PRIVACY.

This Privacy Policy explains how NomaticX, Inc. ("NomaticX," "Nomatic Atlas," "we," "us") collects, uses, shares, and protects personal information when you use the Nomatic Atlas apps for iOS and Android, our websites (nomaticatlas.com and nomaticatlas.app), the waitlist, and the beta program (the "Service"). NomaticX is the controller of your personal information.

The short version: we collect what we need to run a social app for real outdoor plans. We don't sell your data. We don't run ad networks or analytics SDKs, and we don't track you across other companies' apps or websites. And we don't use your posts or photos to train AI models.

• Account: phone number, email address, and password or Apple/Google sign-in identifiers.
• Profile: display name, date of birth (to confirm you're 18+), gender, bio, profile and background photos, activity interests, and any social handles you choose to add (YouTube, Instagram, TikTok, X).
• Content: posts, stories, photos, videos, comments, reactions, and routes you save or record.
• Messages: direct and group messages, including voice messages.
• Groups and activities: groups you join, activities you create or RSVP to, and optional RSVP details such as whether you're open to dating at an activity.
• Support and safety: bug reports, support conversations, and reports you file about content or other users.
• Waitlist: the email address you enter on nomaticatlas.com.

• Location. Only with your permission. When you allow it, the app uses your device's precise location for maps, nearby activities and conditions, and AI answers. If you consent to location-based features, we store your most recent location (not a history) and delete it when you withdraw consent. On iOS, if you record a route and grant "Always" permission, location is collected in the background only while recording.
• Photo metadata. The app and our servers strip GPS and other location metadata from photos and videos before they're published.
• Maps. When you use the map, your device requests map data directly from Mapbox, which receives your IP address and the area you're viewing, and its SDK may send Mapbox usage and location data under the Mapbox Privacy Policy.
• Device and log data. Device model, OS and app version, IP address, push-notification tokens, and server logs of requests and errors. We use these to deliver notifications, secure accounts, and fix problems.
• Cookies. Our web app uses two strictly necessary cookies to keep you signed in. Neither the web app nor nomaticatlas.com uses advertising or analytics cookies.

We do not access your contacts, calendar, health data, or advertising identifier, and we do not track you across other companies' apps or websites.

Verification is performed by Stripe, Inc. (Stripe Identity). You'll be asked for a photo of a government ID and a selfie. Stripe collects and processes those images and compares facial geometry to confirm the ID is yours. We ask for your explicit consent before verification starts.

We never receive or store your ID images, selfie, or biometric data. We receive the verification result, your verified name and date of birth, and a verification session reference. Stripe acts as an independent controller of the data it collects under the Stripe Privacy Policy. When you delete your account, we ask Stripe to delete your verification sessions, including the ID images, selfie, and biometric data it holds, and we delete your Stripe customer record.

Trailhead runs on your device. Your conversations with it are not sent to our servers. Some Trailhead features do send data out:

• Web search sends your search query, without your identity, through our servers to a search service (our self-hosted SearXNG, which queries public search engines, or Brave Search).
• Place search sends your search text and approximate map area to Mapbox, and to Apple Maps on iOS or Google's geocoding service on Android.
• Trail, park, land, fishing, weather, and conditions lookups send the coordinates needed for that lookup to our servers, which query public data providers such as the National Weather Service and Open-Meteo.

Atlas AI (cloud, where available) sends your question, relevant context from the on-device knowledge base, and your location (coordinates, place name, and altitude) to our servers and to our model provider, Anthropic, PBC, to generate a response. We keep the session in memory only while it runs and discard it shortly after it finishes. Anthropic processes the data as our service provider under its commercial terms. The app limits how many cloud requests you can make each day.

See the AI Terms for the limits of these features.

• Provide the Service: accounts, feeds, groups, activities, maps, messaging, notifications, and AI features.
• Verify age and, where you choose, identity.
• Keep people safe: review reports, detect spam, fraud, and abuse, and enforce our Terms and Community Guidelines.
• Send service messages: sign-in codes, security alerts, activity and weather alerts, and waitlist or beta updates. You can opt out of non-essential email.
• Operate subscriptions purchased through the App Store or Google Play (we receive purchase status, not your card details).
• Troubleshoot, secure, and improve the Service.
• Comply with law and respond to lawful requests.

We don't use your personal information for targeted advertising, and we don't make decisions with legal or similarly significant effects about you solely by automated means.

