Privacy notice

The controller under the EU General Data Protection Regulation (GDPR) is Mike Zaschka, Sonnenweg 27, 36289 Friedewald, Germany, opensource@mikezaschka.com. No data protection officer is appointed, as none is required for a project of this size.

What is collected

The site is prebuilt and served by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Like every web server, the host records a log line per request: the requested address, the time, the response code, the transferred size, the browser identification string and the IP address. The atlas sets no cookie unless you sign in (section 3a), embeds no advertising and loads no third-party fonts — type is bundled with the site at build time, so no request goes to a font service.

Page statistics

The site counts its page views with Vercel Web Analytics, run by the same host. It sets no cookie. For each page view it records the time, the address of the page (with query parameters filtered), the page that linked to it, the country, region and city derived from the request, the operating system, the browser and the kind of device, each with its version. To count visitors rather than requests it forms a hash from the incoming request; the hash is discarded after 24 hours and is not used to follow anyone across sites. What the operator sees is aggregated: how often a page was read and where readers came from, never one person’s visits. Some page addresses name a person, because the atlas has a page for each maintainer and author (section 4); those addresses are public already, and the statistics count them like any other page. The purpose is to know which parts of the atlas are read, and so where curation is worth the effort. The legal basis is Article 6 (1) (f) GDPR, that legitimate interest, weighed against data that does not identify you. You can object (section 7), or stop it yourself by blocking the statistics script in your browser; the site works the same without it.

Kept in your browser

Some of what you choose is kept in your browser’s own storage, not in a cookie and not on the server: the light or dark theme, how the graph is drawn, your flight in Explore (the ship, what you have charted, your missions) and your orb (its name, its design, which of its features are on, whether it shows on the atlas’s pages, whether it has welcomed you, and whether you chose to use the atlas through your agent, as pages, or in Explore). It stays in that browser and leaves it only if you sign in (section 3a). This is storage the features you use need to work, so it needs no consent.

Your orb also keeps you company on the atlas's pages. So it can say when you were last on a page, your browser keeps the pages you opened and the day you last opened each, the 300 most recent. That list never leaves your browser, is not part of a signed-in account, and goes when you clear the site's data. Put the orb away and it stays away until you bring it back from its settings.

Your logbook keeps the last 50 distinct atlas items you opened or inspected in Explore: their names, item references, local page addresses and visit times. This recent history stays in this browser, including when you sign in. You can pause recording, remove an item or clear the history from the logbook. Pause and clear also apply to the orb's page-visit memory described above. Bookmarks made while signed out stay in this browser until removed or the site's data is cleared. Copying them to a signed-in account is an explicit action.

Why, and on what basis

Server logs serve to deliver the pages you request, keep the site available and detect abuse; the page statistics are covered above. The legal basis is Article 6 (1) (f) GDPR, the legitimate interest in running a secure and stable website. The host retains request logs for a short period for operational purposes; the operator does not export or evaluate them per person.

Transfer outside the EU

The host is a US company with points of presence worldwide. Vercel is certified under the EU-US Data Privacy Framework and provides the EU standard contractual clauses in its data processing agreement; requests from Europe are normally served from European edge locations.

When you use the contact form the name, email address, reason and message you enter are sent as one email to the operator’s mailbox and are used only to handle your request. The form is delivered by Resend, Inc., a transactional email provider, from its EU region, acting as processor under its data processing agreement with the EU standard contractual clauses; nothing is stored on the site itself. Your email address is set as the reply address, so an answer comes from the operator’s own mailbox. The legal basis is your consent under Article 6 (1) (a) GDPR, which you give by ticking the box and can withdraw at any time, and, where your message concerns an entry or a request for information, Article 6 (1) (f) GDPR. Messages are kept as long as it takes to handle them and are deleted no later than twelve months after the last exchange, unless a statutory retention period applies. Emailing the operator directly is handled in the same way.

Reading and exploring need no account. Signing in is optional: what you make in Explore, the ship you fitted and named, what you have charted, the missions you finished, the entries you pinged and the jokes your orb has heard, and your orb itself, its name, its design and whether it shows on the atlas’s pages, follows you to any browser you sign in on. Bookmarks saved while signed in also follow you. Reading and exploring need no sign-in. These saved items are private; publishing a profile orb is a separate choice.

What is stored

When you sign in with GitHub, GitHub tells the site your account id, your login name and the address of your avatar image; the site asks for nothing else (the read:user scope, never your repositories or your email address). These three, and your flight and your orb as your browser keeps them, and bookmarks (item reference, name, local page address, kind and save time), are stored as one record under your GitHub id; while you are signed in, a change you make on any page is saved there a few seconds later. The list of pages you opened and your recent-item logbook (section 2) are not part of it. Bookmarks are saved when you press Bookmark; doing so does not subscribe you to notifications. A session cookie (oda_session, signed, valid for ninety days) keeps you signed in; it holds the same three values and nothing else. While you sign in, a second cookie (oda_oauth, valid for ten minutes) holds a one-time value that protects the sign-in from being forged, and the page to return to. Both are strictly necessary for the service you asked for, so they need no consent banner.

