Privacy Policy

ATLAS is a training tracker run by one person as a personal project — not a company with a marketing department. This page says plainly what it stores, who else ever sees it, and how to get it back or get rid of it. If something here is unclear, write and ask.

Who is responsible

Andriy Yemeljanov operates ATLAS at atlas.builtbythor.com. Contact: atlas@builtbythor.com.

What ATLAS stores

• Your account: your email address, and either a hash of your password (never the password itself) or, if you sign in with Google, the account identifier Google gives us.
• What you log: workouts, exercises, body measurements, food entries, notes, and the life events you choose to record — illness, injury, travel, rest, milestones.
• Your settings: units, exercise library, training programs.
• Garmin data, only if you connect a Garmin account: sleep, resting heart rate, HRV, steps, activities.

There is no advertising, no analytics, no tracking pixels and no profiling. Nothing is sold or shared for marketing. Ever.

Cookies

One cookie: atlas_session, which keeps you logged in. It is required for the site to work and it expires. There are no other cookies.

Who else can see your data

Nobody, except where a feature you use needs it:

• Google — only if you use “Continue with Google”. Google tells ATLAS your email address and a stable account identifier; ATLAS tells Google nothing about your training.
• Resend — sends account emails (confirmation, password reset). It sees your email address and the message.
• Open Food Facts — when you search for a food or scan a barcode, the search term or barcode is sent to their public database. Your identity is not.
• Anthropic — only when you press “Ask” in the Coach tab. A summary of your recent training is sent so the question can be answered, and the answer comes back to you. It is not used for anything else.
• Google Fonts — the pages load two typefaces from Google's font servers, which means Google sees your IP address when a page loads.
• A hosting provider — ATLAS runs on a rented virtual server (DigitalOcean). They hold the machine, not a copy of the data.

Data is not sold, rented or handed to anyone else, except where the law requires it.

Where it lives and for how long

Everything is stored in a single database on that server, reachable only over HTTPS. It stays there until you delete it. Passwords are stored as scrypt hashes; sessions expire, and resetting your password invalidates all of them at once. No system is perfectly secure, and this one is honest about being small.

Your data is yours

• Export: one click in the app downloads everything you have logged as a JSON file. No lock-in.
• Correction: anything you logged can be edited or deleted in the app.
• Deletion: email the address above and the account and all of its data are deleted.
• Access and complaint: ask what is held about you and you will be told. If you are in the EU or UK, you may also complain to your data protection authority.

Children

ATLAS is not intended for anyone under 16.

Changes

If this policy changes, the new version appears here with a new date. A change that meaningfully affects you will also be emailed to you.