Privacy Policy

1. Introduction

Atmos ("we", "our", or "the app") is an air quality and weather application built in Oslo, Norway. This policy applies to the Atmos iOS app, the Atmos Android app, and the Atmos website. Some features differ by platform — where that is the case, this policy says so explicitly. We take your privacy seriously and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Norwegian data protection law.

2. Data We Collect

Account Information

• Email address and display name (when you create an account)
• If you sign in with Google (web and Android), your Google name and email are synced to your profile
• Authentication tokens stored locally on your device

Location Data

• GPS coordinates (with your permission) to fetch local air quality and weather data
• Saved locations (e.g. Home, Work, Gym) are stored locally on your device, not on our servers
• Your coordinates are sent to third-party APIs to retrieve localized weather and air quality data
• On the web, if you do not grant GPS permission, your approximate location may be estimated from your IP address via Geoapify
• On Android, your approximate coordinates are also stored on our servers alongside your notification device token, solely to determine whether to send you a wildfire or weather alert relevant to your area

Wildfire Data (Android only)

• The Android app includes a Wildfire tab showing active fire detections from NASA FIRMS satellite data, and can send optional smoke/wildfire alert notifications
• Displaying the wildfire map does not require sharing your location with us — it uses whatever map area you are viewing
• Wildfire and smoke alerts use the approximate coordinates described above under Location Data
• You can turn wildfire smoke alerts off at any time in Profile → Notifications

Notification Device Token

• When you grant notification permission, Apple (iOS) or Firebase Cloud Messaging (Android) provides a device token — a unique identifier for your device
• This token is stored on our servers (Supabase, EU) solely to deliver weather, pollen, and (Android) wildfire push notifications
• It is deactivated when you sign out, and deactivated automatically if it becomes invalid (e.g. after a reinstall)

Notification History

• We keep a record of the notifications sent to your account for the last 7 days (title, body, and time sent), so the Notifications screen in your Profile can show your recent alerts even if your device did not wake up to receive the push itself
• This history is scoped to your account and not shared with anyone else

Crash and Diagnostic Data (Android only)

• The Android app uses Firebase Crashlytics to automatically collect crash reports if the app fails unexpectedly
• This includes technical diagnostic information such as device model, OS version, and the code location of the crash — it does not include your account data, location, or app content
• This data is used solely to identify and fix bugs, and is not used for advertising or profiling

App Preferences

• Dismissed prompts and display preferences
• These are stored locally on your device only

3. How We Use Your Data

• Display real-time air quality, weather, UV, and pollen information for your location
• Provide weather and air quality forecasts for your area
• Authenticate your account and sync your profile data across sessions

We do not use your data for advertising, profiling, or marketing purposes.

4. Third-Party Services

We use the following third-party services. Your data shared with each is limited to what is necessary for the service to function:

Each service operates under its own privacy policy. We encourage you to review them.

5. Data Storage

Stored on Our Servers (Supabase, EU)

• User profile (email, display name)
• Device push token (stored while signed in, deactivated on sign out)
• Approximate coordinates for alert targeting (Android only)
• Last 7 days of notification history (title, body, time sent)

Stored Locally on Your Device Only

• Authentication tokens
• Saved locations (Home, Work, etc.)
• Display preferences
• Cached email and avatar initial (for offline display)

We do not sell, rent, or share your personal data with third parties for advertising or marketing.

6. Tracking and Advertising

• Atmos does not use any advertising SDKs or ad networks, on any platform
• We do not collect or use the Apple Identifier for Advertisers (IDFA) or the Android Advertising ID
• We do not track you across other apps or websites
• The iOS app contains no analytics SDKs — all analytics are website-only (Vercel Analytics, anonymous)
• The Android app includes Firebase Crashlytics for crash/diagnostic reporting only (see "Crash and Diagnostic Data" above) — this is not advertising or behavioral tracking

7. App Permissions

Atmos may request the following permissions. All are optional and you can deny or revoke them at any time in your device Settings.

iOS

• Location (When In Use) — To show air quality and weather for your current location
• Notifications — To send daily weather briefings, rain alerts, pollen alerts, and air quality alerts

No other permissions (motion and fitness, camera, microphone, contacts, calendar, HealthKit) are requested or used.

Android

• Location (approximate and precise) — To show air quality and weather for your current location and center the Wildfire map on you
• Notifications — To send daily weather briefings, rain alerts, pollen alerts, and (optional) wildfire smoke alerts

The Android app does not request motion and fitness, camera, microphone, contacts, or calendar permissions.

8. Your Rights (GDPR)

Under the GDPR and Norwegian data protection law (Personopplysningsloven), you have the right to:

• Access — Request a copy of all personal data we hold about you
• Rectification — Correct inaccurate or incomplete data
• Erasure — Delete your account and all associated server-side data
• Portability — Receive your data in a machine-readable format
• Withdrawal of Consent — Revoke any permissions at any time
• Complaint — File a complaint with the Norwegian Data Protection Authority (Datatilsynet)

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

9. Data Retention

• Account data is retained for as long as your account is active
• If you delete your account, your server-side data is permanently deleted
• Locally stored data (saved locations, tokens) is cleared when you sign out or uninstall the app
• Vercel Analytics data is anonymized and retained per Vercel's data retention policy

10. Security

• All data transmitted between the app and our servers is encrypted using HTTPS/TLS
• Authentication uses secure token-based sessions with automatic refresh
• Passwords are never stored locally — authentication is handled by Supabase
• Google OAuth uses the PKCE flow for secure token exchange

11. Children's Privacy

Atmos is not directed at children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. If we make material changes, we will notify you through the app or by email.

13. Contact

If you have questions about this privacy policy, want to exercise your data rights, or have concerns about how your data is handled, contact us at:

breathe@atmos.guide

You may also file a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.