Traveler searches do not publish your private plans. You choose what to share, can manage permissions in your account and can contact us to exercise your rights.
1. Controller and contact
The data controller is identified in the contact section on this page. Use that email for privacy questions, personal data requests or reviews of moderation measures.
2. Data we process
Account and authentication: name, email, username, language, hashed password, sessions and, if you link Google, that provider's identifier and email. Profile: photos, cover image, country, languages, interests and social links you choose to provide. We do not receive your Google password.
3. Trips, communication and documents
We process destinations, dates, stops, place coordinates, notes, invitations, members, permissions, messages and reactions. Expense splitting and budgeting use amounts, participants, balances, descriptions and documents or receipts you attach. Avoid including third-party personal data without an appropriate reason for sharing it.
4. Purposes and legal bases
Data needed for accounts, plans and requested features is processed to perform the service. Security, fraud prevention, moderation and technical improvements rely on our legitimate interests, balanced against your rights. We also comply with applicable legal obligations. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing; device permission does not replace the required legal basis.
5. Location and discovery
Location supports features you enable, such as automatic passport updates, maps and discovery. Public discovery availability uses an approximate area and expires after 24 hours unless enabled again. You can disable it. Teleport searches another destination without changing your real GPS. Matching plans uses public plan authors and their dates or dated stops; it does not publish your plan or location.
6. Sharing and visibility
Your profile and public fields may be visible to other users through community and sharing screens. Public plans, shared routes and associated information may be viewed through public features. Private plans remain subject to owner, member and invitation permissions. Conversation content is accessible to recipients; reported content may be made available to authorised moderators. We do not sell your personal data.
7. Providers and international transfers
Depending on enabled features and service configuration, providers support hosting and databases, file storage, Google authentication, maps/geocoding/routing, email, real-time communication, notifications and payments (such as Google Play or Stripe). They receive data needed for their service and may process technical data such as IP addresses. Transfers outside the European Economic Area require applicable safeguards, such as adequacy decisions or standard contractual clauses; contact us for information about relevant safeguards.
8. Purchases and subscriptions
We store provider references, products, status, dates and information needed to verify purchases, renewals and refunds. Full card details and payment credentials are handled by the payment provider rather than ATLAS forms. Manual plan assignments are recorded separately with administrative audit information.
9. Cookies, storage and notifications
We use session cookies and storage needed for authentication, language, appearance and app functionality. Offline features may keep data on your device. Push notifications depend on your choices and device permissions; manage them in preferences or your operating system. Any non-essential technologies requiring consent should only be enabled after that consent.
10. Retention and deletion
We retain account data and content while needed for the service or stated purposes. You can initiate account deletion in account settings. Some records may be retained for legal obligations, security or establishing legal claims. Planned operational limits include identifiable activity up to 120 days, aggregates without account identifiers up to 400 days, evidence for closed reports up to 180 days after the last decision and administrative audit records up to 730 days. Removal relies on retention routines; backups follow their expiry cycle.
11. Security and decisions
We apply authentication, server-side permissions, password protection and administrative access controls. No system is risk-free. Administrative sanctions can be challenged through the contact on this page. Route suggestions and plan matches are assistance features, not exclusively automated decisions producing legal effects.
12. Your rights
Where applicable, you may request access, rectification, erasure, restriction, portability or object to processing. You may withdraw consent and complain to a supervisory authority, including Portugal's CNPD or the competent authority in your country. We may request proportionate information to confirm your identity. Rights requests are generally answered within one month, subject to legally permitted extensions.
13. Changes
The date on this page identifies the current version. Material changes will be communicated appropriately for their impact through the platform or your account contact details.
Contact and resources
For questions about these documents, personal data requests or complaints, contact info@atlastribe.app.