Privacy Policy

Last updated 26 July 2026

Atlas is a personal life-management app operated by Riley Hinsperger. This page describes exactly what it stores, who else can see it, and how to get it back or delete it. It is written to be read, not to be survived.

What Atlas stores

Only what you put in, plus what is needed to keep you signed in:

• Your account — email address, a password hash (scrypt; the password itself is never stored or recoverable), display name and timezone.
• Your content — tasks, calendar events, habits and check-ins, journal entries, notes, workouts, and any financial accounts or transactions you add or import.
• Activity — a timeline of changes you make, used to give the assistant recent context, and a record of AI token usage so spending can be capped.
• Connection credentials — API keys and OAuth tokens for services you choose to connect. These are encrypted at rest with AES-256-GCM under a key held only by the server.

Atlas sets a single cookie: an httpOnly session cookie. There is no advertising, no analytics, no tracking pixels, and no third-party scripts on any page.

Who else sees your data

Atlas does not sell your data and does not share it for advertising. It is processed by a small number of services, each doing one job:

• DeepSeek (AI provider) — this is the important one. When you use any AI feature, Atlas sends a compact summary of your relevant data (recent activity, upcoming items, counts and your typical schedule) so the model can answer usefully. Do not put anything in Atlas you would not want processed by an AI provider. AI features only run when you supply your own API key, so nothing is sent until you connect one.
• Neon — hosts the PostgreSQL database your data lives in.
• Cloudflare — DNS and the encrypted tunnel that serves the site.
• Google — only if you connect Google Calendar. Atlas reads and writes calendar events on your behalf and stores nothing from your Google account beyond the tokens and the events themselves.
• Plaid — only if you connect a bank. Plaid holds the bank credentials; Atlas never sees them and stores only the resulting account and transaction records.

Where it is held

Data is stored in the database region configured for the deployment and served through Cloudflare's global network. If you are outside that region, your data is transferred and processed there.

How long it is kept

Your content is kept until you delete it or delete your account. Deleting your account removes your account row and everything linked to it, including connection credentials. Deletion is immediate and cannot be undone. Backups, where they exist, roll off within 30 days.

Your rights

• Export — Settings gives you a complete JSON export of everything Atlas holds about you, at any time, without asking anyone.
• Deletion — Settings also deletes your account outright.
• Correction and access — every screen that shows your data lets you edit it. If you want something Atlas does not expose, email [email protected].
• Depending on where you live, you may have further rights under the GDPR, PIPEDA or similar law — including objecting to processing or complaining to a regulator.

Security, honestly stated

Passwords are hashed with scrypt and never stored in plain text. Connection credentials are encrypted at rest. Traffic is HTTPS end to end, and the session cookie is httpOnly, Secure and SameSite=Lax. Every query is scoped to the signed-in account.

Atlas is early-access software run by one person. It has not had an independent security audit. Please do not store anything here whose disclosure would seriously harm you.

Children

Atlas is not intended for anyone under 16, and accounts are not knowingly created for them.

Changes

If this policy changes materially, the date above changes and, where the change affects how your data is used, you will be told in the app before it takes effect.

Contact

Questions, requests or complaints: [email protected].