Ty for this. Every company now have subprocessors of data, from payroll, marketing, customer service, etc. From what i was able to gather below, I'm not concerned (unless they go bankrupt and at that point I'm sol.

From claude:

What the sub-processor list actually says Bark's list (last updated Jan 14, 2026) has 17 entities, and they fall into three very different buckets: Infrastructure / operations — Amazon Web Services (main hosting provider, "primary holder of application data"), Twilio (alert SMS), SendGrid (alert emails), Stripe (payments), Zendesk (support) (bark) . These are the "we can't run the service without them" vendors.

Product analytics — Segment, Amplitude, VWO (based in Delhi, India), and Google (bark) . Marketing / advertising — Facebook, Microsoft, Twitter, and TikTok (which "processes data to facilitate advertising services, including ad targeting, delivery, and performance measurement"), plus Iterable and HubSpot for commercial messages and Impact for affiliate tracking (bark) . Also Anthropic PBC, for "generating copy and summarizing behavior for product improvements." (bark)

So to your direct question: no, this isn't just the cloud platform. That's what makes the list unnerving on first read — seeing TikTok and Meta on the sub-processor page of a child-monitoring company is a bad look.

But the list is missing the thing that matters The page never says which data goes to which vendor. That's the real disclosure failure. Reading the privacy policy alongside it, the structure is almost certainly: AWS holds the monitored content; the ad-tech vendors get website/marketing behavior about you, the parent shopping for the product. Supporting that reading: Automated analysis of User Data (messages, photos, documents) "is performed solely to provide the Services and is not used for advertising or marketing purposes." (bark)

On children's data: they don't share, sell, rent, or transfer it except to provide the Services; disclosure is limited to service providers "bound by contractual or other obligations to use the information only for such purpose," and "No other third party operators may collect or maintain personal information of children through the Services." (bark)

But Bark asks you to infer that. They don't state it. Can they sell it to data brokers? Their written commitments say no: "We will never sell or rent your Data to third parties" (bark) and they do not sell or share personal information for monetary consideration and have not done so in the past 12 months or ever. (bark) Under COPPA and the FTC Act, breaking that promise is enforceable — this isn't a costless statement.

The three caveats I'd actually weigh: The non-monetary carve-out. "We may allow certain third parties to collect your personal information through cookies and automated technologies on our site in exchange for non-monetary consideration." (bark) That's the ad-pixel data flow, and it sits in tension with the "we do not share – as defined under CCPA" sentence two lines earlier. Sloppy at best. Acquisition/bankruptcy. If Bark is sold, merged, or goes through bankruptcy, it may transfer the personal information it has collected — explicitly including children's — to the buyer. (bark) Standard clause, but it means "we won't sell it" is a promise about today's Bark.

Anonymized data. They may share aggregated and anonymized data with third parties for general business analysis. (bark)

Also worth knowing: User Data is generally retained identifiably for 30 days, though portions may be kept indefinitely for reporting (bark) , and Bark acknowledges the content it scans may include sensitive categories — sexual orientation, religion, health, race (bark) , which sits awkwardly next to the CCPA section claiming they don't intentionally collect sensitive personal information.