GoalZen · Amanix Labs
Subprocessors
The third-party services that process personal data so GoalZen can run, and when each one is involved.
Last updated October 2, 2026
Current list
| Provider | Purpose | Data involved | When |
|---|---|---|---|
| Supabase (US, Oregon) | Sign-in (email, Google) and the Postgres database that holds your account and everything you add to GoalZen. | Email, authentication identifiers, profile name or avatar, and all goals, tasks, habits, notes, progress and settings. | Always |
| Vercel | Hosts the website, the web app and the API. | Request metadata (IP address, URL path, browser details) and the data the API handles while serving a request. | Always |
| Resend | Sends the emails we send ourselves, such as the waitlist welcome. | Email address and the message content. | When an email is sent |
| Browser push services (Apple, Google, Mozilla) | Deliver reminder notifications to the browser or device you turned them on for. | A push subscription endpoint for your browser or device and the reminder text. | Only if you turn on notifications |
| PostHog (US) | Product analytics for a few server-side events: signed up, task completed, waitlist joined, bookmark attached from NestMarks. | A pseudonymous account id (a hash for waitlist emails), the event name and counts. Never goal titles, notes or page addresses. | When analytics is enabled |
| Paddle | Planned merchant of record for Pro: checkout, tax, invoices, refunds. Not live; GoalZen is free during the beta. | Email, billing country and payment details (entered with Paddle, never stored by GoalZen). | Planned: only if you buy Pro once paid plans launch |
Not on the list
GoalZen has no advertising, tracking-pixel or data-broker providers, and no analytics runs in your browser. No AI provider receives your data today: the AI-assisted import exists in the code only with a stand-in that sends nothing anywhere, and this page will name the provider before a real one is connected.
Services you connect yourself, such as NestMarks (also operated by Amanix Labs) or a work tool like Jira, receive only what the action you request needs, and disconnecting revokes that access.
Changes
We update this page before a new subprocessor starts handling personal data. Questions: [email protected].