Privacy policy
Atrium is operated by Atrium Town Company (“Atrium Town”). Contact Atrium Town at hello@atrium.town.
What Atrium Town handles
You can upload a photo for your public profile, take one with your camera on a phone or tablet, or use an Atrium illustration. Your device asks before Atrium may use the camera. You choose the square of the photo that is kept; the app prepares that square on your device, and the rest of the photo is not uploaded. Uploaded avatars stay in private storage and are served through Atrium after checking access to the profile; a current public profile avatar is visible to guests. Avatar uploads count toward your personal storage limit. Replacing an avatar, returning to an illustration, or deleting your account removes access to the old image and schedules removal of its normal stored bytes. Interrupted, unused uploads are checked for cleanup hourly after an hour. Previously saved or cached copies cannot be recalled.
To run an account, Atrium Town handles your sign-in email address, account identifier, display name, username, profile information, and session information. Google and Apple sign-in are available when configured; email sign-in links, one-time sign-in codes, and invitations are delivered through an email provider. The regular interface shows display names and usernames rather than other people's email addresses.
Atrium Town stores what people submit: messages, replies, reactions, documents, task lists and their tasks (including who owns them and what they depend on), calendars and their events, answers to events (going, maybe, or can't go), photos, files, space and resource settings, membership and access rules, and reports. Calls transmit participants' audio and, when enabled, video through the call service. Atrium Town also processes information needed to operate the service, such as requests, your manual space order and personal pinned resources and direct messages, and personal saved task views and task defaults (synced privately to your account), device and notification settings, push tokens, moderation scores and decisions, and records of operator review. The browser may keep unfinished message and task entries (including task titles, notes, and subtask entries), cached content, queued edits, personal block choices, and older task view preferences and defaults on your device. New personal task views and defaults sync through your private account data; shared task views and defaults are visible to people who can read the task resource. Saving a view does not grant access to its tasks. For faster reloads, the browser can reuse a bounded, service-specific cache of public display names, usernames and avatar definitions or validated avatar paths saved within the past 24 hours, while refreshing them from Atrium. This cache excludes email addresses, full bios and private space profiles; it does not store photo bytes. The browser also stores a non-secret account hint and cached workspace navigation shared across tabs so returning pages can open while your session is checked. Queued edits remain tied to the account that made them and are checked against current server permissions before being accepted. A temporary connection or authentication-service failure does not by itself sign you out.
Previously downloaded workspace content and supported offline edits can remain available on your device after the network sign-in session expires. Offline access is unlimited by default. A space manager can require a successful access check within a chosen number of minutes. Atrium then hides that space’s cached content and pauses new offline edits when the last observed limit expires, including while the space is open; pending edits remain saved for reconnection. Network failures and server outages do not by themselves erase downloaded work or renew a limited offline period. Explicit authentication or access denials stop the affected local access. A device can only learn new space rules or revocations when it connects. These app controls do not remotely erase copies someone has already obtained. Where supported, tabs in the same browser share a local sync worker and saved workspace data; separate browser profiles and devices do not share that worker. The worker can continue delivering saved edits while another connected tab remains open. Cached workspace data is scoped by service and account, and queued work is checked against current permissions before the server accepts it. Files, photos, calls, and operations that require the server may still need a connection.
Space managers can choose default pinned resources to help members find their way. These suggestions only appear for resources the member can access and never grant access. Members can reorder, unpin, or keep a suggested pin personally; their choices sync privately to their account. New defaults append to existing pins, and removing a default preserves pins the member chose to keep.
Personal direct messages on atrium.town are conversations between two accounts, with the same history across spaces. The app groups conversations using membership in the space you are viewing; leaving a space does not delete personal conversation history or give its administrators access to that history. Private account data stores sent-message times and positions to order conversations, and records which personal conversations have had a call, separately from incoming activity and read positions. Opening an empty composer does not add it to the conversation list or accept a message request. Your personal choice to show horizontal resource tabs in each space syncs privately to your account and can override the space’s default. When tabs are enabled, each browser tab stores its own open-resource IDs, selected space, and view locations in session storage; it does not synchronize that working set to your other browser tabs.
Why Atrium Town uses it
Atrium Town uses this information to authenticate people; deliver conversations, documents, files, and notifications; apply the access settings chosen for spaces and resources; prevent spam and abuse; investigate reports; secure and troubleshoot the service; and meet legal obligations.
AI training
Atrium Town does not currently train AI models on user content. Atrium Town may use content that people make publicly readable without signing in within public spaces, including posts, documents, and images, to develop and train AI models in the future, where permitted by law. Atrium Town may use providers working on its behalf for that purpose and will describe any such sharing before it begins. This public-content rule does not include private resources within an otherwise public space. The training permission applies to content posted after these terms take effect, or older content whose author separately agrees.
