Far — Subprocessors, Third-Party Services & Attributions
DRAFT — requires review by qualified counsel before publication. Published at [/legal/subprocessors] and [/legal/attributions] (may be one page). This list is generated from the actual integrations in the codebase as of 2026-07-05.
Subprocessors (receive personal data server-side)
| Provider | Purpose | Personal data | DPA signed | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Hosting, logs, cron | All traffic, IPs | [ ] | [DPF / SCCs — verify] |
| Neon Inc. | PostgreSQL | All stored user data | [ ] | [verify region + mechanism] |
| Cloudflare Inc. | R2 object storage for uploads (S3-compatible API, not AWS) | Photos, GPX files | [ ] | [DPF / SCCs] |
| Upstash Inc. | Redis rate limiting, QStash jobs | Emails + IPs as TTL'd keys; job payloads | [ ] | [verify] |
| Groq Inc. | AI inference (user-invoked only) | Trip summaries (title, location, dates, route stats, forecast, gear names) | [ ] | [verify — no EU DPF certification as of drafting; SCCs needed] |
| Google LLC | OAuth sign-in | Google profile (email, name, photo) | n/a (independent controller for the Google side) | DPF |
| [SMTP provider — TBD] | Magic-link email | Email addresses | [ ] | [verify] |
Browser-side services (receive IP + queried coordinates, no account identity)
Mapbox (map rendering; sends an anonymized map-load telemetry beacon to
events.mapbox.com — required usage metering, not a disableable tracker), Open-Meteo (weather,
elevation — CC BY 4.0 data), OpenStreetMap Nominatim (geocoding — usage policy requires
attribution, ≤1 req/s, and a valid User-Agent/Referer: verify compliance), Overpass
API (overpass-api.de; mirror maps.mail.ru (VK, Russia) flagged for removal —
GDPR transfer problem), Waymarked Trails, OpenFreeMap, Esri/ArcGIS World Imagery &
Topo (verify free-tier terms permit this use), AWS Terrain Tiles (open data), US
NPS API, Recreation.gov RIDB, Parks Canada, BC Parks.
Required attributions
These are license obligations, not courtesies. They must appear on or near the map UI (short form) and on this page (full form):
- © Mapbox © OpenStreetMap — required by Mapbox ToS wherever Mapbox tiles render, with the "Improve this map" link where required. [Verify present on every map view.]
- © OpenStreetMap contributors, ODbL 1.0 — required for all OSM-derived data: Overpass trail data, Nominatim geocoding, Waymarked Trails overlays, OpenFreeMap tiles. Far's route-over-trail data may constitute a derivative database; if Far ever redistributes corrected/derived trail data publicly, ODbL share-alike applies — [counsel review before that feature].
- Powered by Esri — attribution per Esri terms for World Imagery / World Topo tiles. [Verify exact required string.]
- Weather data by Open-Meteo.com (CC BY 4.0).
- Terrain tiles: Mapzen/AWS Open Data terrain tiles attribution (multiple upstream sources: USGS, NASA, etc. — use the canonical Tilezen attribution block).
- Waymarked Trails (hiking overlay) — CC BY-SA styling/data attribution.
- US NPS / Recreation.gov / Parks Canada / BC Parks — public data; cite source and "not an official source; verify with the land manager" per API terms. [Verify NPS API terms require attribution text.]
Open-source software notice
Far is built on open-source software (Next.js, React, Prisma, MapLibre GL, Mapbox GL
JS, Radix UI, and others). Licenses: generate a NOTICE page from package.json
([license-checker] output) at [/legal/open-source]. MapLibre is BSD-3; Mapbox GL JS
v2+ is under the proprietary Mapbox ToS — its presence requires a Mapbox account and
token in compliant use.
Process
Adding a subprocessor requires: DPA signed, transfer mechanism confirmed, row added here, and — for EU users under a signed customer DPA, if Far ever sells B2B — [30] days' advance notice. Update the "Last updated" date on every change: Last updated [DATE].