Privacy policy

Who we are

atomo.social is run by Mykola Solodukha, an individual based in Ukraine (“we”, “us”). We operate the website at atomo.social and the atomo app for iOS. You can reach us at [email protected] or through the support page.

What this policy covers

This policy explains what personal data we collect when you use the website or the iOS app, why we collect it, who can see it, how long we keep it and what you can ask us to do with it. It is one account across both: everything below applies whether you sign in from a browser or from your phone.

What we collect and why

Your account

Your email address, name and username, and either a password (stored only as a hash) or the sign-in method you chose instead: Google, Apple or a sign-in link sent to your email. We also keep whether your email is verified and who invited you, because atomo is invite-only.

Your profile

Whatever you type into your profile: a bio, your city, a photo, your website and social links, your birth date, sex, phone number, where you work or study, and the answers you give on forms we ask you to fill in. You choose what goes there and you can change or remove it at any time.

Data a community gives us

A community’s managers can upload their member list, so we may hold your name, email address and whatever else was on that list before you ever sign up: extra emails and phone numbers, sex, birth date, country, region and city, Instagram handle, occupation, status, workplace, place of study, graduation city and year, a delivery city and a T-shirt size. We keep it so the community can manage and search its members. When you sign up with that email address it becomes part of your profile and you become a member of every community that listed you. If you are on such a list and would rather not be, write to us and we remove it.

What you post and do

Posts, comments and likes; the communities you join and your join requests; event RSVPs and tickets; photos and videos you upload to an event album; announcements you write as a host; and your activity in mixers. This is the service itself: it exists so other members can see it, within the visibility you and the hosts set. An album shows a copy of each photo or video with its camera and location metadata removed; we keep the original you uploaded, metadata included, so the album can be re-rendered.

Events and payments

Your RSVP status and party size for each event. For a priced ticket we keep the amount, the payment status and the payment link we gave you. The link is created through mono.surf, a Monobank payment-link service we operate, and the payment itself happens on Monobank’s page. Card details never touch atomo: we learn only whether the payment went through.

On your device and in your browser

The iOS app keeps your session token in the device Keychain, caches the pages you open so they load quickly, and shares your current ticket with the home-screen widget through an App Group on the device. It uses no advertising identifier and no tracking. The website sets a session cookie so you stay signed in, and uses browser storage to remember your theme choice and which product tours you have already seen. We set no tracking cookies of our own.

Sign-in providers

While you are signed out, the website loads Google’s sign-in library so that “Sign in with Google” and Google One Tap work; Google may set its own cookies, under Google’s privacy policy. Sign in with Apple and email sign-in links set none.

Analytics

When enabled, the website counts page views with Umami, which runs on our own server, so no analytics company receives anything. It uses no cookies and records no personal identifiers: the page address without its query string, the site you came from, your browser, operating system, device type, screen size and language, and a country derived from your IP address, which is not kept. The iOS app has no analytics and no crash-reporting SDK.

Waitlist

If you leave your email on the coming-soon page, we keep it to tell you when we launch and for nothing else. Write to us and we remove it.

Server logs

Like every web service we log requests: your IP address, the page asked for, your browser type and the request headers, to keep the service secure and to find bugs. We use those logs for nothing else.

How we use it

• To run the service: sign you in, show your profile and content to other members according to your settings, and let you join communities and events.
• To send you emails you need: verifying your address, sign-in links, tickets and event updates, and notices about your account.
• To take payments for priced tickets and to show hosts and community managers what was paid.
• To keep the service safe: preventing abuse, investigating problems and protecting accounts.
• To match and find people: a short summary of your profile, and the message you write when you ask to be matched in a mixer, are turned into a numeric representation by an AI service so we can suggest matches and let community managers search their members by description.

We do not profile you for advertising and we show no third-party ads. We never sell your data: not to advertisers, not to data brokers, not to anyone.

Who can see it

Your profile is public by default, including the email address on it: anyone on the web can open it, signed in or not, and so can search engines. Settings has a switch for each: a private profile is visible to signed-in members only, and its posts to your friends only. Everything else is visible to other members according to the visibility settings on each thing. Events can be public, unlisted or private, and the host chooses whether the guest list is shown. Your event history is visible to your friends only.

A few companies process data on our behalf so the service can run: our hosting provider, an object-storage provider for uploaded images, an email delivery service, Monobank for payments, Apple for Sign in with Apple and Wallet passes, Google for Sign in with Google, and two AI services: OpenAI, which computes the numeric representations used for matching and people search, and OpenRouter, which passes a community manager’s people-search conversation and the member profiles it needs to an AI model provider to answer. We ask OpenRouter for zero data retention on every such request, so it routes only to model endpoints that store neither the conversation nor the profiles after answering and do not train on them; the one exception is the in-flight screening for child abuse material that the law requires, which may hold flagged content for review. Each of these companies sees only what their job needs and handles it under its own privacy terms, linked above. We share data with nobody else unless the law requires it.

How long we keep it

For as long as your account is open. When you delete your account, it closes at once: every session ends, your profile disappears and your future RSVPs are given up. Your data is deleted for good once 30 days have passed. If you change your mind, sign in before that day and the account stays as it is, though the event seats you gave up are not returned.

A few records outlive the account because they belong to other people’s history or are needed for accounting and security: payment and ledger records, your past RSVPs, events you hosted, the mixer pairings and swipes you were part of, photos and videos you added to event albums (originals included), quest proofs, the invite links you used and created, community managers’ people-search conversations (including the answers that mentioned you), and server logs. Your name is replaced by “Deleted user” on them. Your own posts go, and with them the comments and likes other members left on them.

Your rights

You can ask us to show you the data we hold about you, give you a copy of it, correct it, delete it, or stop using it for a particular purpose. You can delete your account yourself in the iOS app once that is available; until then, and from the website, write to us through the support page. We answer within 30 days. If you live in the EU or the UK, these are the rights the GDPR gives you, and you may also complain to your local data protection authority.

Age

atomo is for adults. You must be at least 18 years old to have an account. If we learn that an account belongs to someone younger, we remove it.

Security

Everything travels over HTTPS. Passwords are stored only as hashes. The iOS app keeps your session in the device Keychain, and access tokens expire within the hour and die at once when you reset your password or delete the account. No system is perfect: if you find a security problem, please tell us at [email protected].

Changes to this policy

The date at the top is the date this version took effect. If we change something that matters, we tell you by email or in the app before it applies.

Contact

Mykola Solodukha, atomo.social. Email [email protected] or use the support page.