Atrium Town does not currently use content in private spaces, private resources, or direct messages for AI training. No decision has been made about future training on that content. Before changing this practice, Atrium Town would explain the proposed use and provide the notice or obtain the consent required by applicable law. Sending content to a safety service for moderation is a separate use described below.
Public pages and account eligibility
Public pages can be read without an account. Atrium accounts and participation are intended for adults aged 18 and older; the service is not marketed to minors. If you believe a minor has created an account, contact hello@atrium.town so Atrium Town can review it.
Who can see content
Public spaces and their open channels and documents can be read without an account. Content in a private space, private resource, or direct message is intended for the people who have access under its settings. Space managers choose who has which level on each resource: View, Comment, Edit or Manage, under each app's own names for them. A level can be given to people, to groups, or to everyone in the space; a person's access is the highest level any of these gives them, and levels only add access. A new resource starts with a copy of the space's starting access for its app; changing that starting access later does not change resources that already exist. A resource in a folder can follow the folder's access and add people of its own. In a public space, the space's settings choose whether visitors can read each kind of resource on the web; a new resource keeps that choice, and choosing only the people added takes it off the web for good. Whether visitors can react is one setting for the whole space. Managers can move some abilities to a different level, which changes them for everyone at that level, never for one person. Space owners and administrators manage everything in the space. Whoever makes a resource is given a level on it, which a manager can change like any other. A level given to a person applies only to that person's current membership: leaving the space ends it, and rejoining does not restore it. Sharing a resource is two abilities, each at a level like any other: adding people and groups from the space, and bringing in people from outside it. On resources made from now on, people who can post in a channel, talk in a voice room or edit anything else have both, unless the space or the resource sets them higher; on resources that already existed, only the people who manage them do, until a manager moves them. Someone who shares without managing a resource can give no more than their own level, can raise people but never lower or remove them, and can undo their own last change for ten minutes while nobody else has changed who has access. Whoever can bring people in can share a resource with a person outside the space by their username, including from a personal space. That person sees only what was shared with them, the space's name, its owners and the people named on what was shared; never the member list, groups or settings. Everyone in the space and groups never include them. They can leave what was shared with them at any time, the space's owners and administrators can remove them, and joining the space keeps what was shared with them. A share from someone you have not talked to waits in your inbox's requests, and nothing from it reaches you until you accept it; a share from someone you have blocked never arrives. Until you accept such a share, people who can see who has access to it see you as pending; they are not told whether you declined it or blocked them. Once a share reaches you, the person who shared it can send you direct messages without them waiting as a message request. Whoever can bring people in can also make a share link to it, at no more than their own level, which expires after an hour to thirty days. Anyone holding the link can see the resource's name and kind, the space's name (a personal space's owner by name) and who made the link, and once they sign in, or make an account, they get the link's level on that resource as someone outside the space, without it waiting as a request. Revoking a link, or its maker losing the ability to bring people in or the link's level, stops it working; people who already joined keep their access until someone removes them. Members see who is from outside their space: a Collaborator tag by their name in messages, sharing lists and profiles, and a mark on what is shared with them. The space's People page lists them, with who added them and when, and what they can open among the things the viewer can open too. Earlier per-action rules are read as levels, each person and group getting the highest level they fully had. A combination no level expresses, such as speaking in a voice room without using its chat, or managing a resource's settings without managing who can access it, can leave someone with less than before until a manager changes it, and a resource's managers can mention groups that are closed to mentions there. While you have a document, task list or calendar open, other people who can open it see that you are there, and whether you are away (its tab hidden, or nothing typed, clicked or scrolled for five minutes), and members see who in the space is online. A space can switch both off. A personal space has no online list, but the people it shares something with see each other while they have it open. Mentioning a group notifies the members of that group who can read the message, unless they have turned off group mentions for the space. A space manager can mark a member as a bot so people can limit alerts from that account. A space can also keep connections that add or remove people from the groups they were given. Atrium stores only a digest of each connection key, in private storage that is not copied to members, and a connection does not read space content. Existing spaces pick up these rules the next time they are opened. A person who previously could only read a resource may also post until a manager sets a narrower rule, and a person who was blocked from a resource open to the whole space can open it again until a manager narrows who can open it. People who manage a resource can archive it: an archived resource stays readable by the same people but accepts no new content until it is restored, and archiving does not delete its content. While a calendar is archived, its events' meeting rooms are archived with it. People who manage an archived meeting room can delete it: the room leaves the space, nobody can open it or its chat again, and it cannot be restored. Deleting a meeting room closes it permanently but does not erase the chat or photos already stored for it from Atrium Town's systems. People who can view a document can export its contents as a Markdown file on their device. In the phone app, saving or sharing an export uses a temporary file in the app’s device cache. Document link popovers show the link text and address already in the document without requesting the linked page. Messages support text formatting and clickable links; displaying a message does not fetch linked websites. Opening a link takes you to its destination, whose privacy practices apply. Message images render only from validated Atrium media paths. A registered Atrium emoji shortcode in a message renders that emoji’s image from Atrium; any other shortcode stays text. Reference search in messages, documents, task notes, and calendar notes can look up resources in spaces you have joined. Typing a task reference search sends the search text to Atrium; results include only tasks in a resource you can currently read. A reference does not grant access to its destination. People who can view content may copy it outside Atrium; changing access or deleting content cannot recall copies they already obtained. Uploaded files are delivered through Atrium after an access check, rather than exposed as public storage objects.
