Subprocessors and Third-Party Service Providers
Effective Date: April 27, 2026
Last Updated: October 15, 2026
The Ready Collective maintains a current list of all third-party service providers (subprocessors) that process personal data on behalf of R1 Ready First users. Each provider operates under a written data processing agreement that limits their use of personal data to the specific service they provide.
| Provider Name | Service Category | Data Processed | Processing Location |
|---|---|---|---|
| Heroku | Cloud hosting and infrastructure | All platform data, encrypted at rest and in transit; the Heroku platform runs on Amazon Web Services (AWS) infrastructure | United States |
| Google (Firebase Auth) | Authentication | Email address and authentication tokens | United States |
| Stripe | Payment processing | Subscription and billing information and Stripe customer and subscription identifiers; card and bank details are handled directly by Stripe and are not stored by R1 | United States |
| Asensei | AI movement assessment | Movement data when an athlete uses the movement assessment feature; where a parent turns on the optional, off-by-default video-recording setting, the athlete’s exercise video is also recorded and shared for R1-team review to improve movement-detection accuracy and safety | United States |
| Anthropic | AI food recognition (optional plate photos) | Meal photos a parent chooses to submit through the optional, off-by-default plate-photo feature, used only to identify the food. Under our contract, Anthropic may not train models on them. Starts November 14, 2026. | United States |
| Pearl IRB | Independent research ethics oversight | De-identified research data under IRB-approved protocol | United States |
| Plain | Customer support tooling | Support request content only | United States |
| Sentry | Application performance monitoring | Technical logs and crash reports; account email address attached to error reports; session replay masks all text and images | United States |
| Amplitude | Product analytics | Account email address as a user identifier; product-usage events, which can include an individual readiness score | United States |
| RevenueCat | Subscription management (in-app purchases) | Purchase and subscription status for Apple in-app purchases; the purchasing parent’s email address and display name, synced as subscriber attributes when the app links their identity, so support can locate a customer from the email on a support request – never a child’s information | United States |
We will notify parents at least 30 days in advance of adding any new category of subprocessor that handles children’s personal data. To exercise your right to object to a new subprocessor, use the contact details in Section 9 of the Privacy Notice.
Embedded third-party content
One third party receives data without being a subprocessor, so it is listed separately here. The exercise-demonstration clips in the Body section are hosted on R1’s own YouTube channel and played from YouTube’s privacy-enhanced domain (youtube-nocookie.com). Google delivers that video under its own terms and privacy policy rather than processing data on our instructions, so no data processing agreement governs the relationship and it does not belong in the table above.
Loading a clip (or opening a screen that shows the still image representing one) connects the device to a Google host, which receives the IP address, the browser and operating system identification the device sends, the clip requested, and the date and time. No account, check-in, readiness, or profile data is sent, the clips carry no advertising, and cookies set during playback are confined to the app’s own isolated storage rather than the phone’s web browser. Section 15.2 of the Privacy Notice describes this in full.