fungi.computer Subprocessors
Draft correction to the October 25, 2026 list; not a new subprocessor enrollment or publication decision.
Summary
We don’t run every part of Fungi ourselves. Some companies do jobs for us, like hosting, AI models, payments and email. To do those jobs, they handle some of your information. This page lists who they are, what they do, what they see and where they are.
What’s a subprocessor?
It’s a company that handles personal information for us, on our instructions, so we can run Fungi. For example, Hetzner rents servers for the Fungi service. Different stores and providers hold different parts of your data; no one provider entry is a complete inventory of every copy.
Will we tell you when this list changes?
Yes. We’ll update this page at least 30 days before we add a new subprocessor that receives your content. If you’d like an email when that happens, write to privacy@fungi.computer and we’ll add you to the notice list.
Who are they?
| Subprocessor | What it does for us | What it sees | Where | Terms and data processing |
|---|---|---|---|---|
| Hetzner Online GmbH | Rents servers for the Fungi service; we run the service software | Service records and files stored on those hosts; other providers hold separate copies | Operator-managed deployment; a single storage region for all data is not verified here | Hetzner terms |
| Cloudflare, Inc. | The network in front of Fungi: DNS, secure connections, and a private tunnel to our servers. Hosts the website fungi.computer and its launch list (Workers, Workers KV, Durable Objects). For the Fungi service it sends email (Email Service), checks for bots at sign-up (Turnstile), runs the web browsers Agents use (Browser Rendering), stores App source code (Artifacts), resizes images (Images), generates images (Workers AI, running models from Black Forest Labs and Leonardo on Cloudflare’s own network), routes model requests to our AI model providers (AI Gateway), and can store encrypted off-site backups when those jobs are enabled (R2) | Requests to Fungi as they pass its network, including IP address and browser details, emails we send, App source code, the web pages Agents browse, image prompts and images. The off-site copy job encrypts before upload; this does not establish that every backup is encrypted or that the jobs have run | United States, and Cloudflare’s global network | Cloudflare DPA |
| OpenAI, L.L.C. | Runs the GPT-6 Luna and GPT-6 Sol models behind Agents and the Fungi API, and the GPT Image 2 image model, reached through Cloudflare AI Gateway | Prompts, Agent conversations, the files and code an Agent reads, image prompts, and the model’s answers | United States | OpenAI API data controls: no training by default unless opted in. Abuse-monitoring logs and application state have different rules and exceptions; 30 days is not a universal deletion deadline |
| Moonshot AI | Runs the Kimi K3 model behind Agents and the Fungi API, reached through Cloudflare AI Gateway | Prompts, Agent conversations, the files and code an Agent reads, and the model’s answers | China | Moonshot AI’s terms. They don’t promise it won’t use this data to improve its models, so assume it may |
| Google LLC, ByteDance and MiniMax | Run the video models Agents can use (Veo 3.1, Seedance 2.0 and MiniMax H3 Max), reached through Cloudflare AI Gateway | Video prompts and any images given to the model, and the videos it makes | We haven’t confirmed where each provider processes these requests | Each provider’s terms, through Cloudflare AI Gateway. We haven’t confirmed whether they use this data to improve their models, so assume they may |
| Stripe, Inc. | Payments, subscriptions and receipts | The card and billing details you type in at checkout, and an internal Team ID | United States and others | Stripe DPA |
| Google Analytics | Optional page-visit analytics on fungi.computer, only after Accept | Fixed page address and title, browser information, IP address and cookie identifiers. No form values or email addresses | Processing is not restricted to the EU by this website | Google Analytics data processing terms |
| PostHog | Optional analytics on fungi.computer through the configured eu.i.posthog.com endpoint; off unless you choose Accept |
Page visits, sign-up acknowledgements and a random browser identifier. Requests reveal an IP address; server-side IP discard is not verified. Our event payloads do not include your email address | We have not confirmed every country where PostHog processes or stores this data. | PostHog DPA |
| Cloudflare Email Routing | Receives email sent to our fungi.computer addresses and forwards it to our inbox | Whatever you send us | United States | cloudflare.com/privacypolicy |
| Fastmail | Hosts the inbox where that email lands | Whatever you send us | United States and Australia | fastmail.com/about/privacy |
The public website chat uses the Fungi service and model providers described above. Chat prompts may be sent through Cloudflare AI Gateway to OpenAI or Moonshot AI, as described in their entries above.
What about GitHub and other services you connect?
When you sign in with GitHub or connect a GitHub repository, GitHub handles that under your own agreement with GitHub. The same goes for an AI provider whose API key you add yourself: your Agents’ requests go to that provider under your own agreement with it. Services you connect aren’t our subprocessors, so they aren’t listed here.