Privacy notice
Last updated
This notice explains what personal data The Atlas Index uses, why, and the choices you have.
Who we are
The Atlas Index is run by Benjamin Morgan in the United Kingdom. Benjamin Morgan is the controller of your personal data, which means deciding how it is used. In this notice, “we” and “us” mean Benjamin Morgan.
Contact us about anything in this notice at info@benjmorgan.com.
What you can do without an account
You can browse the map, search and read about places without signing in. You only need an account to save places and make lists. Sharing your location and allowing analytics are both optional.
What we use and why
Keeping the site running and protected
- Like any website, our servers receive your IP address and browser details with each request.
- When the site loads, and whenever you aren’t signed in, it first checks that your browser looks like a real visitor’s. Your browser sends details such as its type, language, time zone and screen size. We check them and don’t store them. Sometimes your browser also solves a small puzzle in the background.
- Your browser then gets an access token that lasts 15 minutes and is kept only in the open page. It contains a random ID and hashes of your IP address and browser details. A hash is a code calculated from a value. It can still be matched back to that value, so we treat it as personal data.
- We count requests per IP address, account and session to apply rate limits. These counts are kept only in our server’s memory, for up to 24 hours.
- If an IP address sends traffic that looks automated or abusive, we record that address in our server logs.
Why: to keep the site available and to stop bulk copying of our data. Lawful basis: our legitimate interests in running a secure service.
Server logs
Our hosting records technical details about requests to our servers, such as the address requested (including the links of shared lists you open), the response and how long it took. Our monitoring uses your IP address to work out an approximate location (country and city) and then discards it, except for the flagged addresses described above. If a place search fails at our map provider, the search text is written to these logs. Logs are kept for up to 90 days.
Why: to find and fix faults and abuse. Lawful basis: legitimate interests.
Search
When our own data has no matching area, or you press Enter without choosing a suggestion, our server sends what you typed in the search box to Mapbox to find places and areas. We don’t store your searches in our database. Lawful basis: legitimate interests, to provide search.
The map
The map comes from Mapbox. Your browser downloads map images, styles and fonts directly from Mapbox, so Mapbox receives your IP address, browser details and the area of the map you look at. Mapbox’s map software also keeps a random identifier in your browser and reports map loads to Mapbox, which uses them to count usage. We have turned off its optional performance reporting. See the Mapbox privacy policy. Lawful basis: legitimate interests, to show the map.
Near Me
Near Me uses your device’s location only if you allow location access when your browser asks; otherwise it measures from the centre of the map. Your position is used in your browser to sort and filter places and to show where you are. It isn’t sent to our servers or saved to your account. When the map moves to your area, Mapbox provides the map for that area. You can turn location access off at any time in your browser settings.
Your account
- You can sign in with Apple, Google, Microsoft or an email address. Sign-in is provided by Auth0 (part of Okta), which keeps your sign-in details, such as your email address and any name your provider shares, and a record of your sign-ins (such as the time, IP address and browser), in its EU region.
- If you sign in with Apple, Google or Microsoft, that company also handles your sign-in under its own privacy policy.
- When you first sign in, we create an account record with your Auth0 user ID, your email address, and when the record was created and last updated.
Lawful basis: providing the account you asked for (contract). We keep your account until you ask us to delete it.
Your lists
- We store your lists (including Want to go, Visited and Recommended), their names and descriptions, the places in them, and whether each list is Private, Shared via link or Public. We also store your answers to “Would you recommend this place?”.
- Anyone who has the link to a list that is Shared via link or Public can see it without signing in. They see the list’s name, description and places, but not your name or email address. Signed-in visitors can copy a shared list into their own account.
- Making a list Private stops its link working; if you share it again, the same link works again. Copies other people have already made stay with them.
Lawful basis: contract. We keep your lists until you delete them or we delete your account.
Reporting a problem with a place
When you use Report an issue on a place, we store which place it is, the problems you choose, when you reported them, and hashes of your IP address, your browser details and, if you aren’t signed in, your temporary session ID. We use them to spot duplicate reports and abuse. If you’re signed in, the report is also linked to your account. We don’t delete reports automatically yet; ask us if you want reports linked to your account deleted. Lawful basis: legitimate interests, to keep place information accurate.
