Privacy Policy

Last updated: 13 August 2026

Atlas is a strength-training and nutrition tracker for iPhone, built by Mark Eskandar. This policy covers two separate things: the app, which collects nothing, and this website, which collects one thing if you ask for a TestFlight invite. It is written from the source rather than from a template, so everything below is a statement about how Atlas actually behaves.

The app

Everything from here to “Exports you initiate” describes the iPhone app. The app has no accounts, no backend, and no servers operated by us. The website is a separate thing with one exception in it, and it is described separately below.

What Atlas stores on your device

All of the following is kept in Atlas's own storage on your iPhone and is never uploaded anywhere:

• Training data — exercises, sets, weights, reps, your split, session outcomes and any note you write at the end of a session
• Nutrition data — your food library, saved recipes, diary entries, water, and the calorie and macro goals you set
• Profile — name, bodyweight, height, birth year, sex and activity level. These are used to estimate your energy needs; that calculation happens on the device
• Health readings you have granted Atlas access to (see below)
• A local activity log — a technical record of app events (launches, crashes, sets logged, storage failures) used to diagnose problems. It records what the app did, not what you searched for. It stays on the device unless you choose to export it

If you delete Atlas, all of it is deleted with the app. You can also erase everything from inside the app: Profile → Reset all data.

What leaves your device, and when

Food search and barcode scanning

When you search for a food or scan a barcode, Atlas sends that search term or that barcode number to three public food databases so they can return matching results:

What is sent is limited to the search term or barcode, plus a generic identifier for the app itself. No name, no account, no device identifier, and nothing else you have logged is included. These requests happen only when you search or scan — Atlas does not pre-fetch, crawl, or sync anything in the background.

As with any internet request, these services will see the IP address your request comes from. That is a property of how the internet works, not something Atlas adds. Each service handles what it receives under its own privacy policy, linked above.

Results you save are stored on your device from then on, so re-logging a food you have used before requires no further request.

Nothing else

Atlas makes no other network requests. There is no analytics endpoint, no crash reporting service, no advertising network, and no account server.

Apple Health

If you grant permission, Atlas reads sleep, steps, active energy, heart rate and bodyweight from Apple Health to inform your dashboard and recommendations.

• Access is read-only and entirely optional; Atlas works without it
• Health data is used on the device and is never transmitted anywhere
• You can revoke access at any time in Settings → Health → Data Access & Devices → Atlas
• Health data is never used for advertising or shared with anyone

Camera

Atlas uses the camera for one purpose: reading a barcode. Recognition happens on the device. No photo or video is stored, saved to your library, or transmitted. Only the decoded barcode number is used, and only to look the product up as described above.

Widgets and Lock Screen

Atlas writes a small summary — the next lift, your streak, calories remaining — into a shared container on your device so its widgets and Live Activity can show it. This container is local to your iPhone and never leaves it.

Exports you initiate

Atlas can export a backup of your data, and separately its activity log, through the standard iOS share sheet. This only ever happens when you tap the export button and choose a destination.

Once you send a file to another app or service — iCloud Drive, Files, email, anywhere else — that copy is governed by that destination's terms, not by this policy. Atlas has no visibility into it.

This website

This is the one place anything is collected, and it is worth being exact about, because everything above says the opposite.

The TestFlight invite form

When you ask for a TestFlight invite, the form sends your name, email address, and — if you filled them in — your device and what you train to a small function running on Cloudflare. Your country, as Cloudflare reports it from your connection, is included so a reply can be timed sensibly.

That function does two things with it:

• Stores it in Cloudflare KV, so a request cannot be lost if the email fails to arrive.
• Emails it to Mark, delivered by Resend.

No script from anyone else runs in your browser. The form posts to this same site. The only onward call happens on the server, after your request has already left your machine.

How long it is kept

Invite requests are deleted within 12 months of being received, or sooner if you ask. The date is fixed rather than tied to when TestFlight opens, because that date is not currently ours to set — Apple Developer Program enrolment is still pending, so there is no TestFlight round yet to anchor a promise to.

Asking for it back, precisely

Email [email protected] and we will delete the stored record and the email itself. Two honest caveats, because a deletion promise broader than we control is not worth making:

• Resend retains its own delivery logs under its policy, and we cannot delete those on your behalf.
• If a reply has already been sent, that thread lives in a normal mailbox and is deleted with it.

Nothing else, and no list

There is no mailing list, no sequence, and no newsletter. You will hear about TestFlight and otherwise not at all. Nothing about the website is used for advertising, and nothing is shared beyond the two companies named above.

None of this touches the app. Atlas itself still has no accounts and no backend; this form is a website feature, and it exists because “email me” was a worse experience than a form.

What we do not do

• We do not sell, rent, or share your data — anything of yours, including an invite request. For everything the app records there is no mechanism by which we could: we never receive it.
• We do not track you across apps or websites.
• We do not show advertising.
• We do not use your data to train machine-learning models.
• We do not build a profile of you. The app's suggestions are computed on your device from your own logged history.

Children

Atlas is not directed at children under 13, and we do not knowingly collect information from them. Since the app collects nothing centrally, there is no data for us to hold or delete on request — deleting the app removes everything.

Your rights

Because your data never reaches us, the usual access, correction, portability and deletion rights resolve on the device itself:

• Access and portability — export a backup from Profile → Export a backup
• Correction — edit or delete any entry directly in the app
• Deletion — Profile → Reset all data, or delete the app

For anything the app records, we hold no copy to produce, correct, or erase. The one thing we do hold is an invite request, if you sent one — see this website for what it contains, how long it is kept, and how to have it deleted. If you would like any of that confirmed in writing, contact us at the address below.

Changes to this policy

If this policy changes in a way that affects what happens to your data, the "last updated" date above will change and the revised policy will be published at the same address before the change takes effect.

Contact

Questions about this policy or about privacy in Atlas: [email protected]

---

Atlas is an independent app. Open Food Facts, USDA FoodData Central and fatsecret are separate services referenced here because Atlas queries them on your behalf; they are not affiliated with Atlas.