Your data, your privacy
Last updated: 15 October 2026
1. Who are we?
Atlasio is a mobile geography quiz application published by PICK SAS, a simplified joint-stock company registered with the French RNE.
- Company name: PICK SAS
- SIREN: 931 180 319
- SIRET: 931 180 319 00010
- Registered office: 60 rue François Ier, 75008 Paris, France
📧 Contact: contact@pick.social
2. Data we collect
2.1 Data you provide
- Email address — account creation, password recovery, transactional communications
- Username — displayed on the leaderboard
- Password — optional (not required for accounts created via Google); stored hashed (bcrypt, never in plain text)
- Profile picture — optional, subject to automated moderation
- Country of residence — optional, shown as a flag on the leaderboard
2.2 Data from Google Sign-In
If you choose to sign in with Google, we receive the following information from Google:
- Email address — used as your account identifier
- Display name — used to generate an initial username
- Google profile picture — imported as your initial avatar (optional)
- Google identifier (sub) — stored to link your Google account to your Atlasio account
We never receive your Google password. Authentication is handled directly by Google through the OAuth 2.0 protocol.
2.3 Data generated by your use of the app
- Scores, games played and game history
- Daily play streak
- ELO ranking (ranked multiplayer mode)
- Session tokens (stored encrypted on your device)
- Friends list and friend requests, and your "online" status, visible to your friends only
- Device time zone offset, so that streaks and daily challenges start at your midnight
- Push notification token, to send you reminders (can be turned off in your phone settings)
- History of your Premium subscription (purchase, free trial, renewals, cancellation, expiry), sent by the App Store or Google Play through RevenueCat
2.4 Advertising data
If you consent to personalised advertising, Google AdMob may collect your advertising identifier (IDFA on iOS, GAID on Android), your approximate IP address and behavioural data. This processing is subject to your consent (see section 5).
2.5 Technical data
- Device identifier (AdMob configuration)
- OS and application version
- IP address (server logs — retained for 30 days)
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account management and authentication | Performance of the contract |
| Leaderboard display | Legitimate interest |
| Sending transactional emails | Performance of the contract |
| Personalised advertising | Consent |
| Non-personalised advertising | Legitimate interest |
| In-app purchases (RevenueCat) | Performance of the contract |
| Content moderation (pictures) | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
4. Third-party services
| Service | Role |
|---|---|
| Supabase | Database and storage (avatars) — hosted in Europe |
| Railway | Server infrastructure (API) |
| Google Sign-In | OAuth 2.0 authentication — email, name and picture transmitted at sign-in |
| Google AdMob | In-app advertising |
| RevenueCat | Subscription and in-app purchase management |
| Resend | Transactional email delivery |
| Sightengine | Automated moderation of profile pictures |
| Vercel | Hosting of atlasio.world and cookieless audience measurement |
5. Advertising and consent (AdMob / GDPR / ATT)
Atlasio uses Google AdMob to display ads to non-Premium users.
- EEA / United Kingdom (GDPR): a UMP consent form is shown on first launch. You can change your preferences at any time from Settings → Manage ad preferences.
- iOS (App Tracking Transparency): Apple separately asks for your permission to track across apps.
- If you decline tracking, you will see non-personalised ads.
- Premium users see no ads at all.
6. Retention periods
| Data | Retention |
|---|---|
| Account data | Until the account is deleted |
| Authenticated sessions | 7 days (automatic rotation) |
| Scores and history | Until the account is deleted |
| Email verification token | 24 hours |
| Password reset token | 15 minutes |
| Server logs (IP) | 30 days |
| Subscription history | Until account deletion, then kept with no link to you |
7. Your rights (GDPR)
If you reside in the EEA or the United Kingdom:
- Access: obtain a copy of your data
- Rectification: correct your data (directly by editing your profile in the app)
- Erasure: delete your account from Profile → Delete my account (automatic and immediate)
- Portability: receive your data in a structured format
- Objection: object to processing based on legitimate interest
- Withdrawal of consent: change your advertising preferences at any time
To exercise your rights: contact@pick.social
You may also lodge a complaint with the CNIL (France).
8. Security
- Passwords hashed with bcrypt (cost factor 12)
- Communications encrypted over HTTPS/TLS
- JWT tokens with short expiry and rotation (refresh token)
- Tokens stored encrypted on mobile (Expo SecureStore)
- Automated moderation of profile pictures before publication
9. Children
Atlasio is not intended for children under 13. If you believe we have collected data from a child, contact us at contact@pick.social.
10. Changes
In the event of a substantial change, we will inform you through an in-app notification. The date of the last update appears at the top of this document.
11. Website (atlasio.world)
The atlasio.world website is a showcase: you cannot create an account there, it shows no advertising and asks you for no personal data.
We measure traffic and page speed with Vercel Analytics and Vercel Speed Insights. Both work without cookies and without advertising identifiers: the measurements are aggregated (page views, country, device type, load time) and cannot identify you or track you across sites.
A single cookie is set, NEXT_LOCALE, which remembers the language you chose. Strictly necessary for the site to work, it is never used for tracking — which is why no consent banner is shown.
12. Contact
📧 contact@pick.social
Data controller: PICK SAS — 60 rue François Ier, 75008 Paris