Each account can have one personal space, made the first time you open it. It has no other members, and cannot be made public, listed in Discover or given a short name of its own. You can share resources in it with other people by their username, as described above; they see only what you share with them. It starts with a notes-to-self channel and a task list, and you can add other resources to it. Your posts there go through the same safety checks as any post. Your personal space is deleted with your account.
Calendars and subscription links
Anyone who can read a calendar, including guests reading a public one, can see its events, the members an organizer added to each event, and who answered. A public calendar's guest page and feed show only how many people are going, but the calendar itself is readable by guests. An event's meeting room, and its chat, are open to the same people as the event's calendar, and the chat is kept after the event like any other conversation.
You can subscribe to calendars from another calendar app, such as Google Calendar, Apple Calendar or Outlook. Your subscription link contains a secret key kept with your account, and anyone who has the link can see the events you can see. Each time a calendar app fetches it, Atrium checks your current access, so a calendar you lose access to leaves the feed. Resetting your links in Atrium stops every earlier link from working. Feeds carry event titles, times, locations, notes and links, never email addresses or anyone's answers. Once a calendar app has copied events, that app's provider holds the copy under its own terms, and Atrium Town cannot recall it. A public calendar also has a link without a key, showing only what guests can already read.
Atrium can invite people to an event by email, including people without an Atrium account. For now, only Atrium Town's operators can send these invitations, and only on calendars they organize. Atrium Town stores each guest's address, and any name the organizer gives, privately with the calendar, and uses it only to send that guest the invitation, its updates and its cancellation through its email provider. Each email names only that guest. Organizers see guests' full addresses; everyone else who can read the calendar sees the name the organizer gave or a masked address (such as s•••@g•••.com), along with each guest's answer. When a guest answers in their calendar app, the reply comes back to Atrium, which records the answer and keeps nothing else from the message. A guest's address is deleted when the guest is removed or the event is deleted. A calendar can send a limited number of new invitations each day. Guests who don't want an invitation can ignore it, or contact hello@atrium.town to have their address removed.
Service providers and moderation
Experimental avatar generation is optional and may be unavailable because of usage limits, credits, or provider capacity. After you explicitly agree in the photo editor, Atrium sends the whole selected photo, resized on your device with metadata removed, and a fixed illustration prompt to OpenRouter and Google AI Studio (Nano Banana 2) to create a cubist portrait. The source photo is held in request memory, not added to Atrium’s media storage or history by generation. The generated preview stays on your device until you save it as your profile avatar, when the normal private avatar storage and deletion rules apply. The source photo and generated result are handled by OpenRouter and Google under their own privacy and retention terms; Atrium cannot promise their deletion or zero retention. You may instead use the built-in shapes or upload an ordinary avatar without generation. Atrium keeps a private daily attempt count and short-lived generation lock, without the photo or prompt, to limit experimental usage.
Atrium Town uses Cloudflare to run the service, store uploaded media, and carry calls; a database provider for account data; Google and Apple for optional sign-in; and Resend for sign-in and invitation emails. When device notifications are configured and enabled, browser push services or Firebase Cloud Messaging carry alerts. A push notification may contain a short message preview if the recipient's and space's settings permit it. A browser's push subscription belongs to one account: signing out ends it and removes the alerts it delivered, and Atrium replaces it when a different account signs in or when it opens in a browser that is no longer signed in. Providers receive information needed to perform these services, subject to their applicable terms and data-handling arrangements.
Atrium Town checks a person's early posts with local spam rules and OpenAI's Moderation API. Submitted text and the full bytes of photos in scanned posts may be sent to OpenAI for safety scores before publication. Later posts may skip that remote check once the poster has earned a trusted rating. A report or suspicious behavior can cause further review. Atrium Town's operators may examine reported or held content, including content from private conversations, for safety purposes. Future moderation providers or material changes to these uses will be described here before use. See the Moderation and security policy.
