Service Providers
Last updated: Thursday, August 6, 2026
This page lists the third-party service providers Track28 currently uses, what each one does, and where it stores data. It is the detailed companion to Section 11 of our Privacy Policy, which describes the categories of providers we use and the commitments that apply to all of them. We update this page whenever a provider changes; the commitments in the Privacy Policy do not change with it.
| Service | Used in | Purpose | Cookies / storage | Consent | Data location |
|---|---|---|---|---|---|
| Railway | App | Runs our servers and database — where your account, cycle, health and workout data is stored | All app data | Not required (necessary to provide the Services) | United States |
| Cloudflare R2 (Cloudflare) | App | Storage of our encrypted nightly database backups | Encrypted backups | Not required (necessary to provide the Services) | North America |
| Amazon SES (Amazon) | App | Delivery of transactional email (account and security messages) | Your email address | Not required (necessary to provide the Services) | United States |
| Sendy (self-hosted) | Website | Sends our newsletter | First name and email address | When you subscribe | France |
| Vercel | Website | Hosts this website | Essential cookies; server logs including IP addresses | Not required (necessary to run the site) | United States |
| Google Analytics (Google) | Website | Traffic & audience analytics | Yes — analytics cookies (up to 2 yrs) | Loads in cookieless mode; cookies and identified measurement only after you accept the banner | United States |
| Vercel Analytics (Vercel) | Website | Aggregate traffic measurement | None (cookieless; aggregate measurement only) | Not required | United States |
| Firebase Analytics (Google) | App | App-usage analytics | On-device identifiers | Your choice in the app | United States |
| Firebase Crashlytics (Google) | App | Crash reporting (app stability diagnostics) | On-device identifiers | Not required (necessary diagnostics) | United States |
| Firebase Performance (Google) | App | App performance diagnostics (load & response times) | On-device identifiers | Not required (necessary diagnostics) | United States |
| PostHog | App | Product analytics | On-device identifiers | Your choice in the app | United States |
| PostHog Session Replay | App | Optional screen recordings to diagnose usability issues — all text and images are always masked | On-device identifiers | Off by default — only if you turn it on in Settings | United States |
| Crisp | App | In-app customer-support chat — receives your messages, email address, name, account identifier, sign-in method, app version and build, language, account status and account-creation date; we never send it your health data | Chat session data and any attachments you send | When you open the chat | European Union (Netherlands / Germany; backups in Ireland) |
| Sign in with Apple (Apple) | App | Account creation and sign-in — sends us your email (or a private relay address) and name | Your Apple ID | When you choose it at sign-in | United States (Apple ID service) |
| Apple HealthKit (Apple) | App | Sync workouts with Apple Health | On your device | You enable it (Apple permission) | On your device |
| Garmin Connect (Garmin) | App | Optional sync of workouts & activity data | Account connection | When you connect your account | United States |
The providers that store or process your account and health information on our behalf are bound by written data-protection commitments, and transfers outside Quebec are covered by the safeguards described in Section 11 of the Privacy Policy — a privacy impact assessment and, where applicable, the European Commission's Standard Contractual Clauses or an EU–U.S. Data Privacy Framework certification.
One exception, stated plainly. Our website host (Vercel) and its built-in aggregate traffic measurement are covered by the same privacy impact assessment as every other provider. What they do not have is a negotiated data-protection agreement: they operate under their standard published terms. They see visitors' IP addresses and, if you subscribe to our newsletter from the website, the email address you submit. They never receive health data or your Track28 account data — the only app-related traffic they see is the request itself, when you open one of our web pages from the app or when a device connection returns through our website.
What we never share: no provider receives your health data, menstrual-cycle information, GPS routes, or personal health metrics for analytics or advertising. The providers that store this information (Railway, Cloudflare R2) hold it solely to operate the service, under written commitments. That information is used only to build and adapt your training plan.
This page is drawn up in French. The French version prevails; this English version is provided for convenience.