites
    Data it handles
    Your email address and the message
    Where
    US
    Safeguard
    Standard Contractual Clauses

  • Google Workspace (Google LLC)

    What it does for CritixFit
    Receives the emails you send to us
    Data it handles
    Your email address and your message
    Where
    US and other countries
    Safeguard
    Google Workspace data processing terms

  • Firebase Cloud Messaging (Google LLC)

    What it does for CritixFit
    Push notifications
    Data it handles
    A device token and the notification text
    Where
    US
    Safeguard
    Standard Contractual Clauses

Maps, weather and routes

  • Mapbox

    What it does for CritixFit
    Draws maps of your workouts and routes
    Data it handles
    IP address and the map area your screen shows
    Where
    US
    Safeguard
    Standard Contractual Clauses

  • OpenStreetMap services and OpenRouteService

    What it does for CritixFit
    Route planner: place search and route lines
    Data it handles
    The place you search for and the points of the route
    Where
    Europe
    Safeguard
    No account data is sent

  • Open-Meteo

    What it does for CritixFit
    Weather for your workouts
    Data it handles
    A city name or coordinates
    Where
    Europe
    Safeguard
    No account data is sent

Analytics and error reports

  • PostHog

    What it does for CritixFit
    Product analytics, and screen recordings with all text, charts and maps hidden on health screens. In the EU and UK only with your consent
    Data it handles
    Pseudonymous usage events
    Where
    EU
    Safeguard
    Stays in the EU

  • Sentry

    What it does for CritixFit
    Error reports, so we can fix problems
    Data it handles
    Error details, device and browser type, with personal details removed
    Where
    EU (Germany)
    Safeguard
    Stays in the EU

Services you choose to connect

When you connect one of these, it sends us the data you allow (such as workouts, sleep and heart rate), and we keep a secure sign-in token for it (Spotify is the exception: your browser talks to Spotify directly). You can disconnect at any time in Settings. Each service has its own privacy policy.

  • Strava, Polar, Wahoo, Suunto

    What it is for
    Workouts from your watch or bike computer
    Data we receive
    Workouts, routes, heart rate and, where offered, sleep and recovery

  • Garmin, through WeFitter (Netherlands)

    What it is for
    Workouts, sleep and recovery from your Garmin watch
    Data we receive
    Workouts, sleep, heart rate and HRV

  • Google Health

    What it is for
    Activity and health data from your Google account
    Data we receive
    Activity, sleep and heart rate, read only

  • Apple Health

    What it is for
    Workouts and sleep from your iPhone
    Data we receive
    Only what you allow

  • Spotify

    What it is for
    Music controls while you train
    Data we receive
    Nothing is stored on our servers

App stores: if you buy through the App Store or Google Play, Apple or Google handles the payment and tells us only that you subscribed.

Changes

When we add a provider or move data to a new region, we update this page. Questions: [email protected].