How Atlas handles your data

Atlas is a private reference for invited readers. Its owner is responsible for the personal data below. Questions and requests: nilsson_david@live.se.

What is kept

• Your e-mail address, who invited you and when, and your role (reader or admin).
• When you last signed in, and your active sessions: when each began, and the browser and network address it came from.
• The public part of any passkey you add. Your fingerprint or face never leaves your device.
• Sign-in codes, stored only in scrambled (hashed) form, for five minutes.
• An audit log of account events, such as sign-ins, failed codes and changes to invitations. It holds your e-mail address, never codes or passwords.
• Suggestions you send: the page they are about, your text, any source link, and the owner's answer.

There are no trackers, no advertising and no third-party fonts. The only cookie is the one that keeps you signed in.

Why

To let invited readers in, keep everyone else out, find misuse, and improve Atlas from readers' suggestions. The legal basis is legitimate interest (GDPR article 6(1)(f)).

How long

• A session ends after 7 days without use, and always 30 days after sign-in.
• Audit log entries are deleted after 90 days. Backups are deleted after 30 days.
• An unused invitation lapses after 30 days. Accounts not used for 12 months are closed.
• Your account is kept until you delete it, or until your invitation is withdrawn.
• Suggestions are kept while your account exists, and deleted with it.

Where

The database and the app run in Frankfurt, in the EU. A hosting service, a database service and an e-mail service process the data for Atlas under data processing agreements. Where one of them handles data outside the EU, it does so under the safeguards the GDPR requires.

Your rights

You can see your sessions and passkeys, end them, and delete your account and its data at any time on your account page. You can also ask for a copy of your data, a correction, or object to the processing at the address above. If you are not satisfied, you can complain to the Swedish Authority for Privacy Protection (IMY).