• Your profile, posts, and stories are visible according to your account privacy setting (public or private) and the audience you choose.
• Routes are private by default until you share them.
• Group posts are visible to group members. Messages are visible to the people in the conversation.
• Your dating preference on an activity RSVP is visible only to the organizer and confirmed attendees of that activity.
• People you block can't see your profile or message you.

Anything you share with others can be copied or screenshotted by them, so share thoughtfully.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only:

• With service providers who process it for us under contract: DigitalOcean (hosting and databases), Cloudflare (network, content delivery, and media storage), Twilio (SMS codes), SendGrid (email), Apple and Google (sign-in, push notifications, place search, app distribution, and purchases), Mapbox (maps and place search), Anthropic (Atlas AI), Brave (web search), and Loops (waitlist email).
• With Stripe for identity verification, as described above.
• For legal reasons: to comply with law or valid legal process, or to protect the rights, property, or safety of our users, the public, or NomaticX, including in response to credible threats of harm.
• In a business transfer: if NomaticX is involved in a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction or consent.

• Turn location, camera, microphone, photo, and notification permissions on or off in your device settings.
• Make your account private, choose post audiences, and keep routes private.
• Block and report users in the app.
• Download a copy of your data from Settings.
• Delete your account from Settings (see below).
• Unsubscribe from non-essential email with the link in any email.

We keep your information while your account is active. When you delete your account, there's a 30-day grace period during which signing in cancels the deletion. After that, we permanently delete your account, profile, posts, routes, media, verification records, push tokens, and sessions, generally within a day.

Some records are kept longer in de-identified form, then deleted:

• Security and audit logs: up to 2 years.
• Purchase and subscription records: up to 7 years, for tax and accounting.
• Support conversations: up to 3 years.
• Messages you sent remain in the other participants' conversation history, shown as from "Deleted user."

Backups roll off on their normal schedule. Waitlist emails are kept until you unsubscribe or the beta program ends. We may keep information longer when required by law or needed to resolve disputes or investigate safety reports.

Depending on where you live (including California, Colorado, Connecticut, Utah, Virginia, Texas, Oregon, and other U.S. states, and the EEA, UK, and Switzerland), you may have the right to:

• know and access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• receive a portable copy;
• opt out of sale, sharing for targeted advertising, or profiling (we don't do these);
• limit use of sensitive information (we use it only to provide the Service);
• object to or restrict certain processing, and withdraw consent at any time; and
• not be discriminated against for exercising these rights.

Most of these are available directly in the app. Otherwise, email support@nomaticx.com. We'll verify your request using the contact information on your account, and respond within the time the law requires (generally 30–45 days). You can use an authorized agent where the law allows. If we deny your request, you may appeal by replying to our decision. If you're not satisfied, you can contact your state attorney general or local data-protection authority.

Sensitive information. Precise location, verified identity data, and your gender and dating preference may be considered sensitive under some laws. We collect them only with your consent or when you choose to provide them, and use them only to provide the features you use.

NomaticX does not collect, capture, store, or possess biometric identifiers or biometric information. Facial-geometry comparison during identity verification is performed only by Stripe, with your written consent beforehand, and is retained and destroyed under Stripe's policies. When you delete your account, we ask Stripe to delete it. To request deletion sooner, contact Stripe or email us and we'll forward the request.

We process personal information on these legal bases: contract (to provide the Service you signed up for), consent (location, identity verification, cloud AI, and marketing email, which you can withdraw at any time), legitimate interests (safety, security, fraud prevention, and improving the Service, balanced against your rights), and legal obligation.

Our servers are in the United States. When we transfer personal information from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or on adequacy decisions where available.

We encrypt data in transit with TLS, encrypt stored data at rest with our hosting providers, restrict and log staff access, and use short-lived sign-in tokens. Messages are not end-to-end encrypted. They are encrypted in transit and at rest, but authorized staff can access them when needed to investigate reports or comply with law. No system is perfectly secure. If a breach affects your information, we'll notify you as the law requires.

Nomatic Atlas is only for people 18 and older. We don't knowingly collect personal information from anyone under 18. If we learn that we have, we'll delete it and close the account. If you believe a minor is using the Service, email support@nomaticx.com.

If we make material changes, we'll post the new version here, update the effective date, and notify account holders in the app or by email before the change takes effect.

Questions, requests, or complaints: support@nomaticx.com. Controller: NomaticX, Inc., Utah, USA.