Privacy policy

Atlas X AI Pty Ltd (“we”) runs Atlas Vault and this website. This policy covers both. Questions and requests go to contact@atlas-ai.au.

This website

This site sets no cookies of its own and uses no analytics or tracking pixels. It is hosted on Vercel and runs in Vercel’s Sydney region (syd1). Vercel receives standard request details such as your IP address in order to serve pages and protect the site.

Early-access requests

• What we store: your email address, the use you chose (recorded as “both” if you skip that question), your consent to be emailed and the time of the request.
• Why: to invite you to the beta and to email you about early access. Nothing else.
• Where: in a database hosted by Supabase in Singapore (ap-southeast-1). The database is part of a Supabase project we also use for another of our products (atlas-cloud-platform), in a separate schema of its own. We also get a short notice in a private Discord channel with the use you chose and a masked email address (for example j***@e***.com).
• Bot check: the form uses Cloudflare Turnstile to check that a person is sending it. It loads when you start filling in the form: you type in it, click or tap into the email field, choose a use or tick the box. It does not load when the page opens, or when you scroll or tab past the form. Cloudflare then processes your IP address and browser details for that check.
• Abuse limit: to stop repeated requests, we store a keyed hash (HMAC-SHA256) of your IP address, not the address. We have the key, so the hash keeps your address from others, not from us. Once it is ten minutes old, it is deleted the next time anyone uses the form. Supabase’s own backups of the database may keep it longer.
• How long: until the beta ends, or until you ask us to remove it, whichever comes first. We remove an entry by hand; Supabase’s own backups of the database may keep it for a while after that.

Services that handle your request

Beta accounts

If you are invited and create an account, your vault is encrypted on your device. We store it as ciphertext and can’t read it. To run the service we store and can see:

• your email address;
• the names and types of your devices, and when each last connected;
• how many items you have, their encrypted sizes and when they change;
• a record of account and sync events, without any vault content;
• your IP address when a device connects, which we use to limit abuse.

Your encrypted vault and these details are kept by a service we run for the beta on a machine we operate in Perth, Australia. It has its own data and keys, but it is not a dedicated host. The server’s request logs record each request’s path and may record your IP address; they are kept on that machine and have no fixed retention period yet.

Traffic to it passes through Cloudflare, which ends the encrypted connection before passing it on. Cloudflare can see request details, your sign-in proof and session tokens, and the encrypted vault data, but not your vault contents.

Your choices

You can ask to see or correct your details at any time by emailing contact@atlas-ai.au from the address you used. To leave the early-access list, ask us and we’ll delete your entry by hand.

Accounts can’t be deleted from an app yet. During the beta, ask us and we’ll delete yours from the beta server: we sign out your devices and assistants, delete your encrypted vaults and remove your email address from your account. We keep ids, dates, usage counts and an activity log, with no email address and nothing from inside your vault. Copies of your encrypted vault on your own devices are yours to remove.

We keep the newest 14 nightly backups of the beta server, on the same machine, so a deleted account’s data leaves the backups once 14 newer ones have been made.

Changes

We will update the date above when this policy changes.