Who can touch your data
This is the list. Everything else on this desk explains it.
We publish the subprocessor list first because it is the only part of a trust page that can be checked from the outside. A policy describes an intention. A vendor list describes an arrangement, and an arrangement either exists or it does not.
Every row below is drawn from company/product-facts.md in the calabrodesign repository, by fact id. Nothing on this page is written from memory, and nothing is written to fill a gap.
The list
| Vendor | What it does | What it holds | Fact |
|---|---|---|---|
| Vercel | Hosting. Serves the static build of the site and the tools. | Build output, and the analytics events described below. | V-2 |
| GitHub | Source control, in the bryancalabro organisation. Pull requests and Actions run here. | Repository contents, commit history, Actions logs. | V-3 |
| Vercel Analytics and Speed Insights | Pageview and performance telemetry, on the portfolio site only. | Pageview and performance events. No personal data is collected by the site itself. | V-4 |
| Anthropic | AI provider, used through Claude Code to build, audit and draft across the first-party repositories. | Repository source and the app inventory content passed into a session. | V-5 |
What is not confirmed yet
Two rows that belong on this list are missing, and we would rather say so than publish a guess.
- DNS and domain registrar for bryancalabro.com. Recorded as
V-1, open.
Whoever runs DNS for a domain can redirect it, so this belongs on a subprocessor list even though it never sees application data.
- Company email provider. Recorded as
V-6, open. The note on that fact is
explicit that a personal Gmail account should not be assumed to be the company's mail vendor.
Both are blocked on owner review of product-facts.md, which is due 2026-10-03. When they are confirmed, they appear here in the table above and this section shrinks.
What the tools themselves send
Nothing.
The app-a-day tools are static pages. They hold their state in your own browser, under a key named for the host, and they make no request to a server of ours while you use them. There is no account to create and no identifier to correlate. The analytics in V-4 run on the portfolio site, not on the tools.
That is not a privacy promise so much as an architecture. A page that never had a backend cannot quietly grow one without a commit, and the commits are public.
How this page changes
The version and review date at the top of every page are the same version as the package.json in this repository and move with it. A change to the vendor list is a commit, and a commit is a diff someone can read.