Application hosting
Provider is selected through deployment configuration and cannot be verified from the repository.
Database and Redis
PostgreSQL and Redis-compatible services may process account, education, session and security data. Providers and regions are not supplied.
The email backend is environment-configured. The production provider, region, retention and contract are not supplied.
Cloudflare Turnstile
Where enabled, an anti-bot token and limited request context are sent to Cloudflare for public-form abuse prevention. Contract and transfer review remains required.
jsDelivr / Pyodide
Coding activities load Pyodide from cdn.jsdelivr.net. The browser contacts that CDN; no CodeQuest account identifier is deliberately added to the request.
Source control
GitHub may hold source code, but production personal data must not be committed. Whether it is a subprocessor depends on operational use.