ATOM account privacy notice
Version: public-account-2026-10-17
Read the versioned plain-text notice
Publisher and contact
ATOM is published by Austin Peppers as an individual. Privacy and support questions may be sent to Peppera091@gmail.com. Do not send passwords, recovery codes, payment details, license identifiers, repository contents or raw diagnostic files.
Accounts and sign-in
Your account connects sign-in, policy acceptance, billing status and approval of ATOM installations. The website links to the configured account service. Enter your password and saved recovery code only in that service's account forms, never in Codex or another chat.
The account service receives your username and password when you register or sign in. Account storage includes your normalized username, a salted password verifier, a recovery-code digest, policy versions and acceptance times, and account/security metadata. A password is not stored as a password-account field; this does not mean it never enters request-processing memory.
Password sign-in uses a Secure, HttpOnly browser cookie and a server-side session digest. Optional genuine passkeys use public-key credential records. The existing passkey portal also uses browser-tab session storage for its authorization token; optional account linking holds temporary authorization in memory. Password sign-in does not establish passkey verification. Requests also supply network metadata used for authentication and abuse limits.
Changing a password preserves genuine passkeys. Recovery changes the password and saved recovery code, revokes browser credentials and passkeys, and preserves the same account's billing and device grants. These actions do not erase account or billing history.
Payments and installation access
Payment details are entered on Lemon Squeezy's hosted checkout. Checkout links carry signed account and offer references. ATOM verifies provider messages and retains billing/subscription identifiers, normalized facts, digests and provenance used to decide account-bound access. Provider messages can contain additional provider-supplied metadata. ATOM's inspected account forms and persisted billing projection do not define card-number or CVC fields. Lemon Squeezy's separate privacy notice is at https://www.lemonsqueezy.com/privacy.
Device approval links an installation to your account. Licensing processes account, license and device identifiers, version information and signed entitlements. Main account storage retains signed entitlement and activation history. The plugin verifies its signed entitlement locally. The licensing data contract excludes repository contents, source code, prompts, diffs, local coordination receipts and build reports. Signing up, navigating to checkout or returning from checkout does not itself grant paid access.
Storage, recovery and retention
Cloudflare hosts the selected account-service and separate private recovery-custody storage. The custodian receives integrity hashes, counts, monotonic values, target/operation metadata and recovery bookmarks, rather than the underlying account rows. Account rows can also exist in separate platform backups or point-in-time recovery history.
Account, billing and audit history is retained by the current implementation. Selected temporary records are pruned during later operations. Session expiry, sign-out, revocation and the seven-day recovery-eligibility window are not account or backup deletion schedules. There is no automatic account-erasure workflow in the selected implementation. Contact the publisher for privacy or account-data questions; this notice does not promise a deletion deadline or removal from all platform backups. Hosting request/security logs and backup retention are separate from application validity and cleanup rules.
Optional website analytics
Website analytics is separate from account storage and requires opt-in. It records allowlisted public-page/event, coarse referral/device categories and a day-bound hash of a rotating browser identifier. Account routes and account/license/payment fields are excluded from this analytics projection. Global Privacy Control and Do Not Track keep analytics off. Change your choice through Privacy choices on the website.
The analytics reporting window is 30 UTC calendar days. Older rows are deleted on the next accepted event or owner report request. Withdrawing consent stops future collection and clears the daily browser identifier; it does not erase prior events. Provider request/security logs and backups have separate policies. A download click does not prove a download, installation or purchase.
ATOM account data flow
Version: public-account-2026-10-17
Read the versioned plain-text notice
1. Website to account service
The website offers fixed HTTPS navigation to sign-in, registration, billing and device approval on the configured account service. It does not forward visitor-supplied return URLs, passwords or device codes. Navigation alone starts no payment and approves no device.
2. Browser and account storage
Account inputs are submitted to the account service in request bodies. The service processes usernames, passwords or recovery inputs, policy consent, cookie/session or passkey authentication and abuse-limit metadata. Storage holds salted password verifiers, recovery/session digests, passkey public-key metadata, consent versions/timestamps and security history. Browser cookies, tab session storage and temporary account-link authorization have distinct roles. Password sign-in is not passkey authentication.