Retention and choices
Messages, documents, account records, and settings remain while needed to provide the service, subject to deletion actions and legal obligations. You can edit or delete your messages where the service permits, change notification settings, and use available space access controls. To delete your account, open Your profile, choose Account settings, and then choose Delete account. See the account deletion policy. A recent sign-in and a confirmation are required. The request permanently closes account access and removes sign-in records and the personal profile; private operator cleanup removes associated posts, uploads, document contributions, history and other personal data within 30 days. The app shows a private receipt with the deadline and completion status, accessible without signing in. Your personal space is deleted. Shared spaces remain for other members; references that need an anonymous identity use “Former neighbor.” Minimal permanent identifiers prevent reuse of a deleted identity. Only records required by law may be preserved beyond deletion. Apple tokens held by Atrium are revoked with retries; older Apple accounts without a usable token receive instructions to disconnect Atrium in Apple Account settings, without delaying deletion. Contact hello@atrium.town for access to or correction of account information.
When a photo is removed from a message, its normal media path is removed during background cleanup. Ordinary deleted photos are scheduled for private retention for seven days. Flagged, reported, or moderation-hidden photos are scheduled for private retention for 30 days for safety review. Cleanup runs hourly, so erasure may follow the scheduled deadline. A legal preservation requirement may require a different period. Atrium Town cannot erase copies readers have already saved or cached.
App sign-in links
Links to spaces on atrium.town can open the installed phone app. Company subdomains do not share this sign-in flow. A link alone does not grant access to private space content. Native email sign-in links expire after 15 minutes, can be used once, and must be opened on the phone that requested them. The app keeps the pending email address, destination and a random request value in device secure storage until sign-in, cancellation, replacement or expiry; expired requests are removed when next read. The emailed verification credential is held in memory while completing sign-in, and the app session is kept in device secure storage rather than in a link. Email codes remain available when link handoff is unavailable.
Invitations
Anyone holding a valid invitation link can see the space’s name and description before joining, including for private spaces. The creator can add a personal note and choose whether the invitation also displays their public display name; their email is not shown. Email lists are validated and deduplicated before sending; each recipient receives a separate email without the other addresses. The list stays in the sender’s form for delivery and retries and is not stored in the space. A note on a shared link is visible to anyone holding that valid link and is included when the invitation is emailed. QR codes encode the same link and are generated on your device without sending it to a QR provider. Sharing uses your device’s share sheet or copies the link. Revoked, expired, and exhausted invitations stop showing this preview to non-members. An unavailable link can explain that it has expired or run out of uses without showing the space’s details. An invitation preview does not grant access to messages, files, member lists, or other space content.
Invitations sent to an existing @username are addressed to that account’s stable ID and appear in its private inbox. Only that account can accept; a username change does not transfer the invitation. The inbox stores an invitation reference and fetches its name, description, inviter and note from the space after checking that it is still valid. Accepting grants membership; declining or dismissing does not. These invitations do not generate push alerts. Blocked senders’ invitations are hidden and cannot be accepted through the inbox while blocked. Space invitation managers can see recipient names and whether their invitations were accepted or declined. Direct invitations are limited to one open invitation per recipient per space, with at least a day between sends. Revocation closes the invitation but does not remove existing members.
Atrium remembers an unfinished invitation in the current browser tab, or on the phone app’s device, for up to 30 days so it can resume after sign-in or reopening. The saved invitation is removed when accepted or dismissed, and its validity is checked again before joining. When a Google Play installation link is offered on an invitation page, that link passes the invitation code to Google Play. The Android app can retrieve it once through Google Play’s Install Referrer service and restore the invitation during onboarding, provided the link was clicked within the past 30 days. This does not accept the invitation automatically. Atrium does not use the referrer for advertising attribution, fingerprint matching, or clipboard access. An App Store installation does not automatically transfer an invitation; reopening or pasting the link restores it on either platform when an automatic handoff is unavailable.
Phone app sessions
The phone app asks you to sign in before entering your workspace. You can preview an invitation before signing in; public browsing remains available on the website. It keeps its session credential in the device’s secure credential storage and uses a random guest identifier for guest activity. The app sends these only to Atrium, with each request and when it opens a live connection. Signing out revokes the app session and removes its local credential. The app loads private photos and files with its own credential, subject to your current access, and bypasses the WebView’s HTTP cache for these requests. Its reusable in-memory photo cache expires entries after at most five minutes and clears them when you sign out or switch accounts; unfinished photo loads from the previous session are discarded. A photo already displayed may remain visible until its view is closed or refreshed. A photo or file you open to share or save is copied to the app’s cache on your device, replacing the one opened before it. Existing browser media caches can retain a copy for up to five minutes.
Security, changes, and contact
Atrium uses access checks for private content and limits moderation evidence to authorized operators. No online service can guarantee absolute security. Service providers may process information in countries other than your own. Atrium Town will update this policy when practices change, give notice of material changes when practical, and change the last-updated date at the same time. Privacy questions can be sent to hello@atrium.town.
Last updated: