Account activity & privacy
Free browsing and private codes
Browsing the public directory does not require an account. A private access code opens one workspace without an email or external sign-in. Treat your code like a password: anyone who has it can access that workspace. Use one code per person. The administrator issues and can revoke codes; only hashes of codes and session tokens are stored in the database.
Your workspace
After entering a code, you acknowledge the activity notice before creating a profile. We collect your first and last name and store them together as your display name. We also store your assigned member label, internal account ID, saved roles, stages, notes, and account dates. A secure sign-in cookie lasts up to seven days. No marketing signup is implied. Existing browser-local directory notes are not automatically imported.
Your Atlas agent
Optional FDE onboarding reads PDF or text resumes on your device. The original file is not uploaded. Only the resume text, name, background, skills, and preferences you review and confirm are stored in your private account. Remove contact details or sensitive information you do not want stored. No resume data is sent to an AI provider or employer. This release uses title and location rules for shortlisting, not an AI resume assessment. Saving an agent profile does not authorize applications or charge fees.
Export or delete the saved agent profile from My data & settings on the agent page. Deleting the whole workspace also deletes that profile. Agent profile text is not shown in the admin dashboard, but is stored on the server, is not end-to-end encrypted, and may be accessible through authorized infrastructure maintenance. The administrator can see that a profile was saved.
Private invitation links provide one sign-in within seven days. Treat a link like your access code. Its secret is stored hashed, exchanged only when you choose to continue, and removed from the address bar. Keep your member code for future sign-ins or request another link from the administrator.
Optional Ashby FDE application pilot
The application desk is separate from the text-only profile importer. If you explicitly upload a PDF there, Atlas stores the original file privately in object storage, with its filename, size, integrity hash, and your account ID in the database. Only your signed-in workspace and the authorized submission service can download it. Keep your access code private. Uploaded PDFs are not publicly accessible or shown in the administrator dashboard. Files are checked for format and size; this is not a comprehensive malware scan.
Application contact details, reviewed answers, role URLs, authorization records, statuses, and confirmation text are stored privately. Each draft holds the exact contact details and resume version for that role. Profile changes do not silently change an already prepared application. No resume or answers are sent to an AI model in this pilot. Templates fill only supplied facts; unsupported questions require your input.
When the separate submission service is enabled and connected, you can authorize up to five selected applications. That consent allows the reviewed data and PDF to be sent to the named employers through Ashby. An employer or its application service can receive data during form filling, even if a final submission stops. Employer privacy terms apply to their copies. Atlas does not store employer passwords, solve CAPTCHA, or claim a submission without observed employer confirmation. An uncertain result is not retried automatically. Payments are not enabled.
The submission service processes only jobs it has claimed from approved batches and uses a fresh browser session for each job. Authorized infrastructure operators may access application data for maintenance; it is not end-to-end encrypted. No browser recordings or screenshots are retained by this pilot. Export your application data and download your PDFs from the application desk. They remain until you delete application data or your workspace. Deletion waits while a submission is running and removes stored PDF versions, drafts, answers, and receipts; it cannot withdraw an employer's copy. Deleting application history also removes duplicate-prevention history, so check earlier applications before restarting.
Public collaboration projects
Publishing a project is optional and requires a separate confirmation. The project brief, your workspace name, the bio and links you provide, and your collaboration email become public. These are separate from private resume text and notes, which are never automatically copied into a project. Use an email you are comfortable publishing. Contact links open your email application; Atlas does not deliver or store email messages, verify email ownership, or guarantee project claims or collaboration terms.
Project owners can edit, stop recruiting, or unpublish under Projects / My projects. Unpublishing hides the brief but retains it for editing. Deleting your workspace deletes projects you submitted, subject to infrastructure backup retention. Export your project data from My projects before deleting. Founder-provided public showcase briefs are maintained separately from member accounts.
Admin visibility
Atlas collaboration requests store your introduction, supplied email, availability, optional portfolio link, request status, and the owner's response. These records are shared only with the applicant and project owner through the collaboration dashboard, not public visitors or other members. Authorized infrastructure maintenance may access stored data; it is not end-to-end encrypted. Export your records in Collaborations. Deleting either participant's workspace removes their request records. Withdrawal stops the collaboration but retains the request history for both participants until account deletion. Email notifications, group chat, repository access, and payment arrangements are not enabled.
The administrator can see names, member labels, account dates, code usage, workspace visits, tracked roles, stage updates, and application-link openings. Private note contents are excluded from the admin dashboard but are stored on the server and are not end-to-end encrypted. Authorized infrastructure access may permit access for maintenance. Avoid passwords or sensitive personal information in notes.
We do not record keystrokes or activity on employer websites. Opening an application link does not mean it was submitted. Only a separately authorized application-pilot run can submit on your behalf.
Retention and deletion
Tracked roles and profiles remain until removed. Activity is displayed for up to 90 days, with older events removed on later workspace updates. Expired sign-in sessions and temporary rate-limit records are cleaned up on later sign-ins. Sign-in rate limiting uses a salted hash of the network address, not the raw address.
Use Account & privacy to export or delete your workspace. Deletion removes the active profile, roles, notes, events, access codes, and sessions for that workspace. A separately submitted waitlist signup and browser-local directory notes are not affected. Infrastructure backups may retain prior copies according to provider retention settings.
Hosting
Role Atlas runs on OpenAI Sites and Cloudflare infrastructure. Hosting providers process information under their own terms and policies. No external sign-in account is required.
Return to workspace