Privacy Policy

Effective date: August 4, 2026

This policy covers the atlas. iOS app and the public journal website that goes with it. atlas. is made by an independent developer. In this policy “we” and “us” mean that developer, and “you” means the person using the app.

Contact: woofer.ua@gmail.com

Location

atlas. is a driving companion. It needs to know where you are to tell you about where you are.

On your device. While a trip is running, the app records your position, speed, distance and the route you drive. That record is stored on your phone. It reaches our server only when the journey is published — which, for a journey you have driven that ends with three or more stories, happens on its own unless you have turned that off. What is sent has had the first and last kilometre removed. See “Publishing to the public journal” below.

What leaves your device, and to whom

• Apple. The app asks Apple (MapKit) to turn your exact coordinates into a place name, for every place it tells a story about. If you use Route Preflight or the Journey Arc, the start and destination you type, and their coordinates, also go to Apple. Apple handles this under its own privacy policy.
• Open reference sources. To find out what is actually near you, the app queries Wikipedia’s geosearch, Wikidata, OpenHistoricalMap, Open Plaques and a NOAA historical-events service. These get your coordinates, or a small bounding box around them. They do not get any identifier for you or your device.
• The story writer. To write the story, the app sends the place name, the facts it found, and — unless you turn this off — your exact coordinates through our server to OpenRouter, which runs the request on the Gemini 3.1 Flash Lite language model — or on Claude Haiku 4.5 when Gemini is unavailable.
• Our server, for local history & news. Only if you turn that source on. Your coordinates are rounded to two decimal places (about 1.1 km) before they are used, cached or logged.

Permissions. Location is required. The last screen of setup asks for “When In Use”, and setup cannot be finished until it is granted. atlas. follows your route in order to know which places to tell you about; without that it has nothing to say, so there is no version of the app that skips this. If you decline, iOS will not show the prompt a second time, and the screen sends you to iOS Settings instead. There is one exception: on a device where location is switched off by Screen Time or by a management profile, the permission cannot be granted at all — iOS does not even show the switch — and setup lets you through rather than shutting you out of a device you may not control. It says so on the screen: planning a route, reading and settings all work there; a live journey cannot.

“Always”, and what happens in the background. Each time you start a journey the app asks iOS for “Always”, so it can keep finding places while the screen is off; iOS shows that prompt only the first time. It works fine without “Always” — you just stop getting new stories once the phone locks. Background location is used only inside a running journey: the app starts location updates when a journey starts, stops them when it ends, and turns on background updates only while you have granted “Always”. It does not use significant-change monitoring or geofences, and it is not woken to check where you are between journeys.

Setting: “Hide coordinates from story engine.” Off by default. When you turn it on, the numeric coordinates are left out of the request to the story writer. Be aware that the place name and the nearby landmarks are still sent, so the story writer can still tell roughly where you are. This setting does not affect geocoding, Wikipedia lookups, local news, illustrations or publishing.

Story text and narration

Writing. Story text is generated in the cloud. The prompt sent through our server to OpenRouter (Gemini 3.1 Flash Lite, with Claude Haiku 4.5 as the fallback model) contains: your coordinates (unless hidden), the place name, the names and facts of nearby landmarks, the titles of stories you have already heard on this trip, your language, story length, chosen tones, and any custom narrator direction you typed. For the Journey Arc it also contains the names of your origin and destination cities.

Narration. To read a story aloud, the app sends the full text of that story to ElevenLabs, which runs the eleven_v3 voice model. If that fails, the same text goes to OpenRouter and its openai/gpt-audio-mini voice model instead. Both requests go through our server. What reaches the voice providers is the story text alone — never your name, your coordinates or an identifier for you.

The shared story cache. Stories are cached on our server so that the same landmark does not have to be re-written for every driver. A cached story is keyed by the landmark, the language, the length and the tone settings. It contains no identifier and no coordinates, and it is readable at a public address. Treat anything you type into “custom narrator direction” as something that could end up in a cached story — do not put personal information there.

Installation identifier (App Attest)

Some features talk to our own server: local history & news, illustrations, crash reports and publishing. To stop those endpoints from being abused, the app proves it is a genuine copy of atlas. using Apple’s App Attest.

App Attest creates a key on your device. Its identifier is stored in the iOS Keychain, which means it survives deleting and reinstalling the app. That identifier is sent with every request to our server, and our server stores it along with the attested public key, a request counter, and per-day usage counters.

This identifier is per installation. It is not your name, not your Apple ID, not an advertising ID, and we do not use it to build a profile of you. But it is a stable identifier, and it does travel in the same request as your rounded location when local history & news is on, and as your trimmed route whenever a journey is published — by you or by the app. There is no IDFA, no identifierForVendor, and no App Tracking Transparency prompt, because nothing here is used for tracking or advertising.

Local history & news (opt-in, off by default)

“Local history & news” is the only story source that is off until you switch it on. When it is on, and no more than four times per trip, the app asks our server for archival background about where you are.

