Subprocessors
Updated August 28, 2026
Hardroad uses the third-party providers below to operate the service. Each one is bound by a written agreement requiring appropriate security and confidentiality, and each processes personal data only on our instructions and only for the purpose listed. This page is referenced by our Data Processing Addendum.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Application hosting, database, file storage, logging | All account and service data | United States |
| Twilio SendGrid, Inc. | Transactional and notification email delivery | Name, email address, message contents | United States |
| Stripe, Inc. | Subscription billing and payment processing | Name, email address, billing details. Card numbers go to Stripe directly and are never stored by Hardroad. | United States |
| Cloudflare, Inc. | Web application delivery, CDN, and bot protection (Turnstile) | IP address, request metadata | Global edge network |
| Apple Inc. | Push notifications to iOS devices (APNs), and Sign in with Apple | Device token, notification contents, Apple account identifier | United States |
| Anthropic PBC | AI assistant features | The task, project, goal, habit and planner content you send to the assistant | United States |
| OpenAI, L.P. | AI assistant features (fallback provider) | The task, project, goal, habit and planner content you send to the assistant | United States |
| ElevenLabs Inc. | Speech synthesis for audio features | The text to be spoken | United States |
Google user data is not sent to any of these
Data obtained through Google APIs — your calendar events and your contacts — is held only in Hardroad's own database on Google Cloud Platform. It is not sent to our AI providers, our email provider, or any other provider on this list. Hardroad's AI features operate on tasks, projects, goals, habits and planner entries only. See the Privacy Policy for the full Google user data disclosure.
Services you connect yourself
Optional integrations — Google Calendar, Google Contacts, Microsoft Outlook Calendar, Garmin, and similar — are not subprocessors. They are services you already have an account with, which you choose to connect. Hardroad reads from and writes to them on your behalf, under the permissions you grant, and you can disconnect at any time. See Data Deletion & Retention.
Changes to this list
We will update this page before a new subprocessor begins processing personal data. Customers with a signed Data Processing Addendum can request notice of changes by emailing privacy@hardroad.app, and may object to a new subprocessor on reasonable data-protection grounds as set out there.