Privacy
Last updated 2026-10-14
You can use every map without an account. An account uses one necessary session cookie. The site has no ads and no analytics script. The server counts map visits as daily totals that do not identify you.
What the site collects about you
You do not need an account to use a map. If you make an account, Atlas stores your verified email address, display name, sign-in provider, provider user id and sign-in times.
Atlas does not store your password or an access token from a sign-in provider. It uses the access token once to read your identity, and then discards it.
For an email sign-in, Atlas stores a hash of the one-use link until the link expires or you use it. It also stores short-lived keyed hashes to limit repeated requests. The hashes do not contain the email address or network address that made the request.
When a sign-in makes a new account, Atlas also records the country of that request, as Cloudflare gives it, and the sign-in provider. Atlas deletes this record with the account.
Each map offers a short guided tour. When you finish or close the tour of a map while you are signed in, Atlas stores that fact, the map and the time. The map then does not offer the tour again. Without an account, the site does not remember the tour.
The session cookie
After you sign in, Atlas sets one first-party cookie named atlas_session. It holds a signed user id, email address, display name, session version and the maps that the account can use. It expires after seven days.
The cookie is Secure, HttpOnly and SameSite=Lax. Script on the page cannot read it, and the browser does not send it in most requests that start on another site.
Each map uses the signed session to select the page your account can use. The old atlas_tiers cookie is no longer used. Atlas removes it when you sign in, open your signed-in account, or open a map.
This cookie is necessary for sign-in, so Atlas discloses it and does not ask for consent. The site sets no analytics, ad or marketing cookie. It writes nothing to local storage, session storage or IndexedDB.
Your save file never leaves your computer
Every map can read a saved game. You pick a file, and the page fills its panels from what the file says.
Your browser reads that file. The page does not upload it, copy it to a server or send it anywhere. The page keeps it in memory while the tab is open. It forgets the file when you close the tab or load another file.
This is not only a promise. Every map ships a Content Security Policy with connect-src set to self. That policy tells your browser to refuse any request to another server. The portal and these documents set connect-src to none. You can read the policy in your browser network tools.
A map page sends a request to this site in two cases only: you press Share, or you open a share link. The next section says what a share holds.
Shared maps
If your account can load saves on a map, you can press Share after you load a save. The page then sends the result that it read from the save to Atlas. It does not send the save file.
That result holds what the page shows: who owns each part of the map, the country names and colours, and the figures in the panels. Atlas stores it in Cloudflare R2, with your user id, the map, the played country, the date in the game and the time you shared it.
Anyone who has the link can open the shared map, with no account. The link preview shows the played country and the date. It does not show your name or email address.
Your account page lists your shared maps. You can delete each one there. When you delete your account, Atlas deletes your shared maps too. Atlas can remove a shared map that a viewer reports.
Atlas keeps a shared map until you or Atlas delete it.
What the web host records
Cloudflare Pages serves the site. Like any web server, it records the request: the IP address it came from, the time, the address asked for, and the browser identification string. Cloudflare uses these to deliver the page and to protect the service from abuse.
The owner of this site reads the totals that Cloudflare shows in its dashboard, such as how many people opened a map. No script on the page produces those figures. The server counts them from requests it has already handled.
The site's own server also counts each map page that it sends. It adds one to a total for the day. The total names the map, the access level of the page, the country that Cloudflare gives for the request, and the website that linked to the map, if the browser states one. It also notes a link preview or a search crawler. The total does not hold your IP address, your account, a cookie or your browser identification string, so it cannot identify you.
The Cloudflare Privacy Policy states how long Cloudflare keeps that record and what it does with it.
Account services
You can sign in with Google, Discord, Twitch, GitHub or Patreon. If you select one, that provider receives the sign-in request and applies its own privacy policy.
You can also ask for a one-use email link. Resend receives the email address and the message so that it can deliver the link.
Cloudflare Pages serves the site, Cloudflare Workers runs the account routes and selects map access, Cloudflare D1 stores the account records, and Cloudflare R2 stores the shared maps.
Each map stays one self-contained HTML file. It loads no account service, content delivery network, web font or social media widget.
- no tag manager, ad network or tracking pixel
- no error report or session replay service
Payments
You pay for a tool through PayPal, by card or with a PayPal account, or you pledge on Patreon. PayPal receives your payment details, your email address and your country, and applies its own privacy policy. This site never receives a card number.
If you connect a Patreon account, Patreon tells this site your Patreon user id, your email address and the tiers your pledge covers. Atlas stores the user id and the email as a sign-in identity, like the other providers.
The provider tells this site which subscription you hold and when it renews or ends. Atlas stores that fact, the subscription identifier and your account identifier. It stores no payment detail.
Atlas keeps the subscription record and the record of each provider message for as long as your account exists. If you delete your account, Atlas deletes them with it. The provider keeps its own record of the payment under its own policy, and Atlas cannot delete that.
No payment detail reaches a map page. Each game has one address. Atlas uses your session to serve the free map, paid modes, or paid tools at that address. Free maps show blurred previews of paid modes. Tools pages include the save reader.
Children
The maps need no account. An account asks only for the identity data that this page names.
Changes to this page
If the site ever starts to collect something, this page changes first and the date at the top changes with it. The public commit history records the change, so nobody can alter the wording quietly.
Contact
Write to this address with any question about this page.