Privacy Policy

Last updated: September 20, 2026.

1. Who we are

Atlas ("Atlas", "we", "us") is a location-based adventure storytelling platform available at onatlas.world and through the Atlas mobile app (together, the "Service"). The Service is operated by Atlas Stories Inc., a federal corporation under the Canada Business Corporations Act, with its registered address at 24 Mont-Royal West, #905, Montreal, QC H2T 2S2. We are the "controller" (or "organization") responsible for your personal information under this policy.

Our person in charge of the protection of personal information (privacy officer) is the Founder of Atlas Stories Inc. You can reach them at [email protected].

This policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to the website, the mobile app, and any email or notification we send you. Our Cookie Policy, Community Guidelines, Security page, and account deletion instructions are part of how we handle your data and are referenced below.

2. What we collect

2.1 Information you give us

• Account details. Your name, email address, a username, and an optional bio and profile photo. If you sign up with Google or Apple, we receive your name, email address (Apple may give us a private relay address if you choose "Hide My Email"), and, for Google, your profile picture. If you sign up with an email address and password, we store your password only as a salted bcrypt hash and never in plain text.
• Security settings. Whether you have enabled two-factor authentication (delivered by email code), your notification and privacy preferences, and the one-time verification codes we email you (which expire).
• Content you create. Stories, chapters, captions, titles, descriptions, tags, comments, likes, saved stories, map markers, and the photos and videos you upload (including audio in videos). Photos and videos you upload may contain embedded metadata (EXIF), including the date, camera details and, if your camera stored it, the GPS location where the photo or video was taken. We read that metadata when you upload so we can place your media on the map and sort it by date. You can strip EXIF data before uploading if you prefer.
• Social connections. Friend requests, friendships, collaborators you add to stories, people you tag, people you block, and reports you file.
• Media folders. Folders you create and the people you invite to share them.
• Messages to us. Anything you send to our support or privacy addresses, and feedback you submit through the in-app feedback form.

2.2 Location and movement data

Location is the core of Atlas, and it is also the most sensitive thing you give us. We collect it in these ways, and only when you choose to use the feature:

• GPS recording (mobile). When you start recording an adventure, the app collects your precise location (latitude, longitude, altitude, accuracy, speed and heading) at frequent intervals, including in the background while the app is closed or your phone is locked, until you stop the recording. Recording uses the "Always" location permission on iOS and the background location permission on Android. Points are stored on your device and synced to our servers while you record. You choose a recording profile (for example "high" or "endurance") that controls how often we sample.
• Motion and activity. While recording, the app uses your phone's motion sensors to detect whether you are stationary or moving so that it can save battery. We do not store raw motion-sensor data on our servers; we may store the resulting activity classification with the track.
• Recording diagnostics. To debug GPS problems we store technical diagnostics about the recording session (for example sample counts, gaps, battery-saving events). These are attached to your track and visible to our engineers, not to other users.
• Locations in your content. The coordinates of the stories, chapters and map markers you place, the map camera position you save with a chapter, and the location metadata from uploaded media described above.
• Location searches. When you search for a place while creating a route or a story, we keep your three most recent searches (name and coordinates) so you can reuse them. Older ones are deleted automatically.
• Strava import. If you connect your Strava account (optional), we import the activities you choose — including the GPS track, distance, time and activity type — and store them as Atlas tracks. See section 6.

You can revoke the location permission at any time in your phone's settings. Doing so stops GPS recording and "use my location" map features from working, but does not delete tracks or media you already saved. Location may also be read when you explicitly tap "my location" on a map, when you place a story or chapter pin, or as a fallback geotag when uploading photos that lack EXIF GPS — those uses require the When In Use permission and are not background tracking.

