Privacy Policy

Sirah Atlas respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, store and protect your personal information when you use our platform.

This policy is drawn up in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy legislation.

Sirah Atlas is the data controller for the processing of your personal data.

We collect the following categories of personal data:

2.1 Account Data

• •Username
• •Email address
• •Password (stored encrypted)
• •Account status (whether an active contribution is linked to your account)

Your username and earned XP appear on a public leaderboard unless you turn this off in your account settings.

2.2 Contribution Data

• •Status and form of your contribution (one-time, monthly or yearly)
• •Payment history
• •Billing information (via Paddle)

2.3 Usage Data

• •Login activity
• •Pages visited and content accessed
• •Usage duration and frequency
• •Device and browser information

2.4 Technical Data

• •IP address
• •Browser type and version
• •Operating system
• •Session information

We process your personal data for the following purposes:

3.1 Service Provision

• •Creating and managing your account
• •Providing access to our services
• •Processing subscriptions
• •Customer service and support

3.2 Payment Processing

• •Processing payments via Paddle
• •Tracking subscription status
• •Billing and accounting
• •If you start a contribution while signed in and do not finish it, we may send you one reminder email about an hour later, and normally no more than one in 30 days. For this we keep a record of the attempt for at most 30 days, deleted soon after a completed payment: your account and email address, the amount and frequency, the offer you chose (such as a game period), the page you came from, how far you got, the type of payment method you chose, our payment provider's reference for the attempt and, if a payment failed, a general reason category (never your payment details). Anonymous daily totals of started, completed and abandoned contributions are kept without any link to you. You can stop these reminders with the link in the email.

3.3 Service Improvement

• •Analyzing usage patterns
• •Improving user experience
• •Developing new features

3.4 Legal Obligations

• •Complying with legal obligations
• •Preventing fraud and abuse
• •Protecting our rights and property

We process your personal data based on the following legal grounds:

• •Contract performance: For providing our services and managing your account
• •Legitimate interest: For improving our services and preventing abuse
• •Legal obligation: For complying with tax and other legal obligations
• •Consent: For marketing communications (if applicable)

We only share your personal data in the following cases:

5.1 Service Providers

• •Paddle: For payment processing and subscription management
• •Hosting providers: For hosting our website and databases
• •Email services: For sending transactional emails
• •PostHog (servers in the EU): For product analytics. In your browser it only runs if you have given consent for Statistics; in addition, our server sends it some events about contributions, subscriptions and account use (such as a completed payment or a played audio preview), linked to your account ID when you are signed in, including without that consent

5.2 Legal Requirements

We may share your data when legally required or to protect our rights.

We never sell, rent or share your personal data for commercial purposes with third parties.

We do not retain your personal data longer than necessary:

• •Account data: As long as your account is active, plus 1 year after deactivation
• •Payment data: 7 years in accordance with tax legislation
• •Usage data: Maximum 2 years for analytical purposes
• •School inquiries: when a school contacts us through the form on the schools page, we store the name, role, institution, country, email address, student count and message, where given. We use them only to reply, and delete the inquiry from our database 12 months after we receive it.
• •Technical logs: web server access logs at most 15 days, and the temporary log of the second web server until the next update or restart (see 10.1); records of payment-provider notifications we could not process 90 days; application logs are overwritten automatically once they reach a fixed size

Under the GDPR, you have the following rights:

7.1 Right to access

You have the right to know what personal data we process about you.

7.2 Right to rectification

You can have incorrect or incomplete data corrected.

7.3 Right to be forgotten

You can request deletion of your personal data.

7.4 Right to restriction

You can have the processing of your data restricted.

7.5 Right to data portability

You can request your data in a structured format.

7.6 Right to object

You can object to certain processing activities.

To exercise these rights, you can contact us at [email protected]

We take the security of your personal data seriously and have implemented appropriate technical and organizational measures:

• •Encryption of sensitive data
• •Secure HTTPS connections
• •Regular security updates
• •Access control and authorization
• •Regular backups
• •Monitoring of suspicious activities

We use cookies and similar technologies to:

• •Ensure proper functioning of the Platform
• •Remember your preferences and settings
• •Analyze usage for improvement purposes
• •Maintain your login session

You can manage your cookie preferences through your browser settings.

