[WORKING DRAFT // Deployment-specific regions and operator records still need verification. Provider documentation does not certify our deployment.]
Subprocessors
These are the companies that receive C0VIBE data to run the service. Each one receives only what its feature needs. Read the privacy page for why we collect data at all, and what you can ask us to do.
We add or remove a provider when the code changes. The date of the last change is shown at the top of this page once it leaves draft.
Core service providers
These run the platform. They receive account and app data as described below.
| Provider | What it receives | Why | Where it runs |
|---|---|---|---|
| Supabase | All account data and app data: the database, sign-in records, uploads in storage, and the requests our edge functions handle. | Database, authentication storage, file storage, realtime updates and edge functions. | The deployed C0VIBE database project is in AWS Singapore (ap-southeast-1), verified through project metadata on 30 October 2026. Edge execution can be distributed; this is not a promise that all Supabase processing stays in Singapore.Provider source |
| WorkOS | Your email address, name and the sign-in details the sign-in flow returns. | Sign-in and account authentication. | International processing, including transfers to the United States under the WorkOS DPA.Provider source |
| Polar | Your name, email and billing details at checkout. Polar is the merchant of record for C0VIBE subscriptions. | Checkout, billing portal, receipts and subscription records. | US billing infrastructure; distributed web delivery; some UK support and payment-risk processing.Provider source |
| Netlify | Standard web requests to the website and web app, including IP address. The sign-up email form posts to Netlify Forms. | Hosting for the website and the web app, and the sign-up form. | Global edge delivery; serverless region is configured per site, with new sites defaulting to Ohio, US. The C0VIBE site selection requires deployment verification.Provider source |
| Resend | Recipient email address and the text of notification emails. | Sending notification emails. Mail is sent from a notifications address; the sender name shown is C0DIC. | United States storage and primary processing. Sending-region selection does not change storage residency.Provider source |
| LiveKit | Camera and microphone streams and room connection details for C0LINK sessions. | Real-time audio and video in C0LINK rooms. | Media routes globally unless pinned. Project data can reside in the US or EU (Frankfurt); C0VIBE project selection is unverified.Provider source |
| SpacetimeDB | Room presence and activity events, so friends can see who is online. | Live presence and activity for C0LINK. | Maincloud physical hosting region remains unverified. The deployment guide does not establish a C0VIBE-specific geographic commitment.Provider source |
| Mux | Video files of C0LINK replays that you or a host choose to keep. | Storing and playing replays. | United States and other subprocessor locations; EU-only residency is not established.Provider source |
| Matrix homeserver (matrix.c0vibe.app) | Messages and account details for a Matrix account you link. | Matrix messaging for linked accounts. Run by us on the c0vibe.app domain. | C0VIBE-operated infrastructure. Geographic hosting location requires our operator inventory; no country is inferred from the domain. |
AI, speech and media providers
These receive the content of a request when you use the feature that calls them. Some features use your own API key. In that case the content goes to the provider under its terms.
| Provider | What it receives | Why | Where it runs |
|---|---|---|---|
| OpenAI | Chat text, speech audio for transcription, realtime voice sessions, text for embeddings and image prompts. | Chat models, speech-to-text, realtime voice and embeddings. | API residency depends on project, endpoint and supported feature. US and other regional endpoints are available; no C0VIBE-specific regional restriction has been verified.Provider source |
| Anthropic | Chat text and the text C0LINK AI members need to reply. | Chat models and C0LINK AI member replies. | Multi-region processing including the US, Europe, Asia and Australia unless an account restriction applies.Provider source |
| OpenRouter | Chat text, routed to the model you choose. | Routing chat requests to many model providers. | Location depends on the selected downstream model provider; no single processing region applies.Provider source |
| Google (Gemini) | Image prompts and reference images. | Image generation. | International: the paid-service processing terms permit countries where Google or its subprocessors maintain facilities, subject to applicable transfer terms.Provider source |
| Groq | Speech audio for transcription and text for polishing. | Speech-to-text and text cleanup for dictation and streaming transcription. | United States and other global processing jurisdictions; no C0VIBE regional restriction verified.Provider source |
| Cohere | Speech audio for transcription. | Speech-to-text. | Processing across Canada, the EU and US; deployment-specific restrictions require contract verification.Provider source |
| ElevenLabs | Text to speak, and audio for voice jobs you start. | Voice output and voice jobs. | Non-Enterprise processing may occur in the US, EU or Singapore. Enterprise residency is account-specific.Provider source |
| Fish Audio | Text to speak. | Voice output. | The privacy policy permits transfers outside Europe but does not identify a fixed hosting country for this integration. Operator contract verification remains required.Provider source |
| fal | Prompts, reference images and text to speak. | Image, video and speech generation. | United States and other countries where fal or its service providers operate servers. No fixed C0VIBE region restriction has been verified.Provider source |
| Replicate | Prompts and media files. | Image and video generation. | Its published infrastructure and data-hosting subprocessors are listed in the United States.Provider source |
| Suno, Sonauto and Mureka | Music prompts and lyrics you enter. | Music generation. | Suno generally stores data in the US and permits other-country transfers. Sonauto and Mureka hosting locations remain unverified; the Suno policy does not establish their regions.Provider source |
| Brave Search | Search queries. | Web search in assistants. | US provider; the API privacy notice does not guarantee a fixed query-hosting region. Confirm the applicable API deployment and contract before claiming regional residency.Provider source |
| Pexels | Search terms for stock photos. | Stock photo search. | US, Australia, Singapore, EU, UK, Philippines, New Zealand and other countries where Pexels group companies or service providers operate.Provider source |
| Browserbase | The pages the browser agent opens and its instructions. | Cloud browser sessions for the C0BRO agent. | Session regions supported by its SDK: US West, US East, Frankfurt and Singapore. The configured region and separate proxy locations require deployment verification.Provider source |
| Stripe | Creator payout details for marketplace sellers. | Payouts to marketplace creators. Listed here while the payout path is in use. | International transfers including the United States; its provider network also includes the EU and India. No EU-only restriction is asserted.Provider source |
Public web services the site or app loads
These are loaded by the page or the app. Your browser or app sends them a request, which includes your IP address. No account data is sent with it.
| Provider | What it receives | Why | Where it runs |
|---|---|---|---|
| randomuser.me | A request for profile images shown on the home page. | Sample profile images on the home page. | A fixed hosting region is not established in the reviewed public API documentation. Operator verification or removal of this dependency remains required.Provider source |
| unpkg.com and cdn.jsdelivr.net | A request for the script library a chat artifact asks for (React, Babel and Mermaid). | Running interactive chat artifacts. | Global edge delivery: UNPKG uses Cloudflare; jsDelivr routes across Cloudflare, Fastly, Bunny and GCore. Requests are not confined to one country.Provider sourceAdditional provider source |
| X (platform.twitter.com and the X API) | The widget request when you embed a post. Posts you publish to X from C0VIRAL. | Embedding posts, and publishing that you start. | International service-provider network including US, European and other providers. No fixed residency for this integration has been verified.Provider source |
Services you connect yourself
Services you connect yourself: GitHub, Notion and Telegram integrations, and model endpoints you configure yourself, such as DeepSeek, MiniMax or z.ai. Your content goes to them only when you use the integration, under their terms.