Legal
Subprocessors
Every company outside Rockbeach that processes school data, what specifically reaches them, and where they are. If you are running a vendor security review, this is the page you were about to ask for.
| Company | What they do for us | What reaches them | Where |
|---|---|---|---|
| Anthropic | Writes the weekly analysis and the AD Insights narrative. | A school's own weekly figures and goals for the week being analyzed. No names, no email addresses, no rep-level records. | United States |
| Neon | The database. Everything entered into the product is stored here. | All school data, encrypted at rest and in transit. | United States |
| Vercel | Runs and serves the application. | Requests in transit, and standard access logs. | United States |
| Stripe | Takes subscription payments and holds the card. | The billing contact’s name and email, and the card itself — which Stripe holds and Rockbeach never sees or stores. Payment card details are the one thing the privacy policy says the product has nowhere to put, and that is true precisely because Stripe holds them instead. | United States |
| Resend | Delivers email — invitations, password resets, notices. | Recipient name and email address, and the content of that message. | United States |
| Open-Meteo | Historical weather for a game, on the Event Snapshot. | The venue’s latitude and longitude and the date of a game. Nothing about a person, and nothing about revenue — a stadium’s coordinates and a date. Called from our server, so no visitor’s address ever reaches them. | Germany |
| ntfy | Sends Rockbeach a phone alert when somebody asks for help. | The school name and the kind of request. Deliberately no message content, no email address, no personal detail. | Operated from Germany |
Who else your browser talks to
Nobody in the table above hears from you directly — our servers talk to them, not your browser. These are the ones your own browser connects to, which is a different question and worth answering separately.
Nobody. Every font, image and script on our pages is served from our own domain, so viewing this site does not connect your browser to anyone else. Our marketing page loaded two typefaces from Google until 9 September 2026; they are now served by us, and Google no longer sees the address of anyone who visits.
Changes
We will update this page before adding a subprocessor that handles school data, and tell account holders. If a change is unacceptable to your institution, write to legal@rockbeachcurrents.com and we will talk about it rather than proceed regardless.