Ops HUD
Focus HUD ↗ Download

Sub-processors

Last updated: 2026-05-10

The third parties below process some Ops HUD user data on our behalf. We list each one here, what data they see, and where they operate.

Email delivery

  • Brevo (sendinblue.com) — sends magic-link sign-in emails, account-action confirmations, and (when enabled) the scheduled digest emails. Receives your email address and the email body. EU-based, GDPR-compliant.

Payments

  • Stripe (stripe.com) — processes Pro plan payments. Stripe sees your email, billing address, and payment method details directly. We never see card numbers; we receive a customer ID and subscription status.

AI summarization

  • OpenRouter (openrouter.ai) — when you click "Summarize," we send the task title and description to OpenRouter, which routes the request to an underlying LLM (currently OpenAI's GPT-5 Nano). The summary returns to us; we store it. We do not send your name, email, or any identifier alongside the prompt.

Integrations (only when you connect them)

  • Slack (slack.com) — when you connect Slack presence sync, we send your status text to Slack on your behalf. Slack stores its own copy.
  • Google (google.com) — when you connect Google Tasks, we hold a refresh token and read/write your task lists on request. We do not access any other Google data.
  • Trello (trello.com) — when you connect Trello, we hold an authorization token and read/archive cards on the boards you select.
  • Microsoft (microsoft.com) — when you connect Microsoft To Do, we hold a refresh token and read/write the Outlook task list you pick. We do not access any other Microsoft 365 data.
  • Todoist (todoist.com) — when you connect Todoist, we hold an OAuth access token and read your tasks / close them on completion.
  • TickTick (ticktick.com) — when you connect TickTick, we hold an OAuth access token and read tasks from a project you pick / mark them complete on completion.
  • Vikunja, Linear, Jira — connected from the desktop client only. Tokens stay on your machine; we never see them server-side. Listed here for completeness.

Infrastructure

  • Cloudflare — DNS, edge proxy (TLS, DDoS protection), and Cloudflare Access (Zero Trust auth for the admin console). Sees request metadata (IP, User-Agent, path) but not request bodies after TLS termination.
  • Hostkey — VPS provider hosting our database and application. United States.

Notifications of changes

When we add or remove a sub-processor we update this page and date it. For business customers under a Data Processing Addendum, we give 30 days' notice via the email on file before adding a new sub-processor that handles their data.