2.3 Information we collect automatically

• Security and access logs. When you sign in or use the Service, our servers record your IP address, the page or API endpoint requested, the request method and result, the time, your browser or app user agent, and your account identifier. We use these to detect abuse, rate-limit attacks, investigate security incidents and show you your recent login activity. We may email you when we see a sign-in from a new device or location (you can turn these alerts off in Settings, except for two-factor codes, which always send).
• Activity on the Service. When you are signed in and open a story, we record that you viewed it (one record per story per 30 minutes). We use these records only in aggregate — for example, how many people viewed stories this week — to understand how Atlas is used. We do not show story owners who viewed their story, and we do not use this data for advertising or profiling.
• Last active. The last time you used Atlas on web, iOS or Android.
• Device and push tokens. If you enable push notifications, we store the token your device gives us, the platform, and when it was last updated.
• Crash reports and diagnostics. The website and app send error reports and performance measurements to Sentry, our error-monitoring provider. Personal fields (email addresses, cookies, tokens, IP addresses) are scrubbed before sending, and we do not attach your account identity to mobile crash reports. Sentry may also record a session replay — a reconstruction of screens and interactions that we use to reproduce bugs. On the website this is off unless you accept analytics cookies (see our Cookie Policy), and then applies to about 5% of sessions plus any session with an error. In the mobile app it applies to about 10% of sessions plus any session with an error; text, images and inputs are masked in mobile replays.
• Cookies and local storage. Described in our Cookie Policy. We do not use advertising cookies or cross-site tracking.

2.4 What we do not collect

We do not collect payment information (Atlas is free), your phone contacts, your health data from Apple Health or Google Fit, advertising identifiers (IDFA/GAID), or any of the special categories such as racial or ethnic origin, health, religion, or sexual orientation — unless you choose to write about them in your own content. We do not use facial recognition. We do not use artificial-intelligence services to analyze your content and do not send your data to any AI provider.

3. How we use your information and on what legal basis

Where the GDPR or UK GDPR applies, we rely on the legal basis shown in the right-hand column. Elsewhere, we collect and use personal information with your knowledge and consent for the purposes below, as required by Canada's PIPEDA and Quebec's private-sector privacy law.

We do not make decisions about you using solely automated processing, and we do not profile you.

3.1 Account approval

Atlas is currently a curated community. When you create an account, a member of our team reviews it manually before you can use the Service, and receives an email with your name, email address and sign-in method to do so. We do not use any automated scoring in that review. If we decline an account we delete it on request.

4. Who can see your content

You control the visibility of each story:

• Public — visible to anyone on the internet, including people who are not signed in, and eligible to appear on the Atlas homepage, the Explore map and in search. Photos and videos in public stories are served from a public content-delivery network. We may feature public stories on our website and in our own marketing; we will not feature a story that is not public.
• Friends — visible only to your confirmed friends.
• Private — visible only to you and to collaborators you have added.

Some things are shared regardless of story privacy: your profile (name, username, photo, bio) is visible to signed-in users so they can find and add you; comments you leave are visible to whoever can see that story; chapters you write on someone else's story are controlled by that story's owner; and members of a shared media folder can see the media in it. If you block someone, neither of you can see the other's content or profile. Once a story has been public, copies may exist outside Atlas (screenshots, caches, search engines) that we cannot recall.

5. Who we share your information with

We do not sell your personal information, and we do not share it with anyone for advertising. We share it only as follows.

5.1 Service providers (processors)

These companies process data on our behalf, under contracts that require them to protect it to the same standard described in this policy and only for the purposes we instruct.

5.2 Other users

As described in section 4, according to the privacy settings you choose.

5.3 Legal and safety

We may disclose information if we believe it is required by law, a court order or a lawful government request; to enforce our Terms and Community Guidelines; to protect the rights, property or safety of Atlas, our users or the public; or in connection with a report of content that sexualizes or endangers a minor, which we report to the relevant authorities.

5.4 Business transfers

If Atlas is acquired, merged or sells substantially all of its assets, your information may be transferred to the new owner, who will be bound by this policy until it is changed with notice to you.

6. Strava

Connecting Strava is optional. When you connect, you authorize us to read your Strava profile and activities (scope: read, activity:read_all). We import only the activities you choose, store them as Atlas tracks, and show your Strava data only to you unless you put it in a story. We keep your Strava authorization tokens in our encrypted database and delete them when you delete your account; when you disconnect, the connection is deactivated and the tokens are no longer used. When you disconnect, you can choose whether to keep or delete the tracks you imported; if you keep them, they remain ordinary Atlas tracks under your control. Your use of Strava is governed by Strava's privacy policy.

7. International transfers

We are based in Canada. Your information is stored with the providers listed in section 5 in Canada (application and database), the United States (media, email, push, maps, sign-in) and Germany (error monitoring). This means your personal information may be stored and processed outside the province or country you live in, including outside Quebec and outside the European Economic Area and the United Kingdom, in places whose privacy laws may differ from yours. Where we transfer data from the EEA or UK to Canada, we rely on the European Commission's and UK's adequacy decisions for Canada; for transfers to the United States we rely on the providers' Standard Contractual Clauses (and, where they are certified, the EU-US Data Privacy Framework). We assess each transfer to ensure the data receives adequate protection, as required by Quebec law.