Your community profile

An account makes you part of the public community, whether you read, write, maintain or contribute. The directory shows your GitHub login and avatar, and your join date when recorded. If that GitHub identity already belongs to an atlas person, the directory shows one combined entry. Older accounts with no recorded creation date are listed without a join date. Your bookmarks, follows, reading history, flight, private orb settings and messages remain private. You can save a private introduction draft on Your community page. Only pressing Publish makes its text visible on your profile and people cards. Withdrawing removes the public copy while keeping your saved draft; deleting your account removes both. Open pages may keep the old text until refreshed. Publication dates are retained while your account exists, so editing or republishing does not make an introduction appear newly shared. Deleting your account removes the member profile; independently sourced public work attribution follows the correction and removal process described below.

Following and updates

Following requires sign-in. Your account stores up to 50 followed item references, when you followed them, identifiers for their known work and releases, and up to 100 grouped updates with their read status and the time they were noticed. This information is private. The site checks for changes when you return and while it is open; following sends no email. You can unfollow in your logbook. Updates that no longer relate to anything you follow are removed. Deleting your account removes its follows and updates too.

Your public profile orb

When you design an orb while signed in, its name and appearance, and a discovery (title, story and link) you added earlier, are published in the Playground’s Orb Harbour. If your GitHub account is linked to a person in the atlas, the orb appears beside that person in the flight. This creates a public copy linked to your GitHub identity for visits and play. Signing in alone publishes nothing: an orb is published once you have made one. Its first-publication date is recorded and kept while your account exists. Saving your orb design updates its public appearance. There is no setting to hide an orb; deleting your account removes the public copy. Visitors already viewing it may see it until they reload or return to the page; Explore refreshes its cached copy within roughly 35 seconds while active.

The Playground’s room chat

Shared flight shows your signed-in GitHub identity, matching atlas profile, ship and orb to the other players. You can switch to solo flight at any time. A signed-in pilot can type a line into the room’s chat. The line travels through the presence service with your GitHub login and your orb’s name, is kept there with the last fifty lines for as long as that room exists, and is sent to everyone who is in the room or joins it. It is not stored anywhere else, not shown on any page, and gone when the room ends. Guests read and cannot write. The operator keeps a word list that refuses a line to its sender, and every line carries a report link into the private contact lane.

The Playground’s flight counters

While you fly in the Playground’s shared room, the presence service counts your flight: units flown, jumps, distinct signed-in people met live and time in the room. If you are signed in, it signs those counts once a minute and your browser sends them to the site, which adds them to your account’s totals and to your orb’s row on the TechEd boards. The boards show the orb’s name and face, never your login. The room also counts the entries you ping from nearby, artifacts, people, capabilities and content, plus jokes heard, Museum exhibits opened, detail pages opened, videos watched and published Harbour orbs that greeted you. A video counts after 30 seconds of visible playback, or 90% of a shorter video. Only its id is recorded, not a playback timeline. The site keeps entry ids and the GitHub logins of greeted players and orb owners to count each once during the event, including across reconnects; the boards show counts only. A guest’s flight is counted in the room and recorded nowhere. Deleting your account removes its private totals. At the TechEd cutoff, the public final standings are frozen in the Orb Hall of Fame with orb names, appearances and counts.

Where the presence service runs

The presence service is a Cloudflare Worker with a Durable Object for each room, run by Cloudflare, Inc. as processor under its data processing agreement with the EU standard contractual clauses. Cloudflare places a room near where it is first opened. Your browser connects to it only when you fly in the shared room; Cloudflare receives your IP address to deliver that connection. The room holds what it shows the other players, the chat lines and the counts described above for as long as the room exists. Solo flight never connects to it. The legal basis is Article 6 (1) (b) GDPR: you joined the shared room, and showing you to the others in it is the service.

Uses, thanks and maintainer notes

Signed-in readers can say they use an artifact, and thank the people behind an artifact or a reading, with one click and no words. We store, for each work, your account identifier, your GitHub name and the date. The work’s page shows only how many readers use it and thanked it, never who. The people the atlas names as maintaining the work, or as the authors of a reading, see your GitHub name and the date when they sign in; people the atlas names as contributors see that someone did, without your name. No email is sent. Clicking again takes a use or a thanks back. A daily count of how many you set or took back supports abuse prevention.

A person the atlas names as a maintainer of an artifact, or as an author of a content item, can publish a note on its page: the text, an optional link, their GitHub name and the date. It is shown as soon as it is saved, and they can change or remove it at any time.

Your uses, thanks and maintainer notes are removed when you delete your data. Already-open pages, screenshots and copies may retain them.

