Privacy Policy
AtomicOSINT LLC — Last updated: 2026-10-04 Effective date: 2026-10-04
1. Introduction
AtomicOSINT LLC ("we", "us", "our") provides a mobile application and associated services for OSINT and intelligence tradecraft training (the "Service"). This Privacy Policy describes how we collect, use, and protect your personal information.
2. Information We Collect
The table lists each category of personal data we collect or store, why we use it, whether it is linked to your account, how long we keep it, and which processors handle it. We collect the optional items only when you use the related feature.
| Category | What we collect | Why | Linked to your account | How long we keep it | Processors |
|---|---|---|---|---|---|
| Account and sign-in | Email address, display name, password (stored only as a salted hash), sign-in method and authentication provider identifiers (the Apple, Google or Microsoft subject ID, with the email, name and picture address the provider returns), email verification state, the time you confirmed you are at least 18 and accepted the Terms, and an optional linked platform account email and ID. A guest has only a random learner ID, a time zone and settings. | Create and secure your account, sign you in, verify your email address, restore your progress, and keep the record that you accepted the Terms. | Yes | Until your account is deleted; deletion takes effect after the grace period in section 5. | Neon Inc.; Cloudflare, Inc.; Resend Inc.; Apple Inc.; Google LLC; Microsoft Corporation |
| Sign-in and consent records | The IP address and user agent recorded with sign-in, registration, password and account-security events and with your Terms acceptance. An email registration that is not yet verified also keeps the IP address and user agent until it is verified or expires. | Detect abuse, investigate account security incidents, and keep evidence that you accepted the Terms. | Yes | Sign-in and account-security events are kept for 7 calendar years; after your account is deleted the event stays without a link to you, and its IP address stays with it. The Terms acceptance record is kept until your account is deleted. | Neon Inc.; Cloudflare, Inc. |
| Profile and preferences | Declared role, domains, experience level and learning goal, daily goal, time zone, reminder settings, accessibility and display settings, your analytics and marketing consent choices, and your social visibility and sharing choices. | Personalize training, schedule streaks and reminders, apply accessibility settings, and honor your privacy choices. | Yes | Until your account is deleted. | Neon Inc.; Cloudflare, Inc. |
| Profile image | An optional PNG, JPEG or WebP image of up to 2 MiB. Only a client that uploads one creates it; the iOS app has no screen for it. The image is stored in Cloudflare R2 and is served from a web address that does not require sign-in. | Show your picture on your profile. | Yes | Until you replace or remove it, or your account is deleted. | Cloudflare, Inc.; Neon Inc. |
| Learning activity | Drill answers, scores, timing and feedback; sessions, review and mastery state; lesson, program, case-file and assessment progress; streaks, XP, hearts and achievements; certificates (when public verification is enabled, anyone with the certificate number can verify one, and the public record shows a random subject ID, not your name or email); notes and bookmarks; your study plan; and any Brief text you submit for practitioner review. Brief text is reviewed by people and is not sent to an automated grading service. | Provide training, spaced repetition, progress tracking, certificates and human review. | Yes | Until your account is deleted. Brief text is removed when its retention period in Product Settings ends. | Neon Inc.; Cloudflare, Inc. |
| Mentoring and social | Friend requests and connections; mentoring requests and responses (free text); safe critique submissions and critiques (ratings and free text, under a pseudonym), and facilitator shares (context and feedback text), which stay off unless an operator enables them; social and team quest progress; leaderboard and league standing; activity feed events; organization and team membership, invitations (including the invited email address) and referral codes. Other learners see your display name and progress only as your social visibility settings allow; they are off by default. | Let you practice with friends, mentors, peers and teams, and show the standing and progress you chose to share. | Yes | Until your account is deleted. If you own an organization, it is deleted for all of its members when your account is permanently deleted. | Neon Inc.; Cloudflare, Inc. |
| Feedback and reports | Beta feedback, satisfaction (NPS) survey answers, item reports and answer challenges (free text). | Fix content, answer challenges and improve the product. | Yes | Until your account is deleted. | Neon Inc.; Cloudflare, Inc. |
| Purchases and subscriptions | Subscription tier, status, billing period dates and cancellation state; the Stripe customer ID and subscription ID; Apple and Google purchase transaction IDs and receipt data. Paid plans are not offered during the beta. Raw card numbers, CVC values, bank account credentials, and payment credential contents are handled by Stripe and are not received or stored by AtomicOSINT. | Show your plan, control access to paid features, restore purchases, and keep financial records. | Yes | Kept after your account is deleted for financial records, without a link to you. The Stripe customer, and with it any subscription, is deleted at Stripe as soon as you request account deletion. | Neon Inc.; Stripe, Inc.; Apple Inc.; Google LLC |
