current as of sep 8, 2026
subprocessors
know exactly where your data is and how it's used. these are the companies that help us host, secure, deliver, and run folk. we only ever share what each one needs to do its job - and we never sell your data or use it to train AI models.
namepurposelocationwebsite
OpenAI
AI models (via OpenRouter) and voice transcription; also conversion measurement for web signups that came from an OpenAI ad (hashed contact details only)
United States
Langfuse
LLM observability: records the messages exchanged with AI models so we can find and fix slow, broken, or wrong replies
Germany
Lemma
LLM observability: traces of AI model calls for reliability and quality
not disclosed
Raindrop
LLM observability: per-reply quality signals so silent failures are caught
United States
Nominatim / OpenStreetMap
reverse geocoding (turning coordinates into a place name)
United Kingdom
Fandom
public reference lookups when you build a character from an existing work (character names only)
United States
AniList
public reference lookups when you build a character from an existing work (character names only)
not disclosed (volunteer-run)
MyAnimeList
public reference lookups when you build a character from an existing work (character names only)
Japan
Danbooru
public reference lookups when you build a character from an existing work (character names only)
United States
TVMaze
public reference lookups when you build a character from an existing work (character names only)
Netherlands
Apify
web image search when you build a character from an existing work (character names only)
Czech Republic
HikerAPI
public Instagram profile lookups (character names only, and the Instagram features you turn on)
not disclosed
Slack
safety report metadata (what was reported and why) so a person on our team reviews it; never your conversations
United States
Meta
conversion measurement for web signups that came from a Meta ad (hashed contact details only, never conversations)
United States
Google
conversion measurement for web signups that came from a Google ad (hashed contact details only, never conversations)
United States
when you connect your own apps (like Gmail, Calendar, GitHub, or your bank), those providers process your data under their own terms - you choose them, and you can disconnect anytime. locations shown are where each company is headquartered; some run infrastructure in multiple regions.