The request contains your coordinates, the resolved place name, your language, and the names of landmarks the app already knows about. Our server rounds the coordinates to two decimal places (about 1.1 km) and forwards the place name and the rounded coordinates to Perplexity, which searches the web. Perplexity’s key stays on our server; your device never talks to Perplexity directly. Results are cached on our server by rounded coordinates, language and time window only. No identifier is stored with them.

One exception you should know about.If you tell the app where you are going, the final chapter of the Journey Arc looks for archival material about your destination using this same source, even when the “Local history & news” switch is off. The request in that case is about your destination city, not your current position.

Illustrations (server-controlled)

Stories can be illustrated with a generated engraving. There is no switch for this in the app; it is enabled or disabled from our server and is off in the default configuration.

When it runs, the request contains the landmark name, a short visual angle, the type of place, up to three public facts, the story title, your language and an internal identifier for the landmark. It contains no coordinates and no story body, and no identifier beyond the App Attest one. The fields sent on to the image model are run through a server-side filter that replaces anything shaped like a coordinate. The image is generated by Google’s Gemini image model through the Vercel AI Gateway, and the finished image file is stored at a public web address so the app can load it. The address is not listed anywhere, but anyone who has it can open the image.

Publishing a trip to the public journal

This is the feature that deliberately makes your data public, and it now happens by itself. When a journey you have actually driven ends with three or more narrated stories, the app publishes it to the public journal. There is no Publish button to press and no confirmation step.

Two things have to be true first. The setting Settings › Privacy & data › “Add journeys to the atlas” has to be on — it is on by default — and you have to have seen the notice card the app shows when your first journey starts. Nothing publishes itself before that card has been shown, which is also why a journey started from CarPlay, where the card cannot appear, waits for the phone.

What does not publish itself: a route you prepared but have not driven; a journey with fewer than three narrated stories; a journey in Arabic, which the app never adds by itself; a journey you declined on the notice card; and a journey you unpublished, which is never put back. None of these are published unless you tap Publish on the journey yourself.

The pen name on the page

There is still no account, no email address and no sign-up. Instead, during onboarding the app generates a two-word pen name for you — “Quiet Kestrel”, published as @quiet-kestrel — fills it in, and offers a “Suggest another” button. It is not taken from your real name, your contacts or your Apple ID; it belongs to that installation of the app, not to an account you sign in to. That pen name is the byline on everything published from your phone, and it has a page of its own on this site listing the journeys published under it. You can edit it before you finish onboarding, or later in Settings — including replacing it with your real name, in which case your real name is what appears.

The ends of the route are cut off before it is sent

A route published whole says where the journey began and where it stopped, and for most drives that is home. So the app trims the track on your phone, before anything is uploaded. This happens on every publish, including the ones you ask for yourself.

• The first and last kilometre of the path you travelled is removed and never leaves the device.
• Any point later in the journey that comes back within a kilometre of where you started or where you stopped is removed as well — otherwise an errand that loops past your street would put back what the first cut took out. This can leave a visible gap in the middle of a loop.
• A story whose location falls inside either of those zones is published without coordinates. Its title, its full text and its place name still appear — a place name is a town, not an address.
• A journey too short to survive the trimming is published as a single point in the middle of the drive rather than as a line.

Be clear about what this does and does not do. It is one kilometre, and it protects the two ends. It does not anonymise your route: everything between the cuts is published as it was recorded, along with the times, so the roads you took, the town you took them in and the hour you were there are all public. Anyone who knows you may well recognise the drive. Treat a published journey as a public account of a real trip you made.

What becomes publicly readable on the journal website

• The trip title, its start and end dates, the distance and the language.
• The route you drove, minus the trimmed ends — the remaining track of coordinates with timestamps, drawn on a map.
• Every story in full text, with its title, time and place name, and its precise coordinates unless the story falls in one of the trimmed zones.
• The narration audio of every story.
• The cover image and any story illustrations.
• Your pen name as the byline, linking to the page that lists your other published journeys.

The map on a published page is drawn with tiles loaded from CARTO, so anyone viewing the page sends their IP address and the map area to CARTO.

Published pages are on the open internet. Search engines can index them, and other people can copy or archive what they see. The trimming above is what keeps a page from pointing at your front door; it does not make the rest of the journey private, and it cannot undo a copy someone has already taken.

Everyone publishes to the same journal site, but not under the same name. Each installation of the app publishes under its own pen name and has its own author page. Whether you are testing the app or using it in earnest, what your phone publishes appears on this public site.

Unpublishing. You can remove a published trip at any time from the trip’s page in the app. That deletes the post, its audio and its index entry from the public site, and the journey is not published again automatically afterwards. The trip and its stories stay on your phone. We cannot control copies that other people or search engines made while it was up.

Crash and performance reports (opt-in, off by default)

“Anonymous analytics” in Settings is off by default. If you turn it on, the app forwards Apple’s MetricKit crash, hang, disk-write and CPU-exception reports to our server. Those reports come from iOS, are sent as an opaque blob along with the app version and build number, and are stored privately — not on the public site — in a folder named after a hash of your installation identifier.

