Prelaunch inventory
Service providers and data flow
Configuration record, not legal approval. Provider contracts, current processing locations, transfer mechanisms, retention, security terms, and legal status must be rechecked before public launch.
| Provider | Purpose | Information disclosed | Location posture |
|---|---|---|---|
| Vercel | Application hosting and private temporary object storage | Web requests and responses; private export archives; non-identifying deletion-ledger records | Application region configured for Singapore; other provider processing must be reviewed |
| Neon | Authoritative PostgreSQL database | Account, authentication, settings, goals, todos, habits, and financial tracking records | Primary database region configured for Singapore |
| Brevo | Transactional email delivery | Recipient address and the required security, reminder, or percentage-based forecast message | Provider processing locations require launch review |
| Upstash QStash | Wake the background-job worker | Signed worker request only; no personal-space job payload | Provider processing locations require launch review |
| Backblaze B2 | Thirty-day database backup storage | Client-encrypted PostgreSQL backup objects and object metadata | Bucket region is selected during production configuration |
| GitHub Actions | Backup, freshness, restore-drill, and delivery automation | A streamed database dump during client-side encryption; encrypted archives and operational output | Hosted runner location is provider-managed |
| Have I Been Pwned | Known-compromised password screening | A k-anonymous prefix derived from the password; never the complete password or account identity | External security service |
| Frankfurter | Optional exchange-rate suggestion | Source and target currency codes only | External reference-data service |
No advertising or behavioral analytics
The initial architecture contains no advertising network, third-party product analytics, session replay, or behavioral tracking provider. Adding one requires a product decision, an updated privacy notice, and user notification.