Privacy notice

Controller and contact

Use these contact details for privacy questions, access requests or deletion requests.

Website and hosting

When you visit Atlas, your IP address, time of access, requested page and technical connection data such as browser information are processed to deliver and protect the website. HTTPS encrypts the connection. It does not prevent tracking by an external service you subsequently choose to load.

Atlas does not maintain a routine access log of every page view. Technical errors and operational events may be logged for troubleshooting. Application logs rotate by size, retaining at most three files of 10 MiB per service. Security incidents may require separate records limited to the particular incident.

Delivery and security rely on Article 6(1)(f) GDPR, based on our interest in an available website and preventing abuse.

Cookies and browser storage

Reading articles does not set Atlas sign-in cookies. The following first-party cookies are used only when you request the relevant account function. They are restricted to our domain, inaccessible to JavaScript and transmitted only over HTTPS on the live website.

Necessary first-party cookies

These cookies support the sign-in or account security you explicitly request: Section 25(2)(2) TDDDG. Account processing relies on Article 6(1)(b), and security on Article 6(1)(f) GDPR.

Local storage instead of cookies

The following entries reside in your browser's local storage. They are not sent to us with each request as cookies are. They have no automatic expiry and remain until overwritten or you delete website data.

We store your privacy choices so we can respect them. Bookmarks and map progress are stored only when you use those features. Choosing “Necessary only” or disabling convenience features removes the three convenience entries. Your preference choice remains stored. You can also delete all entries using your browser's website settings.

Storing privacy choices and bookmarks you request supports those requested features (Section 25(2)(2) TDDDG). Optional analytics and connections to embedded videos require your separate consent.

Internal analytics

Atlas counts page views only if you enable “Analytics” in data preferences. Measurement uses no external analytics service, analytics cookies, device fingerprint or persistent visitor identifier. It relies on your consent under Article 6(1)(a) GDPR.

• Stored values are aggregate views by day and page, with page title, content type and language. No personal browsing histories are created.
• Analytics stores no IP addresses, referrers or browser profiles. Request headers are checked transiently to recognize bots, prefetches and privacy settings.
• A one-time measurement token briefly remains in the open page's memory; only its hash is stored server-side. It expires after five minutes and is removed after use.
• Counting starts only after at least one second in a visible tab. Signed-in sessions, account pages and search requests are excluded. Do Not Track and Global Privacy Control are respected.
• Daily totals are deleted after 25 months. Withdrawal stops further measurement. Existing aggregate values cannot be assigned to an individual visitor.

YouTube videos and external links

Trailers and other videos initially appear as placeholders. Only “Consent and load video” connects you to YouTube. We use privacy-enhanced mode at youtube-nocookie.com. That name does not mean no data or browser storage is processed afterwards.

YouTube/Google receives information including your IP address, technical browser data, requested video and our website as the referring origin. The provider for EEA users is Google Ireland Limited; Google LLC and other Google entities may also process data. The embedded service and any storage on your device rely on your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG).

Possible external player cookies

Google documents the following examples. They are possible provider cookies, not cookies set by Atlas. Actual use depends on the player, browser, Google account and settings.

Other cookie names or similar technologies are possible. Current details are in Google's cookie information and Google's privacy policy.

Google also processes data outside the EEA, including in the US. Google describes reliance on the EU-US Data Privacy Framework and standard contractual clauses. Details and safeguards are in its data transfer information.

“Close video” ends the connection on this page. It does not remove cookies already stored by Google; manage those in your browser or Google settings. Atlas does not persist this permission or automatically load other videos.

Map, images and source links

Atlas serves its own AI concept map and embedded images itself. Viewing the map does not connect to external map services. Opening an external source link sends connection data to the destination, which may use cookies under its own policies. The same applies to links to Rockstar Games, news sites or social networks.

Tips, contact and accounts

Tips and corrections

When you submit a tip, we store your chosen display name, category, title, description, source link and submission time. Optional information can include a related database entry, game version, platform or map coordinates. No email address is required. Do not submit passwords, other people's private contact details or confidential evidence.

Editors and internal review software assess information, sources and possible duplicates. A tip is not automatically public. Verified information may be used editorially; requested source or name attribution is handled in context. Review relies on our legitimate interests in reliable content and abuse prevention (Article 6(1)(f) GDPR).

Email or telephone

If you contact us, we process your contact details and message to handle your request. Email providers participate in transmission and storage. We do not automatically use your details for advertising or a newsletter. Depending on the request, the legal basis is Article 6(1)(b), (c) or (f) GDPR.

Accounts and passkeys

You can create an account with a passkey without an email address. We store username, display name, internal account ID, public passkey key, credential identifier, device label and technical usage data. Your private passkey key and device PIN are not transmitted to Atlas. We receive no biometric data such as fingerprints or facial recognition. Your profile starts private; you control its visibility in your account. Comments and community contributions are not enabled yet.

Account sessions and security-sensitive actions are recorded internally; session tokens are stored only as hashes on the server. Account export, session revocation and deletion are available in the private account area. Account data is processed to provide your requested account under Article 6(1)(b) GDPR; security data to prevent abuse under Article 6(1)(f). Google, Discord, Microsoft, Steam and TikTok sign-in are not currently active. Before enabling these services, we will add the actual providers, data and retention periods to this notice.

Retention, recipients and backups

• Sign-in flows: valid for five minutes; expired records are removed by regular cleanup after one day. Operator authorizations use the different lifetimes listed above.
• Sessions: valid for eight hours; expired or revoked records are cleaned up after seven days. Abuse counters are cleaned up one day after their rate-limit period ends.
• Account security events: 90 days. Notifications: 30 days after being read, or 90 days at the latest. These periods are checked automatically on a regular basis.
• Account data and passkeys: until removal of the sign-in method or account deletion. Personal associations are removed or anonymized; necessary records concerning security incidents or legal matters may be retained separately.
• Tips and correspondence: for as long as needed to handle the request, substantiate source review or resolve a specific legal matter. Personal details no longer required are then deleted or anonymized. Statutory retention duties or unresolved claims can require a longer period.

Access is limited to people who need the data for editorial work, administration or handling your request, and hosting, IT and email providers to the extent necessary. External video services receive data only after you enable them. Disclosure to authorities or legal advisers may be necessary to meet a legal obligation or handle a specific legal matter. We do not sell your personal data.

Backups are encrypted and not publicly accessible. The current strategy retains 30 daily, twelve weekly, twelve monthly and five pre-update backups; additional local copies retain the last 14 verified archives. These are backup generations, not a guarantee of a fixed deletion deadline. Deleted data may remain until the relevant backup expires. Deletion requests must be reapplied after restoration; backups are not used for ordinary processing of deleted data.

Your rights and preferences

You may request access, correction, deletion, restriction and, where applicable, data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent at any time with future effect; earlier processing remains unaffected.

Use “Data preferences” in the footer to turn off analytics or change local storage choices. You can close external videos. Editorial content remains readable without optional permissions; only the relevant additional feature is unavailable. Use the email address above for other requests.

You may also complain to a data protection authority, particularly where you live, work or where an alleged violation occurred. One available contact is the Hamburg Commissioner for Data Protection and Freedom of Information.

We do not make solely automated decisions about you with legal or similarly significant effects. Editorial review software can prepare suggestions; it does not replace a decision concerning your rights.

Advertising and future services

Atlas currently enables no advertising service, newsletter, external analytics service or CAPTCHA provider. The existing “Advertising” preference therefore loads no ads and sets no advertising cookies. Enabling new providers later requires updated information and the necessary consent first; today's choice is not blanket permission for unknown services.