Privacy
Last updated 2026-09-17
You can use every map without an account. An account uses one necessary session cookie. The site has no analytics or ads.
What the site collects about you
You do not need an account to use a map. If you make an account, Atlas stores your verified email address, display name, sign-in provider, provider user id and sign-in times.
Atlas does not store your password or an access token from a sign-in provider. It uses the access token once to read your identity, and then discards it.
For an email sign-in, Atlas stores a hash of the one-use link until the link expires or you use it. It also stores short-lived keyed hashes to limit repeated requests. The hashes do not contain the email address or network address that made the request.
The session cookie
After you sign in, Atlas sets one first-party cookie named atlas_session. It holds a signed user id, email address, display name, session version and the maps that the account can use. It expires after seven days.
The cookie is Secure, HttpOnly and SameSite=Lax. Script on the page cannot read it, and the browser does not send it in most requests that start on another site.
This cookie is necessary for sign-in, so Atlas discloses it and does not ask for consent. The site sets no analytics, ad or marketing cookie. It writes nothing to local storage, session storage or IndexedDB.
Your save file never leaves your computer
Every map can read a saved game. You pick a file, and the page fills its panels from what the file says.
That file is read in your browser. It is not uploaded, not copied to a server and not sent anywhere. The page keeps it in memory for as long as the tab is open, and forgets it when you close the tab or load another file.
This is not only a promise. Every page ships a Content Security Policy with connect-src set to none, which tells your browser to refuse any outbound request the page tries to make. You can read the policy in your browser network tools. If the page ever tried to send your save somewhere, your browser would block it and log the request.
What the web host records
The site is served by Cloudflare Pages. Like any web server, it records the request: the IP address it came from, the time, the address asked for, and the browser identification string. Cloudflare uses these to deliver the page and to protect the service from abuse.
The owner of this site reads only the totals that Cloudflare shows in its dashboard, such as how many people opened a map. No script on the page produces those figures. The server counts them from requests it has already handled.
Cloudflare states its own retention and handling in the Cloudflare Privacy Policy.
Account services
You can sign in with Google, Discord, Twitch or GitHub. If you select one, that provider receives the sign-in request and applies its own privacy policy.
You can also ask for a one-use email link. Resend receives the email address and the message so that it can deliver the link.
Cloudflare Pages serves the site, Cloudflare Workers runs the account routes, and Cloudflare D1 stores the account records.
Each map stays one self-contained HTML file. It loads no account service, content delivery network, web font or social media widget.
- no tag manager, ad network or tracking pixel
- no error reporting or session replay service
Children
The maps need no account. An account asks only for the identity data that this page names.
Changes to this page
If the site ever starts to collect something, this page changes first and the date at the top changes with it. The public commit history records the change, so nobody can alter the wording quietly.
Contact
Write to this address with any question about this page.