Subprocessors
Last changed October 5, 2026
Our Fable, Inc. uses the companies below to run Our Fable. Each entry says what the company does for us and exactly what our code sends it. Our Privacy Policy explains what we collect and why, and our Cookie Policy lists what runs in your browser.
Our Fable does not use AI services. No information about you, your family or your archive is sent to an AI provider.
1. Subprocessors
Convex, Inc. · based in United States
What it does: Database and backend: runs the server functions behind every account and archive, and stores their records.
What it receives: Account and sign-in records, children's names and birth dates, circle members' names and email addresses, archive entries and their metadata (sealed content of newly created families arrives already encrypted on the contributor's device), email queue, consent and privacy-request records.
Vercel Inc. · based in United States
What it does: Hosts the ourfable.org website and its server routes.
What it receives: Every request to the site passes through it: IP address, browser details, the page or API called, and request contents in transit, plus short-lived request logs.
Cloudflare, Inc. (R2 storage) · based in United States
What it does: Stores uploaded files.
What it receives: Photos, voice notes, videos and other files added to an archive or a family update, and archive export files.
Stripe, Inc. · based in United States
What it does: Payments, subscriptions, gift purchases and the checkout form.
What it receives: The paying parent's or gift buyer's email address, payment details (entered directly into Stripe's form; we never see full card numbers), the plan and number of children, and campaign tags from the link that brought them. Where ad measurement has not been declined, also the measurement identifiers (Meta's browser cookies, IP address, browser details and the analytics browser ID), kept with the payment so the later purchase report can be matched. No children's names or birth dates, circle contacts or archive content.
Resend, Inc. · based in United States
What it does: Sends our email and keeps the newsletter contact list.
What it receives: Recipients' email addresses and the email itself: account, billing, invitation, question, reminder and delivery emails, which can include names and links. Newsletter subscribers' addresses.
Twilio Inc. (Twilio Verify) · based in United States
What it does: Sends and checks sign-in text codes, only for parents who turn on text-code sign-in protection.
What it receives: Mobile number and verification requests. No passwords, archive keys, child details or archive content.
Google LLC · based in United States
What it does: Google Analytics 4 measures traffic on eligible public pages and reports trial starts and purchases; Google Drive holds a staff spreadsheet of early-access sign-ups.
What it receives: Analytics (only where you have not declined): browser and device details, IP address, the page visited with private tokens removed, campaign tags, and for a trial start or purchase our internal family ID, the analytics browser ID, plan, number of children and amount. Drive: early-access sign-up email addresses, sign-up time and campaign tags.
Meta Platforms, Inc. · based in United States
What it does: Measures whether our ads lead to visits, trial starts and purchases (Meta Pixel and Conversions API).
What it receives: Only where you have not declined: on eligible public pages, browser and device details, IP address and the page visited; for a trial start or purchase, a one-way hash of the parent's or buyer's email address, Meta's browser cookies, IP address, browser details, campaign tags and the amount. No children's details or archive content.
Telegram · based in United Arab Emirates
What it does: Delivers internal alerts to Our Fable staff about new sign-ups and system errors.
What it receives: For each new sign-up: the parent's email address and parent names, plan, amount, and payment reference numbers. Error alerts carry no family content.
2. Other services our servers query
For a few features, our servers look something up with an outside service. They send only what the lookup needs, never your name or account details.
Open-Meteo · based in Switzerland
What it does: Looks up the weather on the day a child was born, when a parent adds a birth place to The Day They Were Born.
What it receives: The birth place as typed, then its map coordinates and the birth date. Sent from our servers, with no name or account details.
Apple Inc. (iTunes Search) · based in United States
What it does: Finds songs when someone adds music to a letter.
What it receives: The search words typed. Sent from our servers, with no account details.
Spotify AB · based in Sweden
What it does: Finds songs when someone adds music to a letter and picks Spotify.
What it receives: The search words typed. Sent from our servers, with no account details.
3. Built but switched off
These integrations exist in our code but are turned off, so they receive nothing. If we turn one on, it moves to the list above and the change is recorded below first.
Prodigi Group Ltd · based in United Kingdom
What it does: Would print and ship photo prints ordered from a family update. The feature is switched off.
What it receives: When switched on: the photos ordered and the shipping name and address.
4. Changes to this list
Every time we add, remove or change a subprocessor, we record it here with the date. If you need to be told about changes in advance, for example under a data processing agreement, email hello@ourfable.org.
- October 5, 2026. Published this list. It names every provider in use on this date, including Convex, Vercel and Cloudflare R2, which our Privacy Policy previously described only as infrastructure providers, and Telegram, Google Drive and Open-Meteo, which it did not mention.
- October 4, 2026. Removed OpenAI. Until this date, suggested circle questions were written by sending minimized names and ages to OpenAI. Our Fable no longer sends any information to an AI provider.