One Time Secret - Tool - by Alexandru Jungean
Infrastructure and Subprocessors
RomânăWho hosts the application and the database, where, and what each recipient can see.
Version 1.1.0 · Effective 22 August 2026
This page lists infrastructure recipients for One Time Secret - Tool - by Alexandru Jungean. It is the public subprocessor list for the Privacy Policy and the Data Processing Addendum. The Romanian text is at Infrastructură și împuterniciți.
The Operator does not sell secret rows and does not give advertising networks access to create or reveal traffic.
1. Current recipients
| Recipient | Role | Region | What they can see |
|---|---|---|---|
| Netlify, Inc. | application hosting, TLS termination, CDN, serverless runtime, operational logs | United States (controller/processor) with global edge points of presence | TLS and HTTP connection metadata, the request path for pages (reveal paths contain a public identifier only), application privacy logs (allowlist), static first-party assets. Not plaintext, not AES keys, not fragment values in a correctly used link (fragments are not sent to the server). |
| Supabase, Inc. (managed PostgreSQL on Amazon Web Services) | durable storage of the secret-row allowlist and hashed rate-limit buckets | eu-west-1 (Ireland, EEA) | The secret-row allowlist and hashed rate-limit buckets. Not plaintext, not raw proofs, not raw IP columns. Public database roles are denied by policy; the application uses an elevated server role. |
| Google LLC (Search Console) | DNS-only property verification and crawl of pages we mark indexable; no application script, tag, or analytics | United States | DNS verification records and crawls of pages we mark indexable (home and legal documents). Not reveal pages, not API bodies, not capability material. |
Policies: Netlify privacy, Supabase privacy, Google privacy.
2. Who is not a production subprocessor for secrets
- GitHub, if used for source control, does not receive live envelopes.
- There is no email provider in the create/reveal path. If you write to the contact address, your own mail systems and the Operator’s mailbox provider process that correspondence.
- There is no CDN font vendor, analytics vendor, captcha vendor, or error-tracking SaaS on create or reveal.
3. Changes
A material addition or replacement of a subprocessor will be published on this page before it processes new secret rows, except emergency security substitutions, which will be published as soon as possible. Professional customers under the DPA may object by emailing alex.jungean@gmail.com within 14 days; the only practical objection outcome for this free tool may be to stop using the Service, because we cannot run per-customer infrastructure.