Privacy notice

Atlas VTT is run by Fabian Urbanek (“we”). Write to support@atlas-vtt.dev about anything in this notice.

We have no data protection officer. At our size the law does not ask for one (§ 38 BDSG).

Cloudflare hosts atlas-vtt.dev, as our processor (Workers static assets). For each request it handles your IP address, the time, the address you asked for, the page you came from and your browser’s description of itself. It answers from the data centre nearest to you, which may be outside the EU. Without this the pages cannot reach you or be kept safe from attacks, which is our legitimate interest (Art. 6(1)(f) GDPR). Cloudflare shows us totals, such as requests per day. The website itself keeps no logs of single requests. Cloudflare’s protection keeps a request it blocked or challenged for up to 31 days.

The search in the guides runs in your browser. What you type into it is not sent to us or to Cloudflare.

The website sets no cookies. It remembers your choice of light or dark pages in your browser’s local storage, under the name theme. That entry never leaves your browser and is needed for the look you chose (§ 25(2) no. 2 TDDDG). Our fonts come from our own server.

The video on the home page loads from YouTube only when you press play. Then Google Ireland Limited receives your IP address and details about your browser, may store information on your device, and may pass data to Google in the USA. Pressing play is your consent to this (Art. 6(1)(a) GDPR, § 25(1) TDDDG); without it nothing goes to YouTube. See Google’s privacy policy.

Links to Discord, GitHub, Patreon and Obsidian send nothing to them until you follow one. From then on, their own privacy policies apply.

When you email us, we use your address and your message to answer you, because answering is our legitimate interest (Art. 6(1)(f) GDPR). Our mailbox is at Apple (iCloud Mail). We delete messages once the matter is settled, unless the law makes us keep them longer.

Atlas Online is in closed beta. On the Atlas Online page you can leave your email address, and we write to you when you can join. You need no account and give no name.

What we keep

• Your email address, and the same address without a +tag, by which we count the confirmation emails of a day.
• When you signed up, when you confirmed, and when we invited you.
• Which version of the consent text you agreed to.
• Check values (hashes) of the two links in the confirmation email.
• How many confirmation emails we sent you, and when the last one went out.

We do not keep your IP address.

Confirming, and why we may

After you sign up we send you one email with a link to confirm the address. Only confirmed addresses are on the list, and an address that is not confirmed within 7 days is deleted. We keep your address to tell you by email when you can join Atlas Online, because you consented to that (Art. 6(1)(a) GDPR). As proof we keep the time you confirmed and the version of the consent text. Resend sends the emails for us.

Leaving the list

You can withdraw your consent at any time. Every email from the waitlist has a removal link, and you can also write to support@atlas-vtt.dev. Your entry is then deleted at once. Otherwise we keep it until Atlas Online is open to everyone; then we close the list and delete all entries.

Protection against abuse

The form asks Cloudflare Turnstile to check that a person is sending it. Turnstile loads only when you click into the form. It then reads details of your browser and your IP address. The check keeps the form from being used to send email to strangers, which is our legitimate interest (Art. 6(1)(f) GDPR), and it is needed for the sign-up you asked for (§ 25(2) no. 2 TDDDG).

We count requests per IP address (for IPv6 per network) for one minute, without storing the address. We also count how many confirmation emails went out on a day, in total and per mailbox, so that nobody receives email they did not ask for (Art. 6(1)(f) GDPR). The day’s total holds no personal data and is deleted after 8 days.

The Atlas VTT plugin works on your computer. It sends no usage data, and your maps, notes and settings stay in your vault. Its only network use is an image you give it by web address, which loads from that address, and the issue report you send yourself. Details are in the plugin’s privacy note.

An issue report goes to our server at Hostinger, which publishes it as a public issue on GitHub. Put nothing in it that should not be public. The server keeps a keyed hash of your IP address for 24 hours to stop abuse, and a fingerprint of each report to stop duplicates. We delete a published issue when you ask us to.

We share personal data only with these companies, for the reasons given. We sell none.

The European Commission found that companies certified under the EU-US Data Privacy Framework protect data adequately (decision of 10 July 2023). You can look up a company’s certification at dataprivacyframework.gov.

You may ask us what we keep about you (Art. 15 GDPR), and have it corrected (Art. 16), deleted (Art. 17) or its use restricted (Art. 18). You may have the data you gave us in a common format (Art. 20), and withdraw a consent at any time for the future (Art. 7(3)). Write to support@atlas-vtt.dev.

Right to object (Art. 21 GDPR): where we rely on our legitimate interest, you may object at any time for reasons arising from your particular situation. We then stop, unless we have compelling legitimate grounds that outweigh your interests, or we need the data to establish, exercise or defend legal claims.

You may complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where you believe the infringement took place (Art. 77 GDPR).

You need not give us any data. Without an email address we cannot tell you when you can join Atlas Online.

We change this notice when our services or the law change.