8. How long we keep your information

9. Your rights and choices

Wherever you live, you can:

• Access and export your data. Privacy & Security → Export my data emails you a download link (usually within 24 hours) to a machine-readable file containing your profile, stories, chapters, tracks, media metadata, social connections and settings. Media files themselves are not in the bundle but remain downloadable from the app while your account exists.
• Correct your profile and content at any time in the app.
• Deactivate your account (Privacy & Security). Your content is hidden from others until you sign in again.
• Delete your account and everything in it (Privacy & Security → Delete account, or see these instructions if you cannot sign in).
• Control visibility per story, set a default privacy level, and block users.
• Control location by not starting a recording, by revoking the location permission in your phone settings, and by removing location metadata from photos before uploading.
• Control communications: every notification type has a switch in Settings; marketing email is off unless you turn it on (we do not currently send any), and every marketing email will carry an unsubscribe link. Security messages (verification and two-factor codes) cannot be disabled while the feature is on.
• Disconnect Strava from Settings, or from your Strava account's "My Apps" page.
• Manage cookies through the banner or the "Cookie preferences" link in the footer.
• Review recent sign-ins under Privacy & Security → Login activity.

Depending on where you live, you may also have the right to object to or restrict certain processing, to withdraw consent (which does not affect processing already done), to data portability, to de-indexing of your personal information, and to lodge a complaint with a supervisory authority. To exercise any right that is not available in the app, email [email protected] from the address on your account. We may ask you to verify your identity. We respond within 30 days (one month in the EEA/UK, 45 days in California) and do not charge a fee unless a request is manifestly unfounded or excessive. We will not discriminate against you for exercising your rights.

9.1 Canada (PIPEDA and provincial laws)

You may ask what personal information we hold about you, how it is used and to whom it has been disclosed, and challenge its accuracy. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada. Quebec residents may also complain to the Commission d'accès à l'information and have the right to request that we stop disseminating their personal information or de-index it. The technologies we use to locate you — GPS recording while you track, and When In Use reads for map centering, pin placement and photo geotag fallback — are described in section 2.2.

9.2 European Economic Area and United Kingdom

You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR/UK GDPR, and the right to withdraw consent. You may complain to your local data-protection authority or, in the UK, the Information Commissioner's Office. We have not appointed an EU or UK representative under Article 27 because our processing of EEA/UK residents' data is occasional and we do not currently target those markets; contact the privacy officer above.

9.3 California and other US states

We do not sell personal information and do not "share" it for cross-context behavioural advertising, and have not done so in the preceding 12 months, so there is no opt-out to offer. Precise geolocation is "sensitive personal information" under California law; we use it only to provide the features you request, and not to infer characteristics about you. California residents have the rights to know, delete, correct and to non-discrimination, exercisable as described above or through an authorized agent with written permission. Atlas is currently below the thresholds at which the California Consumer Privacy Act applies; we honour these rights voluntarily.

10. Children

Atlas is not directed at children. You must be at least 16 years old to create an account (Atlas requires 16 everywhere for simplicity; EEA default consent age is 16, Quebec requires 14 or parental consent). We do not knowingly collect personal information from anyone under those ages. If you believe a child has created an account, email [email protected] and we will delete it promptly.

11. Security

We protect your information with encryption in transit (TLS 1.2+) and at rest, hashed passwords, least-privilege access for our team, rate limiting, audit logs of administrative actions, and encrypted backups. Full details are on our Security page. No system is perfectly secure; if we learn of a breach that creates a real risk of significant harm to you, we will notify you and the relevant authorities without unreasonable delay — our target is within 72 hours of confirming the incident — and tell you what happened and what we are doing about it.

12. Changes to this policy

We may update this policy as Atlas changes. We will post the new version here with a new "Last updated" date and keep prior versions available on request. If a change materially reduces your rights or expands how we use your information, we will notify you by email or in the app at least 30 days before it takes effect and, where the law requires, ask for your consent.

13. Contact

Privacy questions and requests: [email protected]
Person in charge of the protection of personal information: the Founder, Atlas Stories Inc.
Postal address: 24 Mont-Royal West, #905, Montreal, QC H2T 2S2
Everything else: [email protected]