Privacy Policy

Atlaria ("we", "us") is the data controller for the personal data described in this policy. For any privacy question or to exercise your rights, contact msidhu861@gmail.com.

When you create an account we store your email address and whatever profile fields you choose to fill in (username, display name, bio, avatar, location, privacy preference). We also record that you confirmed you meet the minimum age and accepted these terms.

When you log a trip we store the photos you upload, the locations and dates you attach to an album, and any captions or descriptions you add.

Photo location data: photos often contain hidden GPS coordinates and other camera metadata (EXIF). To protect you, we re-encode every photo as it is uploaded, which removes embedded GPS/EXIF metadata so it is not stored in the image other people can view or download. The location shown on your map comes only from the place you choose for an album, never from a photo’s hidden data. Photos uploaded before this protection existed may still hold coordinates in our database; you can remove them via Settings or by emailing us.

When you paste a link (for example a TikTok or Google Maps link to save a place), we send the contents of that link to an AI provider (Anthropic) to work out the place details, which you then review before saving.

We collect minimal device information (browser, OS, approximate region inferred from IP) to keep the service running, detect abuse, and debug errors. We do not use third-party ad trackers.

• To run the product — show your albums, render your globe, power search and discovery.
• To deliver social features — show your public albums to people you allow, deliver follow notifications and transactional emails.
• To power optional AI features — read a link you paste to suggest a place, or generate a trip plan you ask for.
• To improve the product — aggregate, anonymised usage metrics (never sold or shared with advertisers).
• To keep the service safe — detect spam, respond to abuse reports, enforce our Terms.

We do not sell your personal data. We do not train AI models on your photos or content.

Under the UK GDPR and EU GDPR we rely on:

• Contract — to create and run your account and deliver the features you ask for.
• Legitimate interests — to keep the service secure, prevent abuse, monitor errors, and understand aggregate usage (balanced against your rights).
• Consent — for non-essential analytics and session replay, which stay off until you opt in. You can withdraw consent at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

Every album has a visibility setting you control: Public (anyone), Friends (people you follow mutually), or Private (only you). You can change it any time.

Your globe, passport, and stats visibility mirror the visibility of the albums that feed into them. Other travelers see trip timing as a season and year, never your exact travel day or month.

We use privacy-friendly, cookieless product analytics (Vercel Web Analytics), optionally Google Analytics 4 (with IP anonymisation and ad-personalisation signals turned off, on the website only — not the mobile app), and Sentry for error monitoring so we can fix crashes. Sentry may record a limited session replay to reproduce bugs — text is masked and images/media are blocked.

Where required (e.g. in the EU/UK), analytics and session-replay are off until you consent via the cookie banner, and you can change your choice any time. We use only essential cookies/local storage (your session, theme, and consent choice) without asking. See our Cookie Policy for details.

We share personal data with these processors only as needed to run the service:

• Supabase — database, file storage, authentication.
• Vercel — hosting, edge delivery, and cookieless analytics.
• Google Analytics — aggregate website analytics (consent-gated, web only).
• Sentry — error and performance monitoring.
• Resend — sending transactional emails (e.g. notifications, account emails).
• Anthropic (Claude) — reading a link you paste to extract place details (only when you use that feature).
• Groq — generating an AI trip plan when you request one.
• OpenWeather — weather forecasts for trip planning (we send coordinates and dates, not your identity).
• OpenStreetMap / Nominatim — reverse geocoding (we never send your identity with these requests).
• TikTok / Google Maps — when you paste one of their links, we fetch its public details to read the place.
• Google / Discord / Apple — only when you choose SSO, for sign-in only.
• Mapbox — map tiles, if enabled.

Some of these providers process data outside the UK and EEA (for example in the United States). Where that happens, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses — to protect your data. You can ask us for details of the safeguards in place.

• Access & portability — download your data from Settings → Export your data as a machine-readable JSON file.
• Deletion — Settings → Delete Account removes your account; data is purged within 30 days (see Retention).
• Rectification — edit your profile, albums, and captions any time.
• Objection / restriction / withdraw consent — contact us and we will comply with UK GDPR, EU GDPR, and CCPA requests within 30 days.

If you are in the UK, you also have the right to complain to the Information Commissioner’s Office (ICO). In the EEA, you may complain to your local data protection authority.

Atlaria is an adults-only service. You must be 18 or older to create an account or use it. We ask for your date of birth at sign-up to confirm this and record that you confirmed you are 18+. The service is not directed at children, and we do not knowingly collect personal data from anyone under 18. If we learn that an account holder is under 18, we will close the account and delete their data.

We keep your data as long as your account exists. Deleted accounts are purged from production within 30 days; database backups may retain encrypted copies for up to 90 days before being overwritten. Error logs and aggregate analytics are retained only as long as needed for those purposes.

Questions about this policy or a privacy request? Email msidhu861@gmail.com.