Privacy Policy

What changed: this version replaces the policy of 25 September 2026. It names Rocksofttech as responsible for your data, lists every service that receives your data and says where your data is stored. Every AI feature now uses Microsoft Azure OpenAI, and Talk to Atlas uses Microsoft Azure Speech. It explains the one notice that asks for your consent to health data and AI, how to withdraw it, and which wellbeing entries are saved without it. It also explains push to talk, the emails Atlas sends, exactly what deleting your account removes and what stays, backups, and who at Atlas can see your data.

Atlas is provided by Rocksofttech.

• For anything about your personal data, including a request to see, correct or delete it, email privacy@atlaspa.app.
• For help with the app, email support@atlaspa.app.

We collect what you give us and what the app needs to work for you. You decide most of it.

• Account: your email address, your password (the sign-in service keeps only a scrambled form of it, never the password itself), your name, profile photo, Atlas ID, username, profession and industry, time zone, language, your app settings, and which versions of this policy and our Terms you accepted or were told about.
• Optional profile details, if you add them: gender, date of birth, nationality, blood type, height, weight and a target weight, health conditions, and an emergency contact's name and phone number.
• Location: the city and country you give us. If you choose to use your device's location in Profile, the coordinates are saved to your profile. Atlas uses your location for prayer times and the weather.
• Tasks and planning: tasks, meetings and meeting notes, delegations, the calls, emails and messages you log, recurring schedules, notes, Brain Dump entries, ideas, goals, key dates and your calendar events. If you connect a Google, Microsoft or iCloud calendar, we keep a copy of the events Atlas reads from it.
• People you add: names, email addresses and phone numbers of colleagues, family members and the people you delegate to. You type these in. Atlas does not read your phone's address book.
• Family and household: your family groups, and the lists, chores and activities you share with them.
• Documents: files you keep in your document vault. These can include identity document numbers and finance documents if you choose to add them.
• Faith and prayer: your faith, your prayer log, and the adhkar, Quran and other scripture reading you track, if you use these features.
• Health and wellbeing: weight, sleep, food, water and other drinks, mood, stress, workouts, supplements, medications, health conditions and allergies, wellbeing notes, and, if you connect Oura, WHOOP, Fitbit or Garmin, the readiness, sleep, activity, recovery, strain and step figures you allow.
• Medical records: records and files, such as lab reports, that you add, and the AI summaries you ask for.
• Photos for recognition: a meal or gym machine photo you take for Atlas to recognise is saved in your private storage first. It stays there even if recognition fails, you cancel, or you later delete the meal or workout. It is in your data download, and it is deleted when you delete your account.
• Voice and recordings: what you say to Atlas, and meeting recordings you make or upload. Atlas turns them into text and does not keep the audio (section 6).
• AI and voice use: how many times you used each AI feature today and this month, and how many minutes of voice you used, so we can apply fair-use limits.
• Device and diagnostics: if you turn on push notifications, a push address for your device and your browser type. Error reports, which say what went wrong, on which screen and on what kind of device. While the app is open, which platform you use (web, iPhone or Android) and which area of the app you are in.
• Payments: if you buy a subscription, Paddle tells us its status, plan and renewal date, and Paddle's own customer and subscription numbers. We never see your card details.

Data protection law in the UK and the EU asks us to say why we use your data and on what legal basis. The basis is in brackets.

• To run the features you use, keep your account and sync your data across your devices. (Contract: you asked us to provide Atlas.)
• To send you the reminders and notifications you set up, and emails about your account and its security, such as confirming your email address or resetting your password. (Contract.)
• To store your medical records and files, medications, health conditions and allergies, wellbeing notes and prayer log, which are special category data. (Your explicit consent. See section 4.)
• To keep the other wellbeing entries you choose to log, listed in section 4, and show them back to you. (Contract: you asked Atlas to keep them.)
• To run the AI features and voice. (Your consent, which Atlas asks for before you first use them. See sections 5 and 6.)
• To apply fair-use limits, keep Atlas secure, find and fix faults, and prevent abuse. (Legitimate interests: running a safe and reliable service.)
• To send an email for you to someone who does not use Atlas, when you ask Atlas to, for example to invite them to take on a task. (Legitimate interests. See section 10.)
• To send you tips about features you already have, and, if you agree, news about Atlas. (Legitimate interests for tips, which you can turn off. Your consent for news where the law requires it. See section 10.)
• To keep records the law requires, such as the tax records our payment provider keeps. (Legal obligation.)

