Atlas — Privacy Policy & Data Collection
Last updated: 2026-07-16
Atlas ("the app", "we") is a themeable navigation and map-exploration app, currently available as a web app (PWA) at https://fogmap-pwa.vercel.app. Atlas does use and, if you opt in, collect location and destination data, so we disclose it plainly. This policy explains exactly what data we use, why, which third parties receive what, how long it is kept, and how you stay in control.
Summary
- Atlas needs your location to work as a map/navigation app.
- Your location and explored map stay on your device — they are never uploaded.
- Cloud data collection (backing up your distance-traveled total + logging the destinations you set, routes, arrivals, and hazard-report categories) is strictly opt-in and part of Atlas Plus. Decline and the app runs fully on-device — nothing is sent to our cloud.
- To draw the map, search places, plan routes, and show live traffic, Atlas sends the minimum necessary data to third-party map/navigation providers whenever you use those features — see "Third parties" below. This is part of core map functionality and happens even in local-only mode.
- No name, email, phone, contacts, or photos. No advertising identifiers. No cross-app or cross-website tracking. We never sell your data.
- You can erase all your data (local + cloud) anytime from inside the app.
What data is involved
| Data | Purpose | Where it goes |
|---|---|---|
| Precise / approximate location (while the app is open) | Show your position, follow you, draw routes, and uncover the explored map | Stays on your device; sent to map/routing/traffic providers to render those features. Not backed up to our cloud. |
| Explored areas (coordinates you have visited) | Draw your fog-of-war / exploration map | Device localStorage only —
never uploaded |
| Distance-traveled total (a single number of meters) | The "Distance driven" stat, surviving reinstalls | Device storage; our cloud
(Supabase atlas_progress) only if you opt in |
| Destinations you search (text + result coordinates) | Place search and route guidance | Sent to the search provider (Photon) to return
results; logged to our cloud (Supabase atlas_events) only if you opt in |
| Routes you start, arrivals, and hazard-report categories | Turn-by-turn guidance; basic product analytics | Start/destination coordinates sent to the routing provider (OSRM); the event (with the hazard category, not the marker location) is logged to our cloud (Supabase) only if you opt in |
All cloud rows are keyed to a random device identifier generated on your device — not to your name or identity. There is no login and we never ask who you are.
What we do NOT collect
- No name, email address, phone number, contacts, calendar, or photos.
- No advertising identifiers (IDFA); no ad SDKs.
- No cross-app or cross-website tracking — so the iOS app does not require App Tracking Transparency (ATT).
- We never sell your location or any other data.
Third parties we share data with
To function as a map, Atlas sends the minimum data needed to the service providers below. These providers act as processors to render tiles, search, routes, and live traffic — they are not used for advertising and we do not authorise them to use your data to track you across apps. Map, search, routing, and traffic providers receive data whenever you use those features, regardless of whether you opt into our cloud backup; only Supabase is gated behind your opt-in consent.
| Provider | What it receives | Why | Privacy policy |
|---|---|---|---|
| OpenFreeMap / OpenStreetMap | The map area (viewport) you view | Vector map tiles, fonts, sprites | openfreemap.org · OSMF |
| Photon (komoot) | Your search text + a nearby coordinate to bias results | Place search / geocoding | komoot.com/privacy |
| OSRM (router.project-osrm.org, routing.openstreetmap.de) | Your start + destination coordinates | Drive / walk / cycle routes | Project OSRM (community-run) |
| TomTom | A bounding box around your active route (i.e. your route/ location) while navigating | Live traffic incidents / hazards ahead | tomtom.com/privacy |
| Supabase (only if you opt in) | Distance total, destinations you set, routes, arrivals, and hazard-report categories — keyed to your random device ID (never your explored map) | Private cloud backup + basic analytics | supabase.com/privacy |
We do not control these providers' own server logs; we send them only what is needed to render tiles, search, routes, and traffic. Data stored in our cloud is isolated per device by database row-level security and is deletable at any time.
Retention
- On your device: explored points and preferences stay in your browser's
localStorage(or the iOS app's local storage) until you erase them or remove the app. - Our cloud (Supabase): if you opt in, your rows are kept until you erase them via "Erase all my data" (or on request). There is no fixed expiry — you are in control.
- Third-party providers keep their own transient request logs under their own policies (linked above); we do not receive or store those.
Your controls & rights (GDPR / CCPA)
- Decline collection: choose "Use locally only" — the app runs entirely on-device and sends nothing to our cloud.
- Erase everything (right to deletion): open Privacy & data collection → "Erase all my data" to delete local data and remove your device's cloud rows (GDPR Art. 17 / CCPA deletion).
- Access / portability: your explored points live in your device storage and, if opted in, in Supabase rows keyed by your device ID; email us to request a copy.
- Revoke location: turn off location for Atlas in your browser or iOS Settings at any time.
- No sale / no cross-context behavioural advertising: we do not sell or share your data for advertising (CCPA/CPRA).
Legal basis (GDPR) & children
Different processing rests on different lawful bases:
- Core navigation — sending your coordinates to our map, search, routing and traffic providers to draw the map and route you — is necessary to deliver the service you asked for: performance of a contract (Art. 6(1)(b)) and our legitimate interest (Art. 6(1)(f)) in providing navigation. It happens whenever you use those features, including in local-only mode, and does not depend on consent.
- Cloud backup & usage analytics (Supabase) is based on your consent (Art. 6(1)(a)), which is optional and which you may withdraw at any time in the privacy panel; withdrawing stops that collection going forward.
Atlas is not directed to children under 13 and does not knowingly collect their data.
Contact
Privacy requests: traguyinvests@gmail.com
Changes
We will update this page and the in-app policy when practices change; the "Last updated" date above reflects the latest revision.