Privacy Policy

Effective date: July 28, 2026

This policy covers the atlas. iOS app and the public journal website that goes with it. atlas. is made by an independent developer. In this policy “we” and “us” mean that developer, and “you” means the person using the app.

Contact: woofer.ua@gmail.com

Location

atlas. is a driving companion. It needs to know where you are to tell you about where you are.

On your device. While a trip is running, the app records your position, speed, distance and the route you drive. That record is stored on your phone. We do not receive it unless you publish the trip.

What leaves your device, and to whom

• Apple. The app asks Apple (MapKit) to turn your exact coordinates into a place name, for every place it tells a story about. If you use Route Preflight or the Journey Arc, the start and destination you type, and their coordinates, also go to Apple. Apple handles this under its own privacy policy.
• Open reference sources. To find out what is actually near you, the app queries Wikipedia’s geosearch, Wikidata, OpenHistoricalMap, Open Plaques and a NOAA historical-events service. These get your coordinates, or a small bounding box around them. They do not get any identifier for you or your device.
• The story writer. To write the story, the app sends the place name, the facts it found, and — unless you turn this off — your exact coordinates through our server to OpenRouter, which runs the request on the Gemini 3.1 Flash Lite language model — or on Claude Haiku 4.5 when Gemini is unavailable.
• Our server, for local history & news. Only if you turn that source on. Your coordinates are rounded to two decimal places (about 1.1 km) before they are used, cached or logged.

Permissions. The app asks for “When In Use” location first. Each time you start a journey the app asks iOS for “Always”, so it can keep finding places while the screen is off; iOS shows the prompt only the first time. It works fine without “Always” — you just stop getting new stories once the phone locks. Route planning works with no location permission at all.

Setting: “Hide coordinates from story engine.” Off by default. When you turn it on, the numeric coordinates are left out of the request to the story writer. Be aware that the place name and the nearby landmarks are still sent, so the story writer can still tell roughly where you are. This setting does not affect geocoding, Wikipedia lookups, local news, illustrations or publishing.

Story text and narration

Writing. Story text is generated in the cloud. The prompt sent through our server to OpenRouter (Gemini 3.1 Flash Lite, with Claude Haiku 4.5 as the fallback model) contains: your coordinates (unless hidden), the place name, the names and facts of nearby landmarks, the titles of stories you have already heard on this trip, your language, story length, chosen tones, and any custom narrator direction you typed. For the Journey Arc it also contains the names of your origin and destination cities.

Narration. To read a story aloud, the app sends the full text of that story to OpenRouter, which runs the openai/gpt-audio-mini voice model. If that fails, the same text is sent to ElevenLabs as a fallback. Both requests go through our server. What reaches the voice providers is the story text alone — never your name, your coordinates or an identifier for you.

The shared story cache. Stories are cached on our server so that the same landmark does not have to be re-written for every driver. A cached story is keyed by the landmark, the language, the length and the tone settings. It contains no identifier and no coordinates, and it is readable at a public address. Treat anything you type into “custom narrator direction” as something that could end up in a cached story — do not put personal information there.

Installation identifier (App Attest)

Some features talk to our own server: local history & news, illustrations, crash reports and publishing. To stop those endpoints from being abused, the app proves it is a genuine copy of atlas. using Apple’s App Attest.

App Attest creates a key on your device. Its identifier is stored in the iOS Keychain, which means it survives deleting and reinstalling the app. That identifier is sent with every request to our server, and our server stores it along with the attested public key, a request counter, and per-day usage counters.

This identifier is per installation. It is not your name, not your Apple ID, not an advertising ID, and we do not use it to build a profile of you. But it is a stable identifier, and it does travel in the same request as your rounded location when local history & news is on, and as your route when you publish a trip. There is no IDFA, no identifierForVendor, and no App Tracking Transparency prompt, because nothing here is used for tracking or advertising.

Local history & news (opt-in, off by default)

“Local history & news” is the only story source that is off until you switch it on. When it is on, and no more than four times per trip, the app asks our server for archival background about where you are.

The request contains your coordinates, the resolved place name, your language, and the names of landmarks the app already knows about. Our server rounds the coordinates to two decimal places (about 1.1 km) and forwards the place name and the rounded coordinates to Perplexity, which searches the web. Perplexity’s key stays on our server; your device never talks to Perplexity directly. Results are cached on our server by rounded coordinates, language and time window only. No identifier is stored with them.

One exception you should know about.If you tell the app where you are going, the final chapter of the Journey Arc looks for archival material about your destination using this same source, even when the “Local history & news” switch is off. The request in that case is about your destination city, not your current position.

Illustrations (server-controlled)

Stories can be illustrated with a generated engraving. There is no switch for this in the app; it is enabled or disabled from our server and is off in the default configuration.

When it runs, the request contains the landmark name, a short visual angle, the type of place, up to three public facts, the story title, your language and an internal identifier for the landmark. It contains no coordinates and no story body, and no identifier beyond the App Attest one. The fields sent on to the image model are run through a server-side filter that replaces anything shaped like a coordinate. The image is generated by Google’s Gemini image model through the Vercel AI Gateway, and the finished image file is stored at a public web address so the app can load it. The address is not listed anywhere, but anyone who has it can open the image.

Publishing a trip to the public journal

This is the only feature that deliberately makes your data public. It never happens automatically — you have to tap Publish on a finished trip and confirm.

