Privacy Policy

Atlas is a language-learning app operated by Kate Saville ("Atlas", "we", "us"), based in the United Kingdom. This policy explains what information we collect when you use the Atlas iOS app and our website, why we collect it, and the rights you have over it.

The short version: we collect the minimum needed to run your account and remember your learning progress. Atlas itself contains no advertising, analytics or crash-reporting SDKs and no tracking, and we never sell your data. If you choose to sign in with Apple or Google, those companies also process some data under their own policies — section 3 explains what.

1. Who is responsible for your data

Kate Saville is the data controller for the personal data described in this policy.

Contact: hello@atlaslearn.app

2. Data we collect

Account information. You can create an account in three ways, and we collect what each one needs:

• Email and password — your email address and a password. Your password is hashed by our authentication provider; we never see or store it in readable form.
• Sign in with Apple — a unique identifier for your Apple ID and an email address, which may be a private relay address if you choose Apple's Hide My Email. Atlas does not ask Apple for your name.
• Google Sign-In — a signed token from Google containing your Google account identifier, your email address and the basic profile details Google includes as standard (your name and a link to your profile picture). Atlas uses only the identifier and email address and does not save your name; our authentication provider keeps the details from the token with your sign-in record.

For every account we also store an account identifier, when the account was created, and which sign-in methods are linked to it. Earlier versions of Atlas saved the name that Apple or Google supplied; Atlas no longer does, and any name saved before is erased when you delete your account.

Learning activity. To make the app work — progress, streaks, and spaced-repetition review scheduling — we store your learning records: the course(s) you enrol in, your self-assessment and placement results, lessons completed and scores, the vocabulary you have learned, your review history (including when you reviewed each item, whether you answered correctly, and response times), experience points, streaks, and daily activity dates. We also store your device's time zone so streaks follow your day, not the server's. Quick Fire practice runs are not recorded anywhere: how you grade yourself stays on the screen for that run and is then discarded.

Technical information. When the app or website connects to our servers, our hosting providers necessarily receive your IP address and standard request details, such as the type of app or browser making the request. Our authentication provider may keep records of sign-in events and sessions, which can include IP address and device details, to secure accounts. Atlas's own database does not store IP addresses.

Website waitlist. If you joined the waitlist on our website, we store the email address you submitted, solely to contact you about Atlas.

What Atlas does not collect. The Atlas app does not access your location, contacts, photos, camera, microphone, or advertising identifier, and it contains no advertising, analytics or crash-reporting SDKs. Pronunciation audio is generated on your device by Apple's built-in speech synthesis, and Atlas never records your voice. Atlas does not use a push-notification service: the streak reminder described in section 4 is scheduled by the app on your device, and nothing about it is sent to us or to anyone else.

3. Sign in with Apple and Google Sign-In

These are optional; you can use an email address and password instead.

• Apple authenticates you when you choose Sign in with Apple. Apple processes that data under Apple's own privacy policy.
• Google authenticates you when you choose Google Sign-In, which runs through Google's Sign-In software kit inside the app. Google processes that data under Google's own privacy policy. Google's published privacy declaration for that kit states that it may collect your name, email address, phone number, coarse location, user ID, device ID and usage data, for app functionality and, for some of these, analytics by Google, and that none of it is used for tracking. That processing is Google's: Atlas does not receive it.

4. Data stored only on your device

Some data stays on your device: your appearance preference, your notification preferences (whether the streak reminder is on and the time it fires), mid-lesson resume state, one-time script-introduction flags (for Mandarin, Hebrew, Russian, Japanese and Arabic), and a cache of course content.

Streak reminders. If you allow notifications, Atlas can show one reminder a day, in the evening, on days when no lesson or review has counted towards your streak yet. The reminder is a local notification: the app schedules it on your device using the streak record it already holds for you, and no notification service, token or device identifier is involved. It is optional — iOS asks for your permission first, and you can turn it off or change the time at any time in Account → Notifications in the app or in your iPhone's Settings.

