Sub-processors
Last Updated: 30 April 2026
FORMD ("we," "us") engages third-party service providers ("sub-processors") to operate the platform. This page lists every sub-processor with access to personal data, what they do, what categories of data they receive, and where they process it. Sub-processors are bound by contractual obligations consistent with our Terms of Service, Privacy Policy, and where applicable our Data Processing Agreement (DPA).
We will notify customers of material changes to this list (additions, removals, or changes in data category) at least 30 days before the change takes effect, except where the change is required by law or addresses an immediate security risk. To subscribe to change notifications, email privacy@tryformd.com.
Current sub-processors
| Sub-processor | Purpose | Data category | Region | Compliance |
|---|---|---|---|---|
| Supabase Supabase, Inc. | Database (Postgres), authentication, edge functions, file storage | Account credentials, profile data, fitness data, race results, athlete-coach relationships | United States (us-east-1) | SOC 2 Type II; HIPAA-eligible (FORMD is not currently HIPAA-scoped) |
| Stripe Stripe, Inc. | Payment processing, subscription billing, customer portal | Payment method (card data is tokenized — never touches FORMD servers), billing address, transaction history | United States, European Union | PCI-DSS Level 1; SOC 1 Type II; SOC 2 Type II; GDPR-compliant |
| Resend Resend, Inc. | Transactional email delivery (welcome, billing, trial expiry, athlete invitations) | Email address, email content metadata, delivery / open / click events | United States | SOC 2 Type II; GDPR-compliant |
| Mixpanel Mixpanel, Inc. | Product analytics (funnel, retention, feature usage) | Anonymized user ID, event properties (no PII), device / browser metadata | United States | SOC 2 Type II; GDPR-compliant. Loaded only after the user accepts analytics cookies. |
| Sentry Functional Software, Inc. (Sentry) | Error monitoring and performance tracing | Error stack traces, browser version, pseudonymous user ID (no email, IP, or cookies) | United States | SOC 2 Type II; ISO 27001; GDPR-compliant. Error monitoring runs as a strictly-functional service (no PII, no cookies, no session replay); performance tracing loads only after the user accepts analytics cookies. |
| Intercom Intercom, Inc. | In-app customer support messaging | Email, name, account metadata (subscription tier, trial status), support-message content | United States | SOC 2 Type II; GDPR-compliant. Loaded only after the user accepts support cookies. |
| RevenueCat RevenueCat, Inc. | Mobile subscription lifecycle (iOS App Store entitlements; relevant if a coach also uses the FORMD athlete app) | Anonymized user ID, subscription status, purchase events | United States | SOC 2 Type II; GDPR-compliant |
| OpenAI OpenAI, OpCo, LLC | AI-powered workout generation for athlete training plans | Workout-generation prompt context (anonymized fitness data — no PII) | United States | SOC 2 Type II; EU Standard Contractual Clauses; OpenAI does not train on data submitted via the API per their commercial terms |
| Vercel Vercel, Inc. | Web hosting, CDN, edge runtime | All HTTP request data (URLs, IP addresses, user agent strings) | Global edge network | SOC 2 Type II; GDPR-compliant |
| Expo Expo (Expo Go / EAS, by 650 Industries, Inc.) | Mobile push notification delivery, OTA update distribution | Device push tokens, notification payload metadata, device identifiers | United States (AWS) | SOC 2 Type II; GDPR-compliant; EU Standard Contractual Clauses |
Note on HYRESULT (public race-result data source)
FORMD's Results feature aggregates publicly available HYROX race results sourced from HYRESULT (hyresult.com), a public race-result index. HYRESULT is a public data source, not a sub-processor — see the Privacy Policy §2.8. FORMD reads HYRESULT's public records and does not transmit Customer Personal Data to HYRESULT, so it is intentionally not listed in the sub-processor table above. If you do not want your public race result displayed in FORMD, email privacy@tryformd.com for one-click removal.
Cookie controls
Mixpanel, Intercom, and Sentry performance tracing set cookies and only initialize after you grant consent through the cookie banner. Sentry error monitoring runs from first load as a strictly-functional service — it captures crash diagnostics scrubbed of personal data (no IP, email, or cookies) so we can keep the service working reliably. You can revisit your choices at any time via the "Manage cookie preferences" link in the page footer. See the Cookies section of our Privacy Policy for full disclosure.
Questions or objections
If you object to the use of a particular sub-processor, or if you need a copy of our Data Processing Agreement, please contact privacy@tryformd.com. Material objections may, in some cases, mean we cannot provide the relevant service to you — we will explain the consequences honestly before any action is taken.