隐私政策

Atlas of Us（atlasof.us 网页版与 iOS App）· 生效日期 2026-09-24

一句话：我们只收集提供服务必需的数据，不含任何第三方统计、广告或追踪 SDK，不出售数据；你随时可以在 App 里删除账号和全部内容。

我们收集什么

账号信息：邮箱（登录与接收验证码所需）；昵称（可选，默认取邮箱前缀）；如果你设置了密码，只保存加盐哈希（PBKDF2），我们看不到明文；登录验证码只存哈希，10 分钟过期、使用后立即删除。网页版如使用 Apple 登录，会收到 Apple 提供的用户标识和邮箱（可以是 Apple 的隐藏邮箱）。
你主动创建的回忆：地点（坐标与地名）、日期、文字、照片、视频。
照片：上传前在你的设备上压缩并重新编码，这一步会去掉照片内嵌的 EXIF 信息（包括 GPS）。读取照片的拍摄地点和日期只在你的设备上进行，用来帮你预填这条回忆。
视频：按原文件上传，可能包含拍摄设备写入的元数据（例如位置）。
我们不收集：通讯录、广告标识符。不含任何第三方统计、广告或追踪 SDK。
网站访问统计：atlasof.us 网页（不含 App）使用我们自建的匿名访问统计，只记录访问了哪些页面、从哪里点进来、城市级大致位置（由网络推断）和设备类型；不放 cookie、不存 IP、不关联账号。
防滥用：为防止有人批量请求登录验证码，我们会临时记录请求来源 IP 的不可逆哈希值（每天更换加密盐，无法还原成 IP，也无法跨天关联），最长保留 24 小时后自动删除。

用途

仅用于提供服务：保存你的回忆，并在你和同一本地图册的成员之间同步；发送登录验证码。我们不出售数据，不用于广告，也不做用户画像。

谁能看到

你的回忆（含照片、视频、文字）只有你所在地图册的成员能看到——也就是你用邀请码请进来的人。
公开热力图：所有回忆的坐标会以取整到约 10 公里网格的匿名形式参与全站热力图。热力图不含照片、文字、地名、名字或任何账号信息，也推不出具体位置。

第三方服务

以下服务只在提供功能所必需的范围内处理数据：

Cloudflare（网站托管、D1 数据库、R2 文件存储）：存放你的全部账号与回忆数据。
Cloudflare Email Sending / Brevo：发送登录验证码邮件（Cloudflare 为主，Brevo 为备用），会收到你的邮箱地址。
地图与地址搜索：CARTO / OpenStreetMap 提供地图底图（加载时会看到你的 IP 和正在查看的区域）；OpenStreetMap Nominatim 与高德地图提供地址搜索和坐标反查（会收到你输入的搜索词或要查询的坐标）。
jsDelivr、Google Fonts：加载页面所需的开源程序库和字体，会看到你的 IP。
Apple：仅在网页版使用 Apple 登录时。

保留与删除

你的数据会一直保留，直到你删除它。
删除一条回忆：从数据库和文件存储中删除，连同它的照片和视频。
删除账号：在 App 右上角菜单点「删除账号」（网页版同一位置）。会立即删除你的账号、你创建的全部回忆及照片视频、验证码记录。你拥有的地图册：如果还有其他成员，会转交给最早加入的那位；只有你自己的，会整本删除。
数据库的自动备份（Cloudflare D1 Time Travel，始终开启、无法关闭）可能在最长 30 天内保留已删除数据的历史快照，到期自动失效；我们不会从中恢复你已删除的数据。
撤回同意 / 请求删除：随时在 App 内删除账号，或写信给我们，我们会协助处理。

儿童

本服务不面向 13 岁以下儿童。

联系我们

邮箱 [email protected] · 运营者：张颀（Travis Zhang），加拿大温哥华。政策如有修改，会更新本页的生效日期。

Privacy Policy

Atlas of Us (atlasof.us web app and iOS app) · Effective 2026-09-24

In short: we collect only what the service needs, ship no third-party analytics, advertising or tracking SDKs, never sell data, and you can delete your account and all content from inside the app at any time.

What we collect

Account: email address (to sign in and receive login codes); an optional display name (defaults to the part of your email before "@"); if you set a password, only a salted PBKDF2 hash is stored; login codes are stored only as hashes, expire after 10 minutes and are deleted once used. If you use Sign in with Apple on the web, we receive the identifier and email Apple provides (which may be an Apple private relay address).
Memories you create: place (coordinates and name), date, text, photos and videos.
Photos are resized and re-encoded on your device before upload, which strips embedded EXIF metadata including GPS. Reading a photo's capture location and date happens only on your device, to pre-fill the memory.
Videos are uploaded as original files and may contain metadata written by the recording device (such as location).
We do not collect contacts or advertising identifiers.
Website statistics: the atlasof.us website (not the app) uses our own anonymous page statistics — pages viewed, referrer, city-level location inferred from the network, and device type. No cookies, no stored IP addresses, never linked to your account.
Abuse prevention: to stop automated requests for login codes, we briefly keep a one-way hash of the requesting IP address (salted with a key that changes daily, so it cannot be turned back into an IP or linked across days). It is deleted automatically within 24 hours.

How we use it

Only to provide the service: storing your memories, syncing them among members of the same map, and sending login codes. We do not sell data, use it for advertising, or build profiles.

Who can see it

Your memories (photos, videos, text) are visible only to members of the map you share — people you invited with an invite code.
Public heatmap: coordinates of all memories contribute to a site-wide heatmap in anonymous form, rounded to a grid of roughly 10 km. It contains no photos, text, place names, names or account information, and cannot reveal a precise location.

Third-party services

These process data only as needed to provide their function, under protection equivalent to this policy:

Cloudflare (hosting, D1 database, R2 file storage) — stores all account and memory data.
Cloudflare Email Sending / Brevo — send login-code emails (Cloudflare primarily, Brevo as backup) and receive your email address.
Maps and address search — CARTO / OpenStreetMap serve map tiles (they see your IP address and the area you view); OpenStreetMap Nominatim and AMap (Gaode) provide address search and reverse geocoding (they receive the search text or coordinates you look up).
jsDelivr, Google Fonts — deliver open-source libraries and fonts; they see your IP address.
Apple — only when you use Sign in with Apple on the web.

Retention and deletion

Your data is kept until you delete it.
Deleting a memory removes it and its photos and videos from the database and file storage.
Deleting your account: open the menu (top right) and tap "删除账号" (Delete account). This immediately deletes your account, all memories you created with their photos and videos, and your login-code records. Maps you own that have other members are transferred to the earliest-joined member; maps with no other members are deleted entirely.
Automatic database backups (Cloudflare D1 Time Travel, always on and not configurable) may retain historical snapshots of deleted data for up to 30 days, after which they expire. We will not restore data you have deleted from them.
Revoking consent / requesting deletion: delete your account in the app at any time, or email us and we will help.

Children

The service is not directed to children under 13.

Contact

[email protected] · Operated by Qi (Travis) Zhang, Vancouver, Canada. If this policy changes, the effective date above will be updated.