10.1 Page views

In addition to cookies, we run our own first-party page-view logging to see which content is popular. This works as follows:

• •We record which page was viewed and when, so we can see which content is popular.
• •If you have given consent for the Statistics category, the view is linked to a session identifier and, when you are signed in, to your account.
• •Without that consent, the view is still recorded for aggregate statistics, but without a session identifier and without any link to an account, and no cookie is set. On a subset of these records we additionally store, for 24 hours, a short-lived, one-way, daily-rotating hash derived from technical connection data such as your IP address and browser type. This hash is used solely to count unique visitors and how many of them view more than one page that day, and, within that 24-hour window, to connect a landing-page visit to a signup that follows it; it is then erased. The hash is never linked to an account and never shared with third parties. What remains is the page visited, the country derived from your network connection, and the domain of the website that referred you.
• •Your IP address is used to compute the hashes described in this section and, through our CDN provider Cloudflare, to determine your country, of which only the two-letter country code is kept with a page view. The IP address itself is not stored with your page views, with the daily counts described below or with those hashes. Separately, like almost every website, our web servers write the IP address of each request to an access log, which we use for security and to find faults: the logs on our main server are deleted automatically after at most 15 days, and a second web server, behind the first, keeps its own log only in temporary memory; that log is erased every time we update the site or that server restarts. Our protection against abuse, which limits the number of requests per connection, also holds IP addresses briefly in temporary memory, normally for no more than 15 minutes.
• •Detailed page-view records are deleted after 90 days; only anonymised daily totals per page are kept for longer.
• •At registration we additionally record the country, the domain of the referring website, and the first page visited, so we understand how visitors find the platform.
• •If you use Sirah Atlas as an installed app (the Android app or an app on your home screen), the app keeps a random device number on your device that is sent to us on the first launch each day, so we can count how many devices use the app. We never share this number with third parties and only link it to your account if you have given consent for Statistics (earlier launches from the same device then become traceable to you as well); we keep these records for at most 13 months, and you remove the number by deleting the app or clearing its data.
• •We also count a few steps in the game and on this site: starting the game, finishing the first chapter, seeing or clicking the offer to unlock the game, being offered to save your card, opening one of our short links to the game, viewing the support page, seeing or clicking an invitation to register or to support us, and how often the cookie banner is shown and which choice is made in it (accept all, reject all, or a choice of your own with or without Statistics). These are kept only as anonymous daily totals (per language, per source such as a link or page, and per visit: signed out, or signed in with or without the unlocked game), without an identifier, without a link to an account and without setting a cookie. So that a game step by a visitor who is not signed in, or a visit through a short link, is counted once per visitor per day, we compute one-way, daily-rotating hashes from your IP address and browser type, a different one for each step and separate from the page-view hash above, plus one from the IP address alone to limit how many visitors one connection can add in a day. These hashes are held only in temporary memory for at most 24 hours, never together with your IP address and never in our database, and they are not computed when your browser sends a Do Not Track or Global Privacy Control signal. Views of the support page, invitations to register or support us, choices in the cookie banner and steps by signed-in readers are counted without any hash.
• •We count a few steps of the audio narrations in the same way: starting a chapter, starting a paid chapter after finishing a free one, reaching a quarter, half, three quarters and 90 percent of it, finishing it, reaching the end of an era, the number of seconds listened, the end of the free 45-second preview, and opening, seeing or clicking the offer to hear everything. These are kept only as anonymous daily totals per recording (per language, per place where you pressed play, and per visit: not signed in, or signed in with or without access to the audio), with no identifier, no link to an account and no cookie. To count starting a chapter or reaching the end of the preview only once per day for a visitor who is not signed in, and to count how many such visitors listen each day, we compute one-way, daily-rotating hashes from your IP address and browser type: a different one for each step and each recording, one per day across all recordings, separate from the page-view and game hashes above, plus one from the IP address alone to limit how many visitors one connection can add per day. These hashes are held for at most 24 hours in temporary memory only, never together with your IP address and never in our database, and are not computed when your browser sends a Do Not Track or Global Privacy Control signal. Listening by signed-in readers is counted without any hash.
• •Within a single browser tab we also remember two short codes for how your visit started, or how your first visit started if we already know it (for example TikTok and the game), until you close the tab, unless your browser sends a Do Not Track or Global Privacy Control signal; they are saved with your account or contribution only if you sign up or contribute (with a contribution they are also passed to our payment provider Paddle), and they are kept in a cookie for 30 days only if you have given consent for Statistics.

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). In such cases, we ensure that adequate protection measures are in place.

We may update this privacy policy from time to time. Important changes will be announced at least 30 days in advance via our website or by email.

If you have complaints about our data processing, you can:

For questions about this privacy policy or our data processing practices: