Privacy notice

About this notice

This notice describes how Atlas handles personal information on this website (beta.atlasai.ca), its waitlist, and the Atlas app at app.atlasai.ca, which is currently in invitation-only early access.

Your use of the Atlas app is also governed by our Terms of Use.

Information we collect

• When you join the waitlist: your email address, signup date and time, and a label recording that you joined through the landing page. We also assign a record ID to manage the entry.
• When you’re invited: the invited email address, the invitation date, which Atlas build your account uses (for example, Preview), and sometimes a short internal note about the invitation.
• Your account: your email address, an account ID, when the account was created, when you last signed in, and which version of the Terms of Use you agreed to in the app and when. If you sign in with Google, we also receive the details described under Signing in with Google.
• Signing in: to send and check sign-in links, we keep a short-lived record of each request: your email, a description of the requesting browser and system (for example “Chrome on macOS”), its status, and one-way coded versions (hashes) of the link and browser secrets. To limit abuse, we also log each request’s email address with a one-way hash of your network (IP) address.
• Sessions and security logs: while you’re signed in, our authentication provider keeps a session record that includes your IP address and browser information, and a log of account events such as sign-ins and sign-outs, which includes your IP address.
• Your workspace: your workspace name, courses, folders, notes and their saved revisions, files you upload (PDFs, images and photos, and text files) and previously uploaded PowerPoints, note images, and attachments. Files are stored exactly as you upload them: photos can include details saved by your camera or phone, such as where and when they were taken. When you copy a diagram from a file, Atlas also records its source file and page so you can return to it. Recordings and AI processing are not part of this release; we will update this notice before introducing them.
• When you visit: our hosting infrastructure processes technical information such as your IP address, browser information, requested pages, request times, and errors to deliver and protect the website and app.
• When you contact us: your email address and the information you choose to include, so we can respond.

We do not use advertising pixels, analytics tools, or tracking cookies. If we add tools to measure how Atlas is used, we will update this notice first. Technical processing by our service providers still takes place when you browse, submit a form, or sign in.

Cookies

The website itself doesn’t set cookies. The Atlas app uses only cookies it needs to work: session cookies that keep you signed in, a temporary cookie that ties a sign-in link to the browser that requested it, and a temporary security cookie during Google sign-in. Because these are essential to signing in, they can’t be turned off in Atlas. If you block them in your browser, you won’t be able to sign in.

Atlas also saves notes, opened files, images, viewing preferences, and pending uploads in your browser’s storage on this device. This helps preserve your work and lets you keep using opened material when the connection drops while Atlas is open. Opening Atlas from scratch without a connection is not supported in this release. Signing out removes cached files, except that unsent uploads or images may be kept to avoid deleting their only copy. Those unsent copies have not necessarily been erased when you sign out.

How we use it

• Waitlist: to manage your signup and send you emails about early access, launch, product news, and offers from Atlas. Every marketing email includes a way to unsubscribe.
• Accounts: to check that you’re invited, show the Atlas build your account uses, keep a record that you agreed to the Terms of Use, create and run your account and workspace, and keep you signed in.
• Your study material: to save and sync your notes, organize uploaded files, show files beside notes, and keep diagrams you copy into notes.
• Sign-in emails: to send you sign-in links. These are service messages, not marketing, and only go out when someone requests a link for your address.
• Security: to show the details of a sign-in request on your other device so you can confirm it was you, to limit repeated requests, and to detect and investigate misuse.
• Operations and support: to diagnose problems and answer your questions or requests.
• Improving Atlas: to understand how Atlas is used, fix problems, and plan features, using information such as which features are used, errors, and performance. Where we can, we use aggregated or de-identified information for this. We don’t use the contents of your notes, files, or recordings for this unless you share them with us to fix a problem.

We don’t sell your personal information or use it for other companies’ advertising.

Signing in with Google

If you choose “Continue with Google,” Google shares your name, email address, profile picture link, and Google account ID with Atlas, with your permission. We use them only to sign you in and identify your account. Atlas doesn’t receive your Google password and can’t access your Gmail, Drive, contacts, or calendar. We don’t transfer Google user data to others except the service providers that run Atlas, and we don’t use it for advertising. You can remove Atlas’s access at any time in your Google Account settings. Google’s handling of your information is described in the Google Privacy Policy.

Service providers and storage

• Supabase stores the waitlist, invitations, accounts, workspaces, notes and saved revisions, file and attachment records, and sign-in records, and provides sign-in and session management. Our database is configured in Canada and uses row-level security (RLS) on every public table, so information can only be reached by the people and systems allowed to see it.
• Cloudflare stores files and note images you add to Atlas in Cloudflare-secured servers. Files stay stored while you keep them in Atlas, including in Trash. Permanently deleting a file queues its stored copies for removal from Cloudflare servers. Pieces of a document, such as a screenshot, already copied into a note stay stored with that note even if the original file is deleted. Storage is private; Atlas checks account access before providing temporary download links.
• Vercel hosts the website and app and processes their requests.
• Resend sends waitlist emails, sign-in emails, and Atlas Preview invitations, so it processes your email address and the messages we send you.
• Google handles sign-in when you choose “Continue with Google.”

These providers process information to deliver their services to Atlas. Their infrastructure, support, or subprocessors may process information outside Canada, including in the United States, where different privacy laws apply and local authorities may be able to access it. A Canadian database location does not mean every part of the service runs in Canada.

Personal information may also be disclosed where required by law. If we add another provider or change how information is handled, we will update this notice before using that new arrangement.

How long we keep it

• Waitlist entries: until you unsubscribe or ask us to remove yours. If you unsubscribe, we keep a minimal record of your email address so we don’t email you again.
• Accounts and workspaces: while your account exists. If your early access ends, your account is kept so you can return, unless you ask us to delete it. If Atlas early access closes, we will tell you before deleting accounts.
• Notes and files: while you keep them in Atlas, including in Trash. Permanent deletion removes their live records and queues stored file copies for removal. Diagrams already copied into another note remain with that note.
• Removed note images: images removed from a note have a 30-day recovery grace period and count toward storage during that time. Images still referenced by a current note or an unexpired conflict safety copy are retained. Older unused images are queued for deletion by daily maintenance.
• Sign-in requests: deleted automatically about an hour after the link expires (links expire after 15 minutes). The request log used to limit abuse is deleted automatically after 24 hours.
• Sessions and security logs: sessions end when you sign out or they expire. Account event logs follow our authentication provider’s retention settings.

Technical logs and provider backups follow the applicable provider retention settings. Deleting live information does not necessarily remove every backup copy immediately. Aggregated or de-identified usage information may be kept after your account is deleted. Information may be retained where required by law, or for as long as needed to investigate security incidents or misuse. Contact us if you need more detail about retention or a deletion request.

Your choices and rights

You can browse without joining or signing in. You can unsubscribe from marketing emails at any time using the link in the email. To leave the waitlist, close your account, request a copy of your information, correct it, request deletion, or withdraw your consent, email people@atlasai.ca. You can also use that address to ask a privacy question or raise a concern. We aim to respond within 30 days.

Where possible, write from the address you used with Atlas. We may ask for enough information to verify your request and protect it from unauthorized changes. We will explain if a legal requirement limits what we can provide or remove. Withdrawing consent for information Atlas needs to run your account means we can’t keep providing it.

If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada, or the privacy regulator where you live, such as Quebec’s Commission d’accès à l’information.

How we protect it

The website and app use HTTPS. Sign-in links work once and expire after 15 minutes, and we store only one-way hashes of link and browser secrets. Sign-in cookies can’t be read by page scripts. Each workspace can be read only by its own signed-in owner, and removing an invitation signs that account out everywhere. The public waitlist connection can add entries but can’t read, change, or delete them.

No online service can guarantee absolute security. If a breach of security safeguards involving your information creates a real risk of significant harm, we will notify you and the appropriate regulator as required by law. Please don’t include passwords, sensitive course materials, or recordings in a privacy inquiry.

Age

Atlas is for students aged 16 and older. We don’t knowingly create accounts for anyone younger. If you believe a younger person has given us their information, contact us and we will delete it.

Changes to this notice

We will update this page and its date when our practices change. For a significant change, we will provide an appropriate notice, such as an email to account holders, and ask for consent where required.

Contact Atlas

Atlas’s Privacy Officer is responsible for how Atlas handles personal information. For privacy questions and requests, contact: