Vendors
Minitu Vendor And Subprocessor List
Last updated: 2026-07-19
These vendors help Minitu provide the service. They process user data only as needed for hosting, database storage, email delivery, push notifications, media hosting, translation, support, safety, and legal compliance.
Current Vendors
| Vendor | Purpose | Data Categories | Status |
|---|---|---|---|
| Render | Backend hosting and service infrastructure. | Account data, profile data, messages, moderation data, sessions, operational logs, and API traffic needed to run Minitu. | Active production infrastructure. |
| PostgreSQL / managed database storage | Persistent database for accounts, profiles, chats, social state, reports, and app records. | Account, profile, user content, safety, moderation, notification, and operational data. | Active production database provider through the hosting environment. |
| Cloudinary | Profile photo and gallery photo hosting when Cloudinary upload settings are configured. | Uploaded images, image URLs, upload metadata, and folder path such as `minitu/photos`. | Configured for production photo upload. Account deletion attempts physical deletion of owned Cloudinary assets using stored or safely derived public_id values; failures are logged with minimal hashed audit metadata for review or retry. |
| AWS Rekognition | Automated profile photo safety checks plus optional Face Liveness and face comparison for profile verification. | Uploaded profile photos, a short video selfie streamed to AWS, a returned reference frame, liveness and face-match results, and request metadata needed to detect unsafe content, confirm liveness, reduce impersonation, and compare the user with approved profile photos. | Conditional for photo moderation and optional profile verification. Face Liveness runs in AWS US East (N. Virginia). Minitu requests zero audit images and no S3 output. AWS session data becomes unavailable when the three-minute session expires. Minitu privately retains the reference frame only when human review is needed and deletes it after the review is resolved or cancelled. An AWS Organizations content-use opt-out policy for Amazon Rekognition has been attached to the organization root since July 19, 2026. |
| Expo Push Notifications | Mobile push token registration and notification delivery. | Expo push token, device name, platform, language, notification payload metadata. | Used when a signed-in user enables notifications on a physical device. |
| Apple Push Notification service (APNs) | iOS push notification delivery through Expo and Apple systems. | Push token and notification payload metadata required for iOS delivery. | Conditional for iOS notifications. |
| Firebase Cloud Messaging (FCM) | Android push notification delivery where Expo uses FCM. | Push token and notification payload metadata required for Android delivery. | Conditional for Android notifications. |
| Resend | Email verification, password reset, and service email delivery. | Email address, verification/reset message metadata, and email delivery metadata. | Used when `RESEND_API_KEY` is configured. |
| Google Cloud Translation | Manual chat translation when a user taps Translate. | Selected message text, source language, target language, translation result metadata, and request metadata needed to return a translation. | Current production translation provider when Google translation credentials are configured. |
| OpenAI | Fallback manual chat translation if OpenAI translation environment variables are configured and a user taps Translate. | Selected message text, source language, target language, translation result metadata, and request metadata needed to return a translation. | Conditional fallback; not used when `OPENAI_API_KEY` and model settings are absent. |
| LibreTranslate | Fallback manual chat translation if a LibreTranslate endpoint is configured and a user taps Translate. | Selected message text, source language, target language, optional API key, translation result metadata, and request metadata needed to return a translation. | Conditional fallback; not used when `LIBRETRANSLATE_URL` is absent. |
Not Currently Used
- No third-party advertising SDK was found in the current mobile dependency list.
- No analytics SDK such as Firebase Analytics, Mixpanel, Amplitude, or Segment was found in the current mobile dependency list.
- No crash reporting SDK such as Sentry or Firebase Crashlytics was found in the current mobile dependency list.
- No payment processor or in-app purchase provider is used by the current app.
Changes To This List
Minitu should update this page before adding any new vendor that receives personal data, user content, device identifiers, safety records, or support data. Privacy questions can be sent to privacy@minitu.app.