We do not sell your personal data. We do not show advertising, and Atlas has no advertising or analytics trackers. We do not use your content to train AI models.

The law treats health data, and data that can show your religious belief, as special category data. Atlas asks for your explicit consent before it stores your medical records and files, medications, health conditions and allergies, wellbeing notes and your prayer log, and before it sends any of your data to an AI service.

• Atlas asks with one notice, "Your health data and AI". It names the services that receive your data: Microsoft Azure OpenAI, the AI service Atlas uses, and ElevenLabs or Microsoft Azure Speech for your voice.
• If you choose Not now, nothing is saved or sent, and Atlas asks again when you try one of these features.
• You can withdraw your consent at any time in Profile, under Legal and AI. Your health data consent and your AI consent each have their own row there. Withdrawing your health data consent stops Atlas saving new records and adding to your prayer log, and stops the health coach and report analysis. Withdrawing your AI consent stops Atlas sending your data to AI and voice services. Records you already saved stay until you delete them, and you can remove them at any time.
• Atlas keeps your records until you delete them or delete your account. When you delete your account, they are all removed (section 11).
• Some wellbeing entries are saved when you log them, without this consent question: the doses you log for a medicine, meals, water and other drinks, sleep, weight, mood, stress, workouts, supplements, meditation, wearable figures, the health details on your profile, and your adhkar, Quran and scripture reading. You choose to log each of them, and you can delete them at any time.

Atlas is not a medical service. Our Terms of Service say what Atlas is not for, in section 5.

Atlas's smart features use Microsoft Azure OpenAI, which runs OpenAI models for us. They are: push to talk and typed commands, the replies of Talk to Atlas, meal photos, gym machine photos and supplement label photos, meals you describe, Brain Dump sorting, motivation, grocery lists, support chat, meeting to-dos and handwritten meeting notes, medical report analysis and the health coach.

• Each feature sends only what it needs: what you typed or said, the photo or document you chose, and the parts of your Atlas data the feature uses to answer, such as today's tasks or, for the health coach, your recent wellbeing entries.
• Atlas sends nothing to AI until you have given your consent (section 4).
• When you ask Atlas about the weather somewhere, or ask a general question such as "what is photosynthesis", our server looks up the answer at Open-Meteo or Wikipedia. It sends only the place name or the subject of your question, never your name or your account.
• AI answers are produced automatically and can be wrong. Check anything that matters before you act on it.

• Talk to Atlas: your microphone audio goes to Microsoft Azure Speech to be turned into text, and the text of Atlas's spoken reply goes to Microsoft Azure Speech to be turned into speech. Atlas can be set up to use ElevenLabs for this instead. Only one of them carries a conversation. When ElevenLabs is used, it also receives your first name, profession, today's task counts and, if you connected a wearable, a short health summary, so it can talk about your day, and your browser loads a small sound-processing script from jsDelivr.
• Push to talk and the microphone in text fields: these use your browser's or your phone's own speech recognition. Your browser or phone may send the audio to its maker, for example Google for Chrome or Apple for Safari and iPhone, under that company's own terms. Atlas receives only the text.
• Meeting recordings: a recording you make or upload is sent to Microsoft Azure OpenAI, or to ElevenLabs when Atlas is set up to use it, to be turned into text. Atlas holds the audio only while it is being transcribed and never stores it.
• Atlas does not store voice audio. It keeps the text you choose to save, for example a task created from what you said.

Each service gets only what its job needs. Where a service works for us (a "processor"), it may use your data only to provide that service to Atlas.

