Atlas · privacy

Privacy Policy

Effective 12 September 2026 · Last updated 12 September 2026

Atlas ("the assistant") is a private, self-hosted AI assistant operated by Ivan Pereira ("the operator", "I") for his own personal and business use. This policy explains what data the assistant handles, why, where it is stored, and how access can be revoked.

1. Who is responsible

Data controller: Ivan Pereira, individual, Barcelona, Spain.
Contact for any privacy question or request: [email protected].

2. What data Atlas accesses

Atlas connects to the operator's own Google account using Google's OAuth 2.0 authorisation flow. The operator grants access himself, and can revoke it at any time (see section 8). With that grant, Atlas accesses:

Google user data

• Gmail (https://mail.google.com/, https://www.googleapis.com/auth/gmail.settings.basic): messages, threads, labels, attachments and the operator's Gmail settings/filters — used to read, search, summarise, label and draft correspondence, and to manage his own filters.
• Google Calendar (https://www.googleapis.com/auth/calendar): calendars, events, attendees, free/busy information — used to read his schedule, create and update events, and find free slots.
• Google Drive (https://www.googleapis.com/auth/drive): files and metadata in the operator's Drive — used to find, read, organise and share his own files.
• Google Docs and Sheets (documents, spreadsheets): document content — used to read and edit documents he owns.
• Google Meet (meetings.space.created, readonly, settings): meeting spaces — used to create and read meeting links he creates.

Other data

• Configuration and task notes the operator gives the assistant.
• Technical logs of assistant runs (what task ran, when, and whether it succeeded).

3. How Google user data is used

Google user data is used solely to provide the assistant's functions to its operator: reading and organising his mail, managing his calendar, and handling his files and documents — always on his instruction.

Atlas's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is never sold.
• It is never used for advertising, ad personalisation, or profiling.
• It is not used to train or improve generalised AI/ML models.
• It is not transferred to third parties, except the technical processors listed in section 5, which are bound by contract to confidentiality and to the same limits, and never for their own purposes.
• Humans do not read it, other than the operator himself (who owns the data) — and no Google personnel or third-party reviewer ever sees it.

4. Where data is stored and for how long

• OAuth credentials (access and refresh tokens) are stored encrypted-at-rest, with file permissions restricted to the operator's service account, on his own self-hosted server located in the European Union. Tokens are never published or shared.
• Derived working data (e.g. cached summaries, indexes, task state) is stored on the same server for as long as it is useful to the operator — typically days to a few months — and is deletable on request.
• Retention of copies: Atlas does not keep bulk copies of mailbox or Drive content beyond what a task requires. Content fetched for a task is processed and, where cached, expired on a rolling basis.

5. Sharing and processors

Data is not shared with third parties for their own purposes. To function, the assistant sends the minimum content required for a given task to these technical processors:

• Large-language-model API providers (Anthropic, DeepSeek) — to generate summaries, drafts and classification. Requests are processed under their enterprise/API terms; they are not permitted to use the data to train their models, and no human review is requested or authorised.
• Hosting infrastructure — the operator's own server (European Union), plus static-site hosting for this page.

No data is disclosed to any other party except where legally required, and in that case only the minimum required.

6. Security

• All Google API traffic is over TLS.
• OAuth tokens are stored with owner-only file permissions (0600) on a single-tenant host, and are never transmitted to browsers or third parties.
• Access to the host is restricted to the operator, with key-based authentication.
• Google access can be revoked unilaterally by the operator at any moment (section 8), which immediately invalidates the tokens.

7. Cookies and tracking

This website sets no cookies, runs no analytics, and embeds no third-party trackers. It is a static page.

8. Revoking access, and your rights

Because the assistant's only user is the operator, the relevant rights (access, correction, deletion, portability, objection) are exercised by him directly. Access for everyone else is impossible by design.

To revoke Atlas's access to Google data at any time:

• Visit myaccount.google.com/permissions and remove the app, or
• Use the Gmail / Google Account security page to remove third-party access.

Revocation stops all further access immediately; tokens held by the assistant stop working at once. Any cached derived data can be deleted on request to the contact above.

9. Children

Atlas is not directed to children and is not available to anyone other than its operator.

10. Changes to this policy

Material changes will be published on this page with an updated "last updated" date. Continued operation of the assistant after a change constitutes acceptance of the revised policy by the operator.

11. Contact

[email protected]