3. Checkout and billing
The account service supplies a configured Lemon Squeezy checkout link with signed account and offer references. The browser enters payment information at the provider. Lemon Squeezy sends signed webhook messages to ATOM; after verification ATOM retains normalized billing facts, identifiers, digests and provenance. Raw messages can contain additional provider metadata. Paid access requires the appropriate account, current policy consent and verified eligible billing authority. A checkout redirect does not grant access.
4. Installation approval and entitlements
The plugin and account service exchange a device-binding identifier, device/user authorization codes and scoped authorization results. Explicit browser approval links the installation to the same account. The service issues signed activation/refresh entitlements; the plugin verifies them locally. Main account storage retains signed documents and activation/replay history. The licensing fields exclude repository contents, source code, prompts, diffs, local coordination receipts and build reports.
5. Private recovery custody
The main authority sends schema/state/table hashes, counts, monotonic floors, target/operation metadata and a platform bookmark through a private service binding to a separately keyed recovery custodian. The custodian keeps signed receipt/pending metadata, not the underlying account/password/payment rows. Main storage and separate backups can still contain account verifier, session and billing data. Recovery eligibility does not schedule their deletion or prove that a restore has been performed.
6. Optional website analytics
Only opted-in public-page events go to the website's same-origin analytics endpoint and separate Cloudflare D1 storage. Stored fields are closed public-page/event/referral/device categories and a day-bound browser-token hash. Account routes and account/license/payment fields are excluded from this projection. Host request/security metadata and backups are separate. Application expiry, opportunistic cleanup and withdrawal of analytics consent have different effects; see the privacy notice.
Publisher: Austin Peppers, individual. Privacy/support: Peppera091@gmail.com. Do not send credentials, payment details, license identifiers, repository contents or raw diagnostic files.
Public website
Optional first-party website analytics records visible public page visits, estimated daily browsers, coarse referral and device categories, and clicks on the Customer beta download link. Collection starts only after you choose “Allow analytics.” “No thanks” leaves it off. Use “Privacy choices” on any public page to change your choice. Global Privacy Control and Do Not Track signals keep analytics off even after a previous opt-in.
Your choice is saved in this browser. After opt-in, a random browser identifier rotates each UTC day; the server stores its day-bound hash. We do not store IP addresses, raw browser identifiers, full user-agent strings, referral URLs, URL queries or fragments, account information, license codes or payment data in the analytics database. Account pages are excluded. Known automated browsers, prefetch traffic and signed-in sessions are filtered. Filtering is not perfect, and an estimated browser is not a verified person.
Analytics is hosted with this site in Cloudflare D1 and reports are available only to the configured owner after ChatGPT sign-in. Live records are available for 30 UTC calendar days; expired records are deleted on the next accepted event or owner report request. Hosting backups have their own retention policy. Withdrawing consent clears the daily identifier and stops future collection; it does not remove already recorded activity. The host may separately process ordinary request and security metadata under its own policies.
Download clicks do not establish completed downloads, installations or purchases. No advertising tracker is used.
Local ATOM plugin
Repository inspection and coordination are local by default. ATOM’s declared licensing boundary excludes prompts, source code, diffs, receipts, and build reports. Support and operational evidence use bounded, documented fields and are not transmitted automatically.
Public inspection companion
A planned public companion would let an authenticated user inspect a linked, managed workspace. It would not let callers select arbitrary files or folders, and it would not provide paid builds, checkout, activation, analytics, long-term continuity, or support tools. The service is defined in source but is not deployed, so it is not processing public requests today.
Receipt retention
The release candidate is designed to make public inspection records unavailable 30 days after creation. Expired records are removed at service startup and during hourly checks. Looking up a record cannot create missing data or alter the inspected project. Local ATOM records are outside this public-service policy. Because the service is not deployed, this describes tested candidate behavior—not live processing.
Publisher and contact
ATOM is currently published by Austin Peppers as an individual. Privacy and support questions may be sent to Peppera091@gmail.com. Do not include source code, prompts, diffs, repository paths, credentials, payment data, license identifiers, or raw diagnostic files.
Before public-service launch
The planned public inspection companion’s final hosting and sign-in data flow, service providers, verified domain, and live retention evidence must be documented before submission to OpenAI. This policy does not claim that those launch steps have occurred.