| Usage analytics and client errors | App events (the iOS app currently sends one, when you open the weekly current-content list: the item count, whether the list came from the cache, the app version and the device platform), error reports that a client posts to the API, and analytics events from the admin console. Collected only after you consent. Analytics events can include an IP address. | Understand which features work and find and fix errors. | Yes | Behavioral telemetry is kept for 90 days. Error reports are kept for 30 days. Analytics events are kept for 1 calendar year, with IP addresses truncated after 30 days. | Neon Inc.; Cloudflare, Inc. |
| Diagnostics | Crash reports, performance traces and request failure records sent to Sentry, with device and operating system details, app version, stack traces and request timing. The iOS app sends no account identifier. The admin console sends the administrator ID and role. The iOS app and the admin console send reports only after you consent, and the iOS app removes email addresses, tokens and request bodies from every report before sending it. The API sends server error reports, scrubbed of emails, names and tokens, unless you have declined analytics, and includes a one-way hash of your learner ID only when you have consented. | Diagnose crashes and errors and keep the service reliable. | No | Sentry keeps reports under its own retention period. | Functional Software, Inc. (Sentry) |
| Request logs and network data | The IP address Cloudflare sees on every request, which also keys per-minute rate-limit counters; and application logs with the request path, status code, timing, user agent, your learner or administrator ID and a correlation ID. Logs do not contain request bodies. | Serve requests, limit abuse and diagnose errors. | Yes | Rate-limit counters last one minute. Application logs are archived for 90 days. | Cloudflare, Inc. |
| Email and notification records | Your email address and the content of the emails we send (verification, password reset, deletion confirmation and the weekly progress digest), delivery and bounce events, a log of notifications and emails sent (category, template and date), and an email suppression list (address and reason). | Send the email you request or need for your account, honor unsubscribes, and stop mailing addresses that bounce. | Yes | The notification log is kept for 90 days. We ask Resend to remove your address when your account is deleted. The suppression list keeps the address and reason so that it is not mailed again, and deleting your account does not remove it. | Resend Inc.; Neon Inc.; Cloudflare, Inc. |
| Push notification tokens | Which push notification types you have switched on, and, once you switch one on in the iOS app and allow notifications, a random ID for this installation of the app, its Apple push token and the platform. | Deliver the push notifications you have switched on. New-content and re-engagement notifications are sent only if you switch them on; study reminders are sent only inside the reminder window you set in your study plan, until you switch them off. | Yes | A device is removed when you sign out on it, when Apple reports its token is no longer valid, or when you request account deletion; your notification choices stay with your account until it is deleted. | Neon Inc.; Apple Inc. |
| Administrator accounts | For administrators: email address, display name, role, password hash, Google sign-in subject, email and picture address, an encrypted authenticator (TOTP) secret and backup code hashes, sessions and lockout counters, and an audit log of administrator actions that includes the learner records they act on. | Authenticate operators, enforce roles and keep an audit trail. | Yes | Until the administrator account is removed. Administrator sessions expire after 30 days. Admin audit logs are kept for 7 calendar years. | Neon Inc.; Cloudflare, Inc.; Google LLC; Resend Inc. |
| Backups | Encrypted copies of the full database and of stored images, which contain every category above. | Recover from data loss. | Yes | Daily database backups are kept for 30 days and monthly backups for 12 months in Cloudflare R2; the copy in Amazon S3, when configured, is kept for 90 days. Neon also keeps a short point-in-time history. Learner deletions are applied again after any restore. | Cloudflare, Inc.; Neon Inc.; GitHub, Inc.; Amazon Web Services, Inc. |
We do not collect precise or coarse location, contacts, advertising identifiers, or browsing history.
3. How We Use Your Information
- To provide, maintain, and improve the Service.
- To personalize your training experience.
- To send transactional emails (e.g., email verification, password reset).
- To manage subscriptions: Apple handles purchases made in the iOS app and Stripe handles purchases made on the web. Paid plans are not offered during the beta.
- To diagnose errors and improve reliability.
- To protect the Service and your account from abuse.