Optional analytics (Microsoft Clarity and Google Analytics)
Only if you choose Allow when we ask about analytics, we load Microsoft Clarity. It sets cookies and records how you use the site, for example clicks, scrolling and the pages you visit, as heatmaps and session replays, so we can improve the site. We don’t use it for advertising. Clarity never records a shared list page, and if analytics is on when you open a shared list link, it stays off for the rest of your visit in that browser tab. Microsoft handles this data as described in the Microsoft Privacy Statement.
The same choice also loads Google Analytics. It sets cookies and measures visits, so we can count them and see which pages are used and how visitors arrive, for example from a search engine or another site. Google receives the pages you view and some of what you do on them, such as scrolling and clicking links to other sites. It also receives your IP address and your device and browser details, and works out your approximate location. We have turned off its Google signals and ad personalisation settings, and we don’t use it for advertising. Like Clarity, it never runs on a shared list page, or for the rest of your visit in a browser tab after you open a shared list link. Google handles this data as described in the Google Privacy Policy.
Lawful basis: your consent. To withdraw it, choose Cookies at the bottom of the map or in About, then Reject. We stop Clarity and Google Analytics and delete their cookies on our site.
Cookies and similar storage
Needed for the site to work:
- Sign-in, only if you sign in: Auth0 keeps your sign-in tokens in your browser’s local storage, briefly keeps your sign-in progress in session storage while you sign in, and sets two cookies that last a day to remember you’re signed in. Auth0 also sets cookies on its own sign-in pages.
- Your analytics choice, in local storage.
- A marker that keeps analytics off in a tab where you opened a shared list, in session storage (cleared when you close the tab).
- Mapbox’s identifier, in local storage, and its cache of map images.
- Your settings, in local storage: menu layout, Near Me radius, whether you declined location access, list order, and which updates you’ve already seen.
- Your recent searches, in local storage: the last few venues, places and stations you picked in search. They stay in your browser, and Clear in the search drawer removes them.
Optional, only with your consent: Microsoft Clarity’s cookies _clck (kept for up to a year) and _clsk (one day), and Google Analytics’ cookies _ga and _ga_ followed by our site’s Google Analytics ID (each kept for up to two years). Microsoft and Google may also set cookies on their own domains.
Who we share data with
These service providers process data for us:
- Microsoft Azure: hosting, database, backups and server logs, in its West Europe region (the Netherlands); the website’s files are delivered through Azure’s global network.
- Auth0 (Okta): sign-in, in its EU region.
- Mapbox: maps and place search, in the United States.
- Microsoft Clarity: optional analytics, only with your consent, in the United States.
- Google Analytics: optional analytics, only with your consent, in the United States.
- GoDaddy: redirects visitors who type theatlasindex.com without “www” to the site, in the United States.
As sign-in providers, Apple, Google and Microsoft are involved only if you sign in with them. We don’t sell your personal data.
Data outside the UK
Azure stores our data in the Netherlands and Auth0 stores sign-in data in its EU region. UK law recognises the European Economic Area as giving adequate protection. Mapbox, Microsoft Clarity, Google Analytics and GoDaddy process data in the United States. Mapbox, Microsoft, Google, Auth0 and GoDaddy are certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which UK law also recognises as adequate.
How long we keep data
- Account and lists: until you delete them or ask us to delete your account.
- Server logs: up to 90 days.
- Automatic database backups: 14 days, so deleted data leaves them within 14 days.
- Reports about places: no automatic deletion yet (see above).
- Rate-limit counts and abuse flags: in our server’s memory only, for up to 24 hours.
- Access tokens from the browser check: only in the open page, for up to 15 minutes.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
There isn’t a self-service way yet to download your data or delete your account (you can delete your own lists in the app). Email info@benjmorgan.com from the address you sign in with. We’ll reply within one month, or tell you within that month if we need longer, as the law allows.
Automated decisions
We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. Our protection against automated traffic can slow down or block requests that look automated. If you think you’ve been blocked by mistake, email us.
Complaints
Please tell us first at info@benjmorgan.com. We’ll acknowledge your complaint within 30 days. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.
Changes to this notice
When we change this notice, we’ll update the date at the top.