Privacy Policy

The exact list depends on whether you are just browsing or using account features.

Basic product analytics: page path, locale, a random view ID, active page duration, customization actions, and coarse country/region codes from trusted hosting-edge headers.

Export and reliability details: map/style identifier, output format, dimensions, PNG DPI, SVG precision when relevant, selected layers and settings, status, processing time, file size, user agent, and a one-way client-IP hash.

Accountless purchase details: the exact map configuration, Stripe checkout and payment references, product and amount, payment status, download count and timestamps, and a one-way hash of the random browser access token. Stripe processes checkout email, billing address, and card details; CustomAtlas does not store full card numbers.

Account details when you sign in: a Clerk account identifier and primary email address, plus onboarding and optional newsletter-consent status.

Saved-map details when you use account features: map name, map configuration (which may include quiz or worksheet text you enter), timestamps, recovery versions, export history, share settings, and invited collaborator email addresses.

Feedback details when you send a report or request: the text you submit, relevant page and map context, your account identifier when signed in, and coarse country/region codes. Feedback does not collect an email address.

We use this information to provide requested features and to operate, secure, and improve the service.

Generate requested SVG, PNG, and PDF exports.

Save, autosave, restore, share, and export account-saved maps.

Authenticate accounts, manage sharing permissions, and record and honor optional newsletter consent.

Monitor reliability, troubleshoot failures, improve performance, prevent abuse, enforce rate limits, and maintain platform security.

We do not sell personal data or hand it to advertisers. Data is shared with service providers only as needed to deliver the product, protect it, or comply with the law.

Clerk provides account authentication, Stripe processes payments and receipts, and Supabase hosts account data, accountless purchase records, map assets, export history, and analytics storage.

Our hosting or edge provider may provide coarse country/region headers and process requests as part of delivery and security.

Shared maps are visible to people you invite or anyone with a link, depending on the setting. Edit access is limited to invited editors.

Professional advisors or authorities when legally required.

Where data-protection law requires a legal basis, we process data to perform our contract with you (accounts, saved maps, sharing, and exports), for legitimate interests in operating, securing, and improving a limited-data service, to comply with applicable legal obligations, and with consent for optional newsletters. You may withdraw newsletter consent at any time.

CustomAtlas and its providers may process information in the United States and other countries. Where required, providers use recognized transfer mechanisms and contractual safeguards. Their own privacy notices describe their locations and safeguards in more detail.

Saved maps and their recovery versions remain in your account until you delete the saved map. Export history, analytics events, and other operational records do not currently have a fixed public deletion schedule; they are retained for reliability, security, abuse prevention, and legal obligations, and reviewed periodically for deletion as the service evolves.

Depending on your jurisdiction, you may request access, correction, deletion, or objection to processing. Some controls are already available in the product.

Delete saved maps and their recovery versions from My Maps.

Withdraw optional newsletter consent from account settings.

Request access, correction, or deletion of personal data by email. We may need to verify the request.

Ask questions about how your data is processed.

Complain to your local privacy or data-protection authority where that right applies.

CustomAtlas is not directed to children under 13, and we do not knowingly collect personal data from children.

We use same-origin checks, input validation, rate limits, account authorization, provider access controls, and server-side export processing to help protect the service and the information it handles. We review and improve these controls as the service develops.

We may update this policy as our practices or legal requirements change. Updates are effective when posted here.