Draft — pending review by qualified counsel. Not yet finalized.

Far — Subprocessors, Third-Party Services & Attributions

DRAFT — requires review by qualified counsel before publication. Published at /legal/subprocessors. This list is generated from the actual integrations in the codebase as of 2026-07-05.

Subprocessors (receive personal data server-side)

Provider	Purpose	Personal data	DPA signed	Transfer mechanism
Vercel Inc.	Hosting, logs, cron	All traffic, IPs	[ ]	[DPF / SCCs — verify]
Neon Inc.	PostgreSQL	All stored user data	[ ]	[verify region + mechanism]
Cloudflare Inc.	R2 object storage for uploads (S3-compatible API, not AWS)	Photos, GPX files	[ ]	[DPF / SCCs]
Upstash Inc.	Redis rate limiting, QStash jobs	Emails + IPs as TTL'd keys; job payloads	[ ]	[verify]
Groq Inc.	AI inference (user-invoked only)	Trip summaries (title, location, dates, route stats, forecast, gear names)	[ ]	[verify — no EU DPF certification as of drafting; SCCs needed]
Google LLC	OAuth sign-in	Google profile (email, name, photo)	n/a (independent controller for the Google side)	DPF
Resend Inc.	Magic-link and transactional email	Email addresses	[ ]	[DPF / SCCs — verify]

Browser-side services (receive IP + queried coordinates, no account identity)

Mapbox (map rendering; sends an anonymized map-load telemetry beacon to events.mapbox.com — required usage metering, not a disableable tracker), Open-Meteo (weather, elevation — CC BY 4.0 data), OpenStreetMap Nominatim (geocoding — usage policy requires attribution, ≤1 req/s, and a valid User-Agent/Referer: verify compliance), Overpass API (overpass-api.de, primary; overpass.private.coffee as a last-resort fallback added D158 — Private.coffee is a self-described EU privacy non-profit, but its DPA status and exact jurisdiction are unconfirmed: verify before relying on it as a stated compliance position; mirror maps.mail.ru (VK, Russia) flagged for removal — GDPR transfer problem — curator-only tool, never sees user trip data, tracked in compliance-audit.md), Waymarked Trails, OpenFreeMap, Esri/ArcGIS World Imagery & Topo (verify free-tier terms permit this use), AWS Terrain Tiles (open data), US NPS API, Recreation.gov RIDB, Parks Canada, BC Parks.

Required attributions

These are license obligations, not courtesies. They must appear on or near the map UI (short form) and on this page (full form):

© Mapbox © OpenStreetMap — required by Mapbox ToS wherever Mapbox tiles render, with the "Improve this map" link where required. Confirmed present in code: both map components (trail-map.tsx, route-intelligence-map.tsx) add Mapbox's own AttributionControl to every map instance.
© OpenStreetMap contributors, ODbL 1.0 — required for all OSM-derived data: Overpass trail data, Nominatim geocoding, Waymarked Trails overlays, OpenFreeMap tiles. Far's route-over-trail data may constitute a derivative database; if Far ever redistributes corrected/derived trail data publicly, ODbL share-alike applies — [counsel review before that feature].
Powered by Esri — attribution per Esri terms for World Imagery / World Topo tiles. [Verify exact required string.]
Weather data by Open-Meteo.com (CC BY 4.0).
Terrain tiles: Mapzen/AWS Open Data terrain tiles attribution (multiple upstream sources: USGS, NASA, etc. — use the canonical Tilezen attribution block).
Waymarked Trails (hiking overlay) — CC BY-SA styling/data attribution.
US NPS / Recreation.gov / Parks Canada / BC Parks — public data; cite source and "not an official source; verify with the land manager" per API terms. [Verify NPS API terms require attribution text.]

Open-source software notice

Far is built on open-source software (Next.js, React, Prisma, MapLibre GL, Mapbox GL JS, Radix UI, and others). Licenses: generate a NOTICE page from package.json ([license-checker] output) at [/legal/open-source]. MapLibre is BSD-3; Mapbox GL JS v2+ is under the proprietary Mapbox ToS — its presence requires a Mapbox account and token in compliant use.

Process

Adding a subprocessor requires: DPA signed, transfer mechanism confirmed, row added here, and — for EU users under a signed customer DPA, if Far ever sells B2B — [30] days' advance notice. Update the "Last updated" date on every change: Last updated 2026-07-24.