Privacy, in plain language.

• Your account: name, email address, a password hash rather than the password itself, account creation time, whether your email address has been verified, and whether a welcome email was attempted.
• Verification codes: to confirm your email address when you sign up, we email you a 6-digit code. Only a hash of the code is stored, it stops working after 10 minutes or 5 wrong tries, and it can be used once. An account whose address is never verified cannot sign in; it stays stored until someone signs up again with the same address, which replaces it.
• Your map: the country codes you mark as visited. The product does not ask for notes, visit dates, cities, routes, coordinates, or photos.
• Shared maps: the map name, optional description, memberships, roles, and pending invitation addresses. Only a hash of an invitation token is stored.
• Sessions: the session record that keeps you signed in, its expiry, and the IP address and browser user agent that the authentication system records.

• Only you can see your personal map and account settings. Other people cannot look it up by guessing a URL.
• Members of a shared map can see each other's display names, country marks, and combined or per-member country counts. They do not receive email addresses, account ids, or account settings.
• A shared-map owner can see pending invitation email addresses and revoke those invitations. The invited person sees the map name only after the invitation checks pass.
• An exported image contains country marks and public brand information only. On a shared map it contains the combined marks, or the selected member's marks, but never member names, emails, account ids, the map name, per-member breakdowns, notes, visit dates, or other account metadata.

A session cookie keeps you signed in. It is HTTP-only and SameSite=Lax, and it is marked Secure when the app runs over HTTPS. There are no advertising or analytics cookies.

The app uses server-side authorization for private pages and actions. Hiding a button is not treated as a security boundary.

Account email is sent through Brevo for verification codes, welcome messages, password resets, and shared-map invitations. AtlasShare does not add tracking pixels and does not include other members' email addresses in those messages.

Brevo processes delivery and may record its own delivery or open telemetry, and it adds an unsubscribe header that some mail clients display. Those records are governed by Brevo's terms and retention policy. Clicking unsubscribe can suppress future transactional email from this sender.

The installable app uses a service worker to keep the public app shell, public static assets, and a standalone offline page on your device. It does not cache authenticated HTML, /api/* responses, invitation responses, or any response marked private.

When a navigation cannot reach the network, you see the public offline page. No map or account data is replayed from a cache. Signing out clears the runtime cache on this device as an extra safeguard.

The app runs no product analytics, advertising scripts, tracking pixels, or social login. The infrastructure needed to run the service — hosting, the PostgreSQL database, and Brevo for email — processes data on the operator's behalf. There is no separate analytics profile.

Account data stays until you delete the account. Deleting your account removes your visits, sessions, and memberships, and deletes shared maps you own. That action cannot be undone. Email-delivery records held by Brevo follow Brevo's retention policy.

You can change your display name, change your password, and delete your account from the account page.

Country geometry is based on @svg-maps/world (CC BY 4.0), filtered to the 193 UN member states plus the Holy See and Palestine.

Boundaries follow the source data and are not a statement about disputed territories. Read the licence.