PRIVACY POLICY
What Atlas stores, what it doesn't, and what you can delete.
The short version
Atlas is private by default. Your flights, hours, and aircraft data belong to you. Atlas does not sell, share, or republish your data without your explicit opt-in for share surfaces. You can export everything Atlas holds about you. You can delete your account, and the underlying records, on request.
What Atlas collects
- Account: your email address.
- Aircraft identifiers: tail number and ICAO24 hex.
- Flight records: first-seen and last-seen times, position samples, altitude, ground speed, and track — sourced from FlightAware and other public aircraft position providers.
- Subscription state: tier, status, and payment events from Stripe. Atlas does not store card numbers.
- Audit trail: append-only signed records of every flight stored, with Ed25519 signatures, so the ledger cannot be silently rewritten.
What Atlas does not collect
- Atlas does not track real-time public position streams.
- Atlas does not infer or expose home base, employer, or contractor work patterns on any public surface.
- Atlas does not track you across the web. No third-party analytics scripts.
- Atlas does not store passwords. Sign-in is email-link based.
- Atlas does not store payment card numbers. Stripe handles all card data.
Third parties Atlas relies on
- FlightAware: aircraft position and flight data source. FlightAware's terms apply to upstream data.
- Stripe: payment processing. Stripe's privacy policy applies to card data and billing events.
- Resend: transactional email delivery (welcome, payment confirmation, account-action links). Resend's privacy policy applies to email transport.
- Vercel: static-asset hosting and edge delivery.
Share surfaces are opt-in
Public share surfaces are off by default. When you opt in to a share, Atlas applies a field allowlist and endpoint crop policy before any record leaves the private projection. Atlas will refuse to publish a share that would leak home-base, employer, or contractor-pattern signals.
Retention and deletion
Atlas retains your data for as long as your account is active. To request deletion, email privacy@atlasfly.io from the address on your account. Atlas will delete your tenant, your aircraft, your flight records, your share surfaces, and the signing audit trail within 30 days.
Some records may be retained in encrypted backups beyond 30 days for disaster recovery. Backups are rotated and overwritten on a quarterly cycle; deletion requests are honored permanently once the next backup rotation passes.
Data export
Every Atlas tenant can export every record Atlas holds about them, including signed canonical flight records, share policies, and subscription state. Email privacy@atlasfly.io to receive a signed export bundle.
Changes to this policy
Atlas may update this policy. Material changes will be announced via email to the address on your account at least 14 days before they take effect.
Contact
Privacy questions, deletion requests, export requests: privacy@atlasfly.io.