Your sign-in session is kept in the iOS Keychain (see section 7), and if you use Google Sign-In, Google's software kit keeps its own sign-in record there too. Deleting the app removes the local data; iOS may keep Keychain items after the app is deleted, and Atlas removes its own when you sign out or delete your account.

5. How we use your data and our legal bases (UK GDPR)

• To provide the service — operating your account, letting you sign in with the method you choose, saving progress, scheduling reviews, showing streaks and XP. Legal basis: performance of a contract (our Terms of Service).
• To secure the service — authentication, preventing abuse, maintaining accurate records. Legal basis: legitimate interests.
• To communicate essential account messages — for example password-reset emails. Legal basis: performance of a contract.
• To remind you to practise, if you have allowed notifications — the streak reminder is generated on your device from your own streak record (section 4), and you can switch it off at any time. Legal basis: consent, withdrawable at any time.
• To contact waitlist subscribers about Atlas. Legal basis: consent, withdrawable at any time.

We do not use your data for advertising or profiling, and we do not make automated decisions with legal or similar effects about you.

6. Who we share data with

We share data only with the service providers that run Atlas:

• Supabase — our database, authentication, and hosting provider. Your account and learning data are stored on Supabase's managed infrastructure in London (UK).
• Apple — Sign in with Apple, if you use it, and standard iOS services on your device. When you delete an account linked to Sign in with Apple, we send Apple a one-time code so Apple can revoke Atlas's access to your Apple ID. Apple may collect diagnostics under its own policies and your device settings; we do not receive Apple's diagnostic data through any SDK.
• Google — Google Sign-In, if you use it (see section 3); when you delete an account linked to Google, Atlas asks Google to revoke its access to your Google account. Separately, Google Workspace sends transactional account emails, such as password-reset messages, on our behalf through our Google Workspace mailbox.
• Vercel — hosts our website, including the waitlist form.

We never sell personal data and never share it with advertisers or data brokers. We may disclose data if the law requires it.

Some of these providers, including Apple and Google, are based outside the UK and may process data in other countries. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

7. Cookies and similar technologies

The Atlas app does not use cookies. It stores a secure session token in the iOS Keychain so you stay signed in; this is essential to the service. Our website's waitlist form works without advertising or analytics cookies.

8. User-generated content

Atlas does not currently offer public profiles, comments, messaging, or any way to share content with other users. Your learning answers are private to your account and are used only to schedule your reviews.

9. Children

Atlas is not directed at children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal data from children under 13; if you believe a child has created an account, contact us and we will delete it.

10. Data retention and deletion

We keep your account and learning data for as long as your account exists — that history is the product's memory of your progress.

You can delete your account at any time from Account → Delete Account in the app. You confirm it's you first — with your password, or with Apple or Google if your account is linked to them. Deletion is immediate and permanent: your authentication account (including its linked sign-in methods and sessions), all learning records, and any waitlist entry under the same email address are erased from our live systems in a single operation. If your account is linked to Apple or Google, Atlas also asks them to revoke its access, and the app then erases its data from your device and signs you out. You can also email us and we'll do it for you.

Some copies can outlast deletion for a limited time: sign-in security records kept by our authentication provider, and our hosting provider's infrastructure backups, which are overwritten on its own schedule. Your Apple ID or Google account itself, and data those companies hold about your use of it, are governed by their own policies.

11. Your rights

Under UK GDPR you have the right to: access the data we hold about you; correct inaccurate data; delete your data ("right to erasure"); restrict or object to certain processing; port your data to another service; and withdraw consent where processing is based on consent.

Erasure is available immediately in the app (Account → Delete Account). To exercise any other right, email hello@atlaslearn.app. We will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

12. Security

Data is encrypted in transit (TLS) and at rest by our hosting provider. Row-level security in our database stops other users from reading your records, and your learning records can only be changed through server-side functions that act on your own signed-in account. To operate Atlas, a small number of accounts with a developer permission can look up accounts by email address and manage account permissions, and we can access data through our hosting provider's administration tools when needed to run and support the service.

13. Changes to this policy

If we change this policy, we will update the effective date above and, for material changes, tell you in the app or by email before they take effect. Continued use of Atlas after a change means the updated policy applies.