Subprocessors
These are the companies that process people's data for Ponzu. "Not in use yet" means the feature that needs them is not switched on, and they hold nothing until it is. Where we chose a region, the table names it; otherwise the company decides where it processes data.
| Name | What for | What data | Where | Status |
|---|---|---|---|---|
| Vercel, Inc. | Hosts the API, this website, and the cloud sandboxes where Claude Code runs | Requests and logs; repository checkouts, sandbox disks and their snapshots; while a sandbox runs, your Claude credential and the repository's secrets in its memory | United States (Washington, D.C., iad1) | In use |
| Neon (Databricks, Inc.) | Database and realtime updates | Accounts, workspaces, canvases, threads, comments, notifications, events and usage; tokens and secrets, encrypted; and, for live updates, the IP address of each device connected to it | United States (AWS us-east-1, N. Virginia) | In use |
| Cloudflare, Inc. | Object storage (R2) and delivery of canvas files from ponzu.cloud | Canvas files, previews, exports, pictures of comments and pull requests, and, in a bucket of their own, checkpoints (the agent's transcript and uncommitted work) | Delivered through Cloudflare's network worldwide | In use |
| WorkOS, Inc. | Sign-in and sessions | Name, email and GitHub identity; the GitHub token each sign-in produces, as it passes through; the IP address and browser of each sign-in | Where WorkOS runs its service | In use |
| PostHog, Inc. | Product analytics, session replay, error tracking and AI observability, for the desktop app, the server and this website | Usage events, recordings of desktop app sessions, errors, model-call metadata, and the IP address of events sent from your device | United States (PostHog Cloud US) | In use |
| Anthropic, PBC | Suggests prompts to start from for a repository, on Ponzu's own account | A repository's description, topics, file layout, README, up to four manifest files and one theme file, and for a small repository the start of up to two other files | Where Anthropic runs its service | In use |
| 650 Industries, Inc. (Expo) | Delivers updates to the iPhone app | The phone's IP address and platform, the app's runtime version and its update channel, and whatever else Expo's update library sends, in each check for an update | Where Expo runs its service | In use |
| 650 Industries, Inc. (Expo) | Sends pings to iPhones through Expo's push service | The phone's push token, and each ping's text and the ids it opens | Where Expo runs its service | Not in use yet |
| Apple Inc. | Carries the pings Expo hands it to iPhones (Apple Push Notification service) | The phone's push token, and each ping's text | Where Apple runs its service | Not in use yet |
| Resend | Sends Ponzu's emails (billing emails to admins, people joining a workspace to its admins, the Friday recap, the daily email of notifications, and legal notices) | Your email address, and the email: workspace and canvas names, the names and GitHub logins of people who joined and the workspace's number of people (to admins), amounts, dates and Stripe's invoice link (billing, to admins), pull request numbers, a suspension's reason, links that carry Ponzu's ids, and Ponzu's own sentences | Where Resend runs its service | Not in use yet |
| Stripe, Inc. | Payments | The workspace's billing contact and card | Where Stripe runs its service | Not in use yet |
Services you connect
Two services you connect yourself are not our subprocessors: they work for you, under your own account with them.
- GitHub holds your repositories, branches and pull requests, under GitHub's terms. Ponzu reaches them through the GitHub App you install.
- Anthropic, for Claude Code's turns, under your own Claude account or API key and your plan's terms. (Separately, Ponzu's own Anthropic account suggests prompts for a repository; that is the Anthropic row above.)
Other requests your browser makes
A canvas can name fonts from Google Fonts, which the apps load from Google, and images from any https address, which load from wherever they live. Their hosts learn that the canvas was opened, as they would in any browser.
The desktop app checks GitHub for updates and downloads them from there, and this website's download links point to GitHub too. GitHub sees those requests as any web host does.
Questions: privacy@ponzu.design.
Last updated November 13, 2026.