Third-Party Services

VercelLegacy

Retired. Vercel was used only by Ridge Sight, which has been sunset. No current CHKDSK Labs product sends data to Vercel. Retained here for historical disclosure.

Purpose: Application hosting, CDN, serverless compute, and cookieless web analytics.

Data shared: HTTP request metadata (IP address, headers, request path), anonymized page views, and web vitals performance metrics. No PII is collected by Vercel Analytics.

Stripe

Purpose: Payment processing, subscription billing, and usage-based metered billing.

Data shared: Stripe handles all payment information (credit cards, billing addresses) directly. We store only opaque Stripe identifiers (customer ID, subscription ID) and subscription status. No raw card data ever touches CHKDSK Labs infrastructure.

Microsoft

Purpose: Payment processing and subscription management for apps distributed through the Microsoft Store on Windows.

Data shared: All payment and billing information is handled directly by Microsoft. We receive only subscription status and license entitlements. No raw payment data ever touches CHKDSK Labs infrastructure.

Gumroad

Purpose: Storefront, checkout, and license-key delivery for products sold directly rather than through a platform store.

Data shared: Gumroad handles all payment information (credit cards, billing addresses) and the buyer email directly. We receive only the Gumroad sale ID and the issued license key for entitlement verification. No raw card data ever touches CHKDSK Labs infrastructure.

Google

Purpose: Distribution, payment processing, and in-app services for apps published on the Google Play Store — app delivery and updates via Google Play, purchases via Google Play Billing, advertising via Google AdMob (including the User Messaging Platform consent form), and optional leaderboards, achievements, and cloud saves via Google Play Games Services.

Data shared: AdMob and its ad technology partners receive the Android advertising ID, IP address and the coarse location derived from it, ad interaction events, and general device information. Play Billing handles all payment and billing information directly; we receive only opaque purchase tokens and order identifiers. Play Games Services receives submitted scores, achievement progress, and a small saved-game snapshot, tied to the player's own Google account and only while they are signed in. Play Console reporting reaches us as aggregated, non-identifying install, crash, and rating statistics. No raw payment data and no personal data ever touches CHKDSK Labs infrastructure — these apps have no CHKDSK Labs backend at all.

Scope: not every app uses every one of these services. Our paid apps — CastBlast among them — use Google Play only for distribution, purchase, and Play Console reporting; they contain no advertising SDK, request no advertising ID, and use no Play Games Services. NarMob's Play edition uses AdMob for a single banner and nothing else from Google beyond distribution; its itch.io edition is not on Google Play at all.

itch.io

Purpose: Storefront and payment processing for the paid, ad-free edition of NarMob. itch.io hosts the download and takes the payment under its own terms and privacy policy.

Data shared: itch.io handles all payment information directly; no card data reaches us. Its seller dashboard shows us each purchase record, including the email address on the buyer's itch.io account where one exists. We read that only to answer support questions and process refunds, we do not export it, and the app itself never contacts itch.io — there is no licence check and no telemetry.

GitHub

Purpose: Authentication (OAuth 2.0), repository data access, and webhook event delivery.

Data shared: OAuth tokens (encrypted at rest), GitHub user ID, username, avatar URL, and repository/PR metadata. Source code is never accessed or stored.

Neon (PostgreSQL)

Purpose: Primary database hosting for application data.

Data shared: All stored application data. Sensitive credentials are encrypted (AES-256-GCM) before storage. Row-level security (RLS) is enforced where applicable.

Sanity

Purpose: CMS content delivery for published articles and knowledge-base content.

Data shared: Published content only. No user personal data is stored in Sanity.

Vercel AI GatewayLegacy

Retired. The Gateway was used only by Ridge Sight, which has been sunset. No current CHKDSK Labs product performs AI inference on user data. Retained here for historical disclosure.

Purpose: Unified API proxy for AI model inference, routing requests to providers operating under Zero Data Retention (ZDR) agreements.

Data shared: Product-specific metadata only (e.g. PR metadata for Ridge Sight). No source code, no PII, no raw user content is sent. All data is discarded immediately after inference — it is not stored, logged, or used for model training.

Sentry

Purpose: Error monitoring and performance tracking for application reliability.

Data shared: Error messages, stack traces, request metadata (route, status code, response time). No PII, access tokens, or request/response bodies are included. Opt-in via environment variable configuration.

Slack

Purpose: Support ticket management and optional notification delivery.

Data shared: Support ticket content (name, email, subject, messages) for ticket management. Notification digests (alert counts only, no PR details) for opt-in notification delivery. Webhook URLs are encrypted at rest.

Pushover

Purpose: Optional push notification delivery for alert digests.

Data shared: Notification digests containing alert counts only. API credentials are encrypted at rest (AES-256-GCM). Opt-in only.

Fly.io

Purpose: Static site hosting and long-running service infrastructure.

Data shared: HTTP request metadata (IP address, headers, request path). No PII is collected at the infrastructure level.

Cloudflare

Purpose: Application hosting via Pages, serverless compute via Workers, object storage via R2, relational database via D1, and key-value storage via Workers KV (used by Blokhead to store signed license JWTs keyed by Stripe customer ID).

Data shared: HTTP request metadata (IP address, headers, request path), application data stored in R2/D1/KV as required per product. Cloudflare acts as both a network intermediary and a data processor for stored content.

Summary

Integration Notes

• No cardholder payment data is processed by any CHKDSK Labs infrastructure. Only non-sensitive identifiers from Stripe or Microsoft Store transactions are stored.
• Ad-supported mobile apps do not request a single ad until the Google User Messaging Platform consent flow has been resolved, so no advertising identifier is shared before the player has answered it.
• All third-party services are selected based on their security posture and compliance with applicable data protection regulations. We review our third-party integrations annually or when a new service is added.

Processor Change Policy

This page is updated whenever a new third-party processor is added or when an integration materially changes the categories of data processed.

Related Documentation

• Privacy Policy
• Security Posture
• Data Processing Agreement
• Terms & Conditions