Subprocessors
Last updated: October 12, 2026
Kova uses the following vetted third-party service providers (“subprocessors”) to operate the Services. Each processes information on our behalf under its data-protection terms, limited to processing on our instructions. Kova data is stored and primarily processed in the United States; our CDN and edge-security provider (Cloudflare) may handle network traffic transiently at the globally distributed edge location nearest the request. We will post material additions to this list at least 14 days before they take effect; you may subscribe to changes by emailing privacy@flykova.com.
Apple, Inc.
Sign in with Apple, account identity; App Attest / DeviceCheck device-integrity checks
Reddit, Inc.
Reddit advertising pixel and Conversions API on flykova.com only (never in the iOS app): measures whether Reddit ads lead to visits and subscriptions. Opt-in: only visitors arriving from a Reddit ad are asked, and nothing loads or is sent unless they accept the site's cookie notice. Reddit is an independent controller for this data; change your choice in Privacy Policy §5.
Apple, Inc. (APNs, PassKit)
Push notifications, boarding-pass parsing
Apple, Inc. (App Store Connect / TestFlight)
When a beta invitation includes TestFlight delivery, the invited email address is transmitted to Apple to add it to our TestFlight beta group; Apple then sends its own invitation email. See Privacy Policy §2 and §4.
Functional Software, Inc. (Sentry)
Crash and error reporting (PII scrubbed)
Cloudflare, Inc.
CDN, DDoS protection, network
Vercel, Inc.
Hosts the flykova.com website (site analytics is first-party — measured by Kova's own systems, not by Vercel)
Self-managed infrastructure (Kova-operated)
Application servers, databases, caches
| Category | Provider | Purpose | Location | Policy |
|---|---|---|---|---|
| Authentication | Apple, Inc. | Sign in with Apple, account identity; App Attest / DeviceCheck device-integrity checks | United States | link |
| Payments | Stripe, Inc. | Web subscription billing | United States | link |
| Advertising measurement | Reddit, Inc. | Reddit advertising pixel and Conversions API on flykova.com only (never in the iOS app): measures whether Reddit ads lead to visits and subscriptions. Opt-in: only visitors arriving from a Reddit ad are asked, and nothing loads or is sent unless they accept the site's cookie notice. Reddit is an independent controller for this data; change your choice in Privacy Policy §5. | United States | link |
| Push & Wallet | Apple, Inc. (APNs, PassKit) | Push notifications, boarding-pass parsing | United States | link |
| Resend, Inc. | Transactional email delivery | United States | link | |
| Beta distribution | Apple, Inc. (App Store Connect / TestFlight) | When a beta invitation includes TestFlight delivery, the invited email address is transmitted to Apple to add it to our TestFlight beta group; Apple then sends its own invitation email. See Privacy Policy §2 and §4. | United States | link |
| Diagnostics | Functional Software, Inc. (Sentry) | Crash and error reporting (PII scrubbed) | United States | link |
| Infrastructure | Cloudflare, Inc. | CDN, DDoS protection, network | United States (global edge) | link |
| Website hosting | Vercel, Inc. | Hosts the flykova.com website (site analytics is first-party — measured by Kova's own systems, not by Vercel) | United States (global edge) | link |
| Hosting | Self-managed infrastructure (Kova-operated) | Application servers, databases, caches | United States | link |
| Backup storage | Backblaze, Inc. | Encrypted off-site database/file backups | United States | link |
A note on aviation and other public data sources. Kova additionally queries public and commercial data feeds — flight schedules, positions and operational data, road routing between airports, government per-diem rates, and public event calendars. Those queries describe flights, airports, and cities, not users, and no personal information is transmitted to them. They are not subprocessors of personal data, so we do not list them above.
See the Privacy Policy for the categories of personal information handled, the purposes for processing, and your rights.