• Microsoft Azure: hosts Atlas. The servers, the database and the file storage run in Microsoft's data centre in Denmark, in the European Union. The database and file storage run Supabase software, operated by us.
• Microsoft Azure OpenAI: the AI service behind every AI feature (section 5).
• Microsoft Azure Speech: turns your voice into text and Atlas's replies into speech (section 6).
• Microsoft Azure Communication Services: sends the emails Atlas sends, from its servers in Europe. It receives the recipient's email address and the email itself.
• ElevenLabs: only when Atlas is set up to use it for voice or meeting recordings (section 6).
• Paddle: sells Atlas subscriptions as our reseller and merchant of record, when paid plans are offered. Paddle collects your payment and billing details itself and handles them under its own privacy notice. When you open checkout, Paddle's own scripts load from Paddle.
• Google, Microsoft and Apple: if you connect a calendar, Atlas reads, and if you allow it writes, your events through Google Calendar, Microsoft Outlook or iCloud. If you sign in with Google, Microsoft or Apple, that company confirms who you are. If you turn on push notifications, they go through Apple's and Google's push services and can include a task title. Google also serves the fonts our pages use, so Google sees your IP address when a page loads.
• Wearable makers: if you connect them, Oura, WHOOP, Fitbit or Garmin send us the figures you allow.
• Free public services your device contacts directly: Aladhan (prayer times) and Open-Meteo (weather and city search) receive the coordinates or the city you use. BigDataCloud turns coordinates into a city name in Profile. The scripture readers contact alquran.cloud, Sefaria, bible-api.com, GurbaniNow and the Bhagavad Gita API. These services see your IP address and what you asked for, which for scripture is the book, chapter or verse you opened. They are not our processors and have their own privacy notices.
• Public services our server contacts: Open-Meteo and Wikipedia, with only the place name or the subject of a question (section 5).
• Apps you connect to Atlas: if you connect another app to your account, for example an AI assistant such as Claude or ChatGPT, it holds a key that can read and change everything in your Atlas account, as the consent screen says before you allow it. That app is not our processor: its own terms apply to what it does with your data. You can disconnect it at any time in Settings, under Connected apps. It then cannot get a new key, and a key it already holds stops working within an hour.
• Other Atlas users: when you delegate a task, share with your family group or are added to one, the people involved see what is shared. Someone who knows your email address, username or Atlas ID can find your account to delegate a task to you or invite you to a family group. They see your name, Atlas ID, username, profile photo and a shortened form of your email address, unless they typed your full address themselves.

Your account data is stored on Microsoft Azure servers in Denmark, in the European Union. Backup copies are also kept on Microsoft Azure servers in the European Union. Talk to Atlas turns your voice into text in Microsoft's UK South region, in London, and turns Atlas's replies into speech in Microsoft's West Europe region, in the Netherlands.

Some of the services in section 7 process data in other countries, including the United States. Our team may also reach Atlas from outside the UK and the EU, for example to fix a fault or answer a support request. Where personal data leaves the UK or the EU, we rely on the safeguards the law allows: an adequacy decision, such as the one for the EU and the UK, or standard contractual clauses with the UK addendum.

A small number of Atlas staff have admin access, so they can keep the service running and help when you ask for support.

• An admin who has set up a second sign-in step must pass it before any admin tool works.
• Everything an admin looks at or changes is recorded in a log that cannot be edited or deleted through Atlas.
• Most admin screens show only totals, such as how many people signed up this week. No names or emails.
• Support staff can open an account, for example to help with an email that did not arrive. They must state why before they see it, that reason is logged, and Atlas emails you to say your account was opened, unless your address used the link to stop all email from Atlas (section 10). They see your name, time zone, the titles of your tasks and delegations, their dates and status, and counts.
• The admin tools do not show your health data, medical records, wellbeing entries or faith entries. They show only whether health data exists.
• The few people who run the servers can technically read stored data. They use that access only to keep the service running and to fix faults.
• While the app is open, it tells Atlas which platform you use and which area of the app you are in, so we can see how many people are online. It never sends what is on your screen or what you type. Only admins can see this signal with names, and only while you are online.

• Emails to you: Atlas emails you to confirm your address, to reset your password and about your account. It can also send tips about features you have, a weekly review if you turn it on, and news about Atlas. In the UK, the EU, the EEA and Switzerland, and wherever we cannot tell where you are, we send news only if you agree. Elsewhere you can stop it with one click. You can turn each kind of email off.
• Emails for other people: Atlas can email a person who does not use Atlas when an Atlas user gives us their address, for example to invite them to take on a delegated task or to join a family group. The email comes from Atlas and names the person who asked us to send it. While the task is still open we may send reminders about that same task, and we tell the person when reminders stop. We do not create an account for them.
• Every email, except sign-in and account security emails, has a link to stop all further email from Atlas to that address. Sign-in and account security emails are the ones that confirm your email address, invite you to Atlas, sign you in, reset your password, give you a security code, confirm a change of email address, or tell you that your password or email address was changed.
• We keep a record of each email (the address, which kind of email, and whether it was delivered), so we do not send duplicates and so the stop link keeps working. If you have no Atlas account and want that record removed, email privacy@atlaspa.app. An address that asked us to stop stays on a do-not-email list, so we do not write to it again, apart from sign-in and account security emails.