They contain no story text, no place names and no coordinates. Your choice is re-read before every single upload, so turning the switch off stops uploads immediately. This is the only “analytics” the app has: there is no product-analytics SDK, no event tracking, no session recording, and no measurement of which screens or buttons you use.

Music (optional)

If you connect Apple Music, playback happens on your device through Apple’s frameworks. If you connect Spotify, you paste in your own Spotify client ID and sign in to Spotify directly; the app sends playback commands to Spotify’s API. Nothing about your trip, your location or your stories is sent to Spotify or Apple Music.

What we do not collect

• No account, email address, phone number or password.
• No contacts, photos, camera or microphone access. The app declares none of those permissions.
• No health, fitness, financial or payment data. Nothing is on sale in this build — the app carries Apple’s StoreKit and the identifiers for the memberships and story packs it will one day offer, but the shelf is replaced by a card that says there is nothing to buy yet. If anything is ever sold, Apple takes the payment: card and billing details go to Apple under its own terms and never reach us.
• No browsing history, no search history.
• No advertising identifier, no ad network, no ad SDK.
• No third-party analytics, attribution or crash-reporting SDK. The app bundles no third-party SDKs at all.
• No tracking across apps or websites, and no App Tracking Transparency prompt, because there is nothing to track.
• We never sell personal data and never share it with data brokers.

Who receives data, and what each one gets

Each of these companies handles what it receives under its own privacy policy. As with any internet request, the services above see the IP address your request comes from. We do not store IP addresses in our own records; our hosting provider handles them as part of delivering the request and keeps its own operational logs.

Where your data lives, and how long we keep it

On your phone. Trips, stories, narration audio, illustrations, route tracks, Route Preflight packs and your settings are stored on your device and kept until you delete them. Deleting a trip in the app deletes the trip and its stories; the narration audio files are reclaimed by a sweep the next time the app launches. Deleting the app removes all of it. The App Attest key identifier in the Keychain is the one thing that survives deleting the app; iOS removes Keychain items when you erase the device.

On our server. Published trips stay up until you unpublish them, or until we take the journal down. Illustration image files are content-addressed and stay in storage indefinitely at their public, unlisted addresses, even after the trip that used them is unpublished or deleted. Cached stories stay until we clear the cache; they contain no identifier and no coordinates. News results are cached by rounded coordinates, language and time window — archival results for 30 days, current-week results for 3 hours. Crash reports are kept privately while we are investigating stability, and deleted when they are no longer useful. App Attest records are kept for as long as that installation keeps making requests; usage counters expire on their own each day.

At the providers. Story prompts and narration text are held by OpenRouter — and the model hosts it routes to, Google and Anthropic — and by ElevenLabs, under their own retention rules. We do not control those.

Your choices

• Location. This one is not optional: atlas. cannot be set up without it, so the real choice is whether to install the app — except on a device where Screen Time or a management profile forbids location outright, and there setup lets you through without it. Afterwards you can downgrade “Always” to “While Using”, or revoke location altogether, in iOS Settings. Revoking it does not lock you out of an app you have already set up — your saved journeys stay readable and routes can still be planned — but no new journey can follow you until you allow it again.
• “Hide coordinates from story engine.” Keeps your numeric position out of the story prompt.
• Story sources.Turn individual sources off in Settings — except Wikipedia, which is always on. “Local history & news” is off unless you switch it on.
• “Ask where you’re going.” Turn it off to stop the Journey Arc, and its destination lookup, entirely.
• “Anonymous analytics.” Leave it off, or turn it back off, to stop crash reports being sent.
• “Add journeys to the atlas.”In Settings › Privacy & data, on by default. Turn it off and nothing is published unless you ask for it.
• “Don’t publish this journey.” The second button on the notice card shown when your first journey starts. It keeps that one journey out of the journal for good, and leaves the setting alone.
• Pen name. Change the name your journeys are signed with in Settings. The app generates one for you; nothing forces you to put your real name on a page.
• Delete a trip. Removes it, its stories and its audio from your phone.
• Unpublish. Removes a published trip from the public journal, at any time, from the trip’s own page. That journey is not published again by itself.
• Music. Connect nothing, and no music service is contacted.

Because there is no account, we usually have no way to connect anything on our server back to you as a person. If you want a published trip removed and cannot do it in the app, email us with the link and we will take it down. Depending on where you live, you may have rights to access, correct, delete or object to the processing of your personal data. Write to the contact address above and we will respond.

International transfers

Our server runs on Vercel’s infrastructure, and the providers listed above operate in the United States and elsewhere. If you use atlas. outside those countries, the data described here will be processed in them.

Children

atlas. is not designed for or directed at children. Do not use it if you are under 13. We do not knowingly collect personal information from children. If you believe a child has published a trip or sent us data, email us and we will remove it.

Changes to this policy

If the app changes what it collects, this page changes with it and the effective date at the top is updated. Significant changes will also be noted in the app.

Contact

woofer.ua@gmail.com — see also our Terms of Use and Support page.