What becomes publicly readable on the journal website:

• The trip title, its start and end dates, the distance and the language.
• The complete route you drove — the full track of coordinates with timestamps, drawn on a map.
• Every story in full text, with its title, time, place name and precise coordinates.
• The narration audio of every story.
• The cover image and any story illustrations.
• The author name (byline) you set in Settings. Change it before you publish if you do not want that name on the page.

The map on a published page is drawn with tiles loaded from CARTO, so anyone viewing the page sends their IP address and the map area to CARTO.

Published pages are on the open internet. Search engines can index them, and other people can copy or archive what they see. Publishing your route makes it possible for a reader to work out where you started and where you finished — which for most drives means near your home.

During this early phase, all publishing goes to one shared journal. Every copy of the app publishes to the same public site under a single author account. If you are testing the app, anything you publish appears on that public site, not on a journal of your own.

Unpublishing. You can remove a published trip at any time from the trip’s page in the app. That deletes the post, its audio and its index entry from the public site. The trip and its stories stay on your phone. We cannot control copies that other people or search engines made while it was up.

Crash and performance reports (opt-in, off by default)

“Anonymous analytics” in Settings is off by default. If you turn it on, the app forwards Apple’s MetricKit crash, hang, disk-write and CPU-exception reports to our server. Those reports come from iOS, are sent as an opaque blob along with the app version and build number, and are stored privately — not on the public site — in a folder named after a hash of your installation identifier.

They contain no story text, no place names and no coordinates. Your choice is re-read before every single upload, so turning the switch off stops uploads immediately. This is the only “analytics” the app has: there is no product-analytics SDK, no event tracking, no session recording, and no measurement of which screens or buttons you use.

Music (optional)

If you connect Apple Music, playback happens on your device through Apple’s frameworks. If you connect Spotify, you paste in your own Spotify client ID and sign in to Spotify directly; the app sends playback commands to Spotify’s API. Nothing about your trip, your location or your stories is sent to Spotify or Apple Music.

What we do not collect

• No account, email address, phone number or password.
• No contacts, photos, camera or microphone access. The app declares none of those permissions.
• No health, fitness, financial or payment data. There are no in-app purchases and no StoreKit.
• No browsing history, no search history.
• No advertising identifier, no ad network, no ad SDK.
• No third-party analytics, attribution or crash-reporting SDK. The app bundles no third-party SDKs at all.
• No tracking across apps or websites, and no App Tracking Transparency prompt, because there is nothing to track.
• We never sell personal data and never share it with data brokers.

Who receives data, and what each one gets

Each of these companies handles what it receives under its own privacy policy. As with any internet request, the services above see the IP address your request comes from. We do not store IP addresses in our own records; our hosting provider handles them as part of delivering the request and keeps its own operational logs.

Where your data lives, and how long we keep it

On your phone. Trips, stories, narration audio, illustrations, route tracks, Route Preflight packs and your settings are stored on your device and kept until you delete them. Deleting a trip in the app deletes the trip and its stories; the narration audio files are reclaimed by a sweep the next time the app launches. Deleting the app removes all of it. The App Attest key identifier in the Keychain is the one thing that survives deleting the app; iOS removes Keychain items when you erase the device.

On our server. Published trips stay up until you unpublish them, or until we take the journal down. Illustration image files are content-addressed and stay in storage indefinitely at their public, unlisted addresses, even after the trip that used them is unpublished or deleted. Cached stories stay until we clear the cache; they contain no identifier and no coordinates. News results are cached by rounded coordinates, language and time window — archival results for 30 days, current-week results for 3 hours. Crash reports are kept privately while we are investigating stability, and deleted when they are no longer useful. App Attest records are kept for as long as that installation keeps making requests; usage counters expire on their own each day.

At the providers. Story prompts and narration text are held by OpenRouter — and the model hosts it routes to, Google and Anthropic — and by ElevenLabs, under their own retention rules. We do not control those.

Your choices

• Location. Grant, downgrade or revoke it in iOS Settings. Route planning still works with location off.
• “Hide coordinates from story engine.” Keeps your numeric position out of the story prompt.
• Story sources.Turn individual sources off in Settings — except Wikipedia, which is always on. “Local history & news” is off unless you switch it on.
• “Ask where you’re going.” Turn it off to stop the Journey Arc, and its destination lookup, entirely.
• “Anonymous analytics.” Leave it off, or turn it back off, to stop crash reports being sent.
• Author name. Change the byline in Settings before publishing anything.
• Delete a trip. Removes it, its stories and its audio from your phone.
• Unpublish. Removes a published trip from the public journal.
• Music. Connect nothing, and no music service is contacted.

Because there is no account, we usually have no way to connect anything on our server back to you as a person. If you want a published trip removed and cannot do it in the app, email us with the link and we will take it down. Depending on where you live, you may have rights to access, correct, delete or object to the processing of your personal data. Write to the contact address above and we will respond.

International transfers

Our server runs on Vercel’s infrastructure, and the providers listed above operate in the United States and elsewhere. If you use atlas. outside those countries, the data described here will be processed in them.

Children

atlas. is not designed for or directed at children. Do not use it if you are under 13. We do not knowingly collect personal information from children. If you believe a child has published a trip or sent us data, email us and we will remove it.

Changes to this policy

If the app changes what it collects, this page changes with it and the effective date at the top is updated. Significant changes will also be noted in the app.

Contact

woofer.ua@gmail.com — see also our Terms of Use and Support page.