Where, and on what basis

The record is held in a key-value store run by Upstash, Inc. as processor, in the region the site is configured for, under a data processing agreement with the EU standard contractual clauses. The legal basis is Article 6 (1) (b) GDPR: you asked for your flight to be kept, and keeping it is the service. GitHub’s own handling of the sign-in is governed by GitHub’s privacy statement.

How long, and how to delete it

The record is kept until you delete it. Sign out, in the account menu, drops the cookie and leaves the record for your next sign-in. Delete my data, in the same menu, removes the record, any published profile orb, sent and received notes, and the session; your browser keeps its own copy of the flight until you clear it there. You can also ask by email at opensource@mikezaschka.com.

The atlas maps software and the writing about it, and both are made by people. For a maintainer or an author it may hold: the name or handle you publish under, the organisation you publish for, links to your public profiles, the entries you maintain or wrote, and counts and dates derived from that public activity — repositories pushed this year, a last release date, the platform statistics a post displays. It holds no contact details beyond what a public profile shows, and no special categories of data.

Where it comes from

Public sources only: package registries such as npm, GitHub and the profiles and repositories published there, the SAP Community, and the authors’ own sites. Curated lists elsewhere are credited as sources. This paragraph is the information required by Article 14 GDPR for data not obtained from you.

Why, and on what basis

The purpose is to credit work to the people who did it and to show, factually and dated, whether something is maintained. The legal basis is Article 6 (1) (f) GDPR: the legitimate interest of the developer community in an attributed, current map of the ecosystem, weighed against the very limited nature of the data, all of which you have already published in a professional context. Origin never influences a reading, reach is never summed into a leaderboard, and nothing is graded, so an entry says what you made and when it moved, and no more.

Drafting with AI

Most of the text in the atlas is drafted with AI. To draft it, tools run on the operator’s machine send the text of the public page an entry describes, which usually includes its author’s name, together with parts of the atlas’s own entries, to Claude, a language model provided by Anthropic. Nothing else is sent: not the contact form, not server logs, and nothing that is not already published.

The tools run under the operator’s Claude Max subscription, which is a consumer plan. Anthropic therefore does not process this material on the atlas’s behalf; it receives it as a controller in its own right. For people in the European Economic Area, the UK and Switzerland that is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (privacy@anthropic.com). Its privacy policy sets out how long it keeps what it receives, whether it uses it to improve its models, and how it transfers data to the United States, for which it relies on adequacy decisions and standard contractual clauses.

The legal basis is Article 6 (1) (f) GDPR, the same legitimate interest as above: describing public work accurately, and keeping those descriptions current, across an ecosystem too large to write up by hand. You can object to this as to the rest of this section (see section 7).

How long

As long as the entries you are attached to remain in the atlas. Crawled numbers are overwritten at each crawl; only dated transitions are kept. You can object at any time (see section 7), and an entry about a person is removed on request without needing a reason. So that a later crawl does not add a removed person again, their GitHub login is kept afterwards only as a one-way hash (SHA-256) in the public repository: enough to recognise the login if it turns up, not enough to read it back.

The hosted endpoint at /mcp answers the same tools over the web. It is stateless: each request is answered from the bundled graph and nothing of it is kept by the site, beyond the host’s server log (section 2). What a request sends there has left your machine: it is read to answer that one request and is not stored.

Feedback on the atlas is public on GitHub. If you open an issue there, GitHub processes your data under its own privacy statement, and your issue — including your GitHub name — becomes part of the public history of the repository.

Under the GDPR you have the right to:

• access the personal data held about you (Article 15);
• have inaccurate data corrected (Article 16);
• have data erased (Article 17) or its processing restricted (Article 18);
• receive data you provided in a portable format (Article 20);
• object to processing based on legitimate interest (Article 21) — which includes the entries described in section 4;
• withdraw consent given for the contact form, without affecting earlier processing;
• lodge a complaint with a supervisory authority, in particular the one for your place of residence or for the operator’s seat in Germany.

To exercise any of these, use the contact form with the reason “privacy or data request”, or email the address in section 1. Requests are answered within one month.

For residents of California and of other US states with comparable privacy laws: the atlas does not sell personal information and does not share it for cross-context behavioural advertising, has not done so in the preceding twelve months, and uses no tracking that would require a “Do Not Sell or Share” control. The categories collected are the identifiers in server logs and the aggregated page statistics (section 2), the contact details you choose to send (section 3), your GitHub account id, login and avatar if you sign in (section 3a) and the public professional information described in section 4. You may request to know, correct or delete this information, and you will not be treated differently for doing so, through the channels in section 7. Requests may be made by an authorised agent with proof of authorisation.

The atlas is written for working developers and is not directed at children. No data is knowingly collected from anyone under sixteen.

When the site gains a feature that touches personal data, such as submissions, votes or comments, this notice is updated first, and the date at the top changes. The history of every version is in the public repository.