Subprocessors

Every company that handles your data on our behalf, and what for.

Updated 2026-10-05

Fly.io (Frankfurt, Germany)

Runs the server. Sees every request the app makes and the logs it writes; the logs carry no names, addresses or trip contents.

Neon (Frankfurt, Germany)

Hosts the Postgres database that holds everything the privacy policy lists, in AWS eu-central-1.

Google

Sign in with Google, when you choose it. Google confirms who you are and hands over the identifier, email address and name the privacy policy lists; no Google service sees your trips, and ndemo's server sends Google nothing about you. On the web, the sign-in page loads Google's button from Google, so your browser contacts Google when that page opens. To check a sign-in, the server fetches Google's public signing keys; that request carries nothing about you.

Apple

Sign in with Apple, which is how an account exists; push notifications (APNs), which is how a phone learns that a trip changed; and Maps, which draws the map and answers a pin's address on the phone itself, not through our server.

frankfurter.dev

The European Central Bank's exchange rates, so a trip in another currency reads in yours. The phone fetches them once a day. The web asks ndemo's own server instead, and the server asks frankfurter.dev: your browser never contacts frankfurter.dev, and the server forwards no reader's address, headers or cookies. The request carries the list of currency codes it covers and nothing else.

Brevo (France)

Sends every letter this server writes — invitations, sign-in codes and the preview list's confirmations — from fra@getndemo.com. Brevo sees the address a letter goes to and what the letter says: for an invitation the inviter's name and the trip's name, for a sign-in the code, for the preview list the two links. Nothing else; the letter is plain text with no tracking.