• We keep your data for as long as your account is open. Error reports are deleted after 30 days.
• You can delete individual items in the app at any time.
• To delete your account, open Profile, choose Delete account, and type DELETE. We then immediately and permanently delete your account and the data you created in Atlas, including the files and photos you uploaded, your sign-in record and the emails we queued to your address. If you have a subscription that can still renew, cancel it first: Atlas will not delete an account that can still be charged.
• If you cannot sign in, or you would rather ask us, email privacy@atlaspa.app from the address on your account. We will delete your account within 30 days of confirming it is yours.
• A large data export is kept in private storage so you can download it. The link works for 24 hours. We replace the file when you export again and delete it when you delete your account.

What stays after you delete your account:

• Where you appear in another user's data, for example a task they delegated to you or a family connection they created, we keep their record but remove its link to your account. A name or email address they typed in themselves stays in their record. Anything you wrote on their delegation timeline stays with them, without your name.
• The log of admin actions (section 9) is kept, because it is the record of what staff did. It holds only a random account number, never your name, email or content, so once your account is gone it no longer points to you.
• A list of deleted account numbers and the time of each deletion. It lets us delete those accounts again if we ever have to restore a backup.
• Addresses on our do-not-email list stay there, so the opt-out keeps working.
• Paddle keeps records of your purchases, such as invoices, where the law requires it.
• Deleting your account does not send a deletion request to the services in section 7. Anything they keep is kept under their own terms. To remove Atlas's access to your Google, Microsoft, Apple or wearable account, do it in that account's security settings.
• Copies of your data stay in our backups after you delete your account. We will set a fixed period after which backups are deleted, and state it here. Until then, backups are kept. If we ever restore one, we first delete again every account that was deleted after that backup was made.

You can ask us to:

• give you a copy of your data;
• correct data that is wrong;
• delete your data;
• give you your data in a portable format;
• restrict how we use your data, or object to a use based on legitimate interests;
• stop using your data for news about Atlas;
• withdraw your consent at any time, for AI features and for your health data (section 4). This does not affect what we did with your consent before you withdrew it.

We answer within one month.

To get a copy of your data, open Settings in the app, go to Your data, and choose Download my data. You get a ZIP file with everything Atlas holds about you: one JSON file per kind of record, spreadsheets (CSV) of your tasks, delegations, prayers and health logs, your uploaded files and photos, and a README that explains each file. Very large files are listed with a download link that works for 24 hours. Secrets such as sign-in tokens and saved keys are left out, and where someone else's record points at you, you get what the app already shows you, not their private notes. You can download once every 10 minutes. In the iPhone and Android apps the file opens in your browser to save.

To correct your data, change it in the app or email us. You can delete items and your account yourself in the app.

Atlas does not use advertising or analytics cookies. Your sign-in session and your settings are kept in your browser's local storage on your own device, so you stay signed in. Clearing your browser data signs you out. While you connect a wearable, Atlas sets a short-lived security cookie (about ten minutes) to protect that step. When you open Paddle's checkout, Paddle's own scripts run under Paddle's notice.

Atlas is not for children under 13. We do not knowingly collect data from children under 13. If you think a child under 13 has an account, email privacy@atlaspa.app and we will delete it.

Atlas is served over an encrypted connection (HTTPS). Every person's records are separated in the database itself, so one person cannot read another's, apart from what they choose to share. Calendar and wearable access tokens stay on Atlas's servers, and your browser cannot read them. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the regulator as the law requires.

If we change this policy in a way that matters to you, we will tell you in the app the next time you open it after the change is published. The version and the date of this policy are shown at the top of this page, and earlier versions are kept.

If you are unhappy with how we handle your data, email privacy@atlaspa.app first, so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the European Union, to the data protection authority where you live.