4. Data Sharing and Sub-processors
We do not sell your personal data. We share data only with the processors below, for the purposes described in our Data Processing Addendum. Apple, Google, and Microsoft also receive the information you give them when you choose to sign in with them.
| Processor | Service | What it receives |
|---|---|---|
| Cloudflare, Inc. | Hosting and edge compute (Workers and Pages), R2 storage for images and encrypted backups, rate limiting, Turnstile bot checks, DNS and CDN, and the application log archive | Every request, including IP addresses; stored images; rate-limit counters; application logs; encrypted backups |
| Neon Inc. | PostgreSQL database hosting | All stored application data |
| Resend Inc. | Transactional email delivery | Recipient email addresses, the content of the emails we send, and delivery events |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | Error reports, stack traces, device and app metadata and request timing from the iOS app and the admin console (sent only after consent) and scrubbed error reports from the API (a one-way hash of the learner ID is included only when the learner has consented) |
| Stripe, Inc. | Web checkout and billing portal (Paid plans are not offered during the beta) | Payment details entered on Stripe's pages (processed directly by Stripe), customer and subscription records, and the learner ID in checkout metadata |
| Apple Inc. | Sign in with Apple, App Store in-app purchases (purchase validation with the App Store Server API), and the Apple Push Notification service | Apple subject identifier, the name and email shared at sign-in, purchase transaction identifiers, and for a push notification the device push token and the notification's title and text |
| Google LLC | Google Sign-In for learners and administrators, and Google Play purchase verification (supported by the API and not used by the iOS app) | Google subject identifier, email, name and picture address; purchase tokens for Google Play verification |
| Microsoft Corporation | Microsoft sign-in for learners (personal, work and school accounts) | Microsoft subject identifier (tenant and object ID), email and name |
| GitHub, Inc. | Source code hosting and GitHub Actions, including the scheduled jobs that create and encrypt database backups | Database dumps exist on GitHub-hosted runners while a backup job runs, before they are encrypted and uploaded |
| Amazon Web Services, Inc. | Cross-provider copy of encrypted backups in S3 (Only when the cross-provider backup workflow is configured) | Encrypted database and asset backups |
5. Data Retention
We retain your account and training data for as long as your account is active.
Account deletion: When you request account deletion from the Settings screen, your account enters the current configured grace period (30 days by default) during which login is disabled and first-party erasure is scheduled. After the configured period, personal data in AtomicOSINT systems is permanently deleted, except records we must retain for legal obligations such as purchase records and audit logs. Processor erasure obligations for services such as Resend and Stripe are tracked as retryable deletion jobs until the processor deletion is completed. You may reactivate your account within the configured grace period by contacting us. If you own an organization, it is deleted for all of its members when your account is permanently deleted; the deletion confirmation email says so.
Backups: Encrypted backups of the database and stored images are kept for the periods in the table in section 2. Deleted data can remain in a backup until that backup expires, and we apply learner deletions again after any restore.
Operational retention: Error diagnostics are retained for 30 days. Behavioral telemetry is retained for 90 days. Analytics events are retained for 1 calendar year, with IP addresses truncated after 30 days. Sign-in and account-security events are retained for 7 calendar years. Admin audit logs are retained for 7 calendar years, remain immutable during that window, and are deleted by scheduled retention enforcement after the retention window ends. These are the current defaults and are configurable in Product Settings; the active configuration is authoritative, and the product owner must update this policy before changing a published default.
6. Your Rights (GDPR)
If you are located in the European Economic Area you have the right to access, rectify, erase, restrict processing of, and port your personal data. You can export your data and delete your account from the Account screen in the app. To exercise these rights in another way, contact us at the address below.
7. Cookies and Tracking
The AtomicOSINT iOS app stores no cookies. It signs in with a token kept in the iOS Keychain and keeps a small amount of other data on your device, which the Cookie Policy lists. The admin console and the API, when a browser calls it, use first-party cookies and browser storage, which the Cookie Policy also lists. The public website sets no cookies. Usage analytics and Sentry diagnostics in the app require your consent. We do not track you across apps or websites owned by other companies.
8. Children's Privacy
The Service is for adults and is not directed to anyone under 18. We do not knowingly collect personal data from anyone under 18.
9. FERPA and Institutional Use
The Family Educational Rights and Privacy Act (FERPA) protects student education records maintained by educational institutions. AtomicOSINT is not an educational institution, does not process student education records on behalf of schools, colleges, universities, or other educational agencies, and is not currently FERPA-compliant. Do not use the Service as an institution-managed educational records system unless AtomicOSINT has first entered into a separate written agreement covering the required institutional privacy and FERPA obligations.
10. Changes to This Policy
We will notify you of material changes by updating the "Last updated" date above and, where required by law, by seeking fresh consent.
11. Contact
AtomicOSINT LLC Mailing address: 651 N Broad St, Suite 201, Middletown, DE 19709 Email: privacy@atomicosint.app Website: https://atomicosint.app