Privacy policy

Reside Atlas is an independently operated directory and experience-report platform for intentional communities. This policy says what personal data we collect, why, who can see it, how long we keep it, and what you can ask us to do. It applies to resideatlas.com and to the email we send. We collect as little as the work allows. We never sell personal data, we never use it for advertising, and we never give it to the communities we list.

Last updated 16 September 2026.

Reading the site. You do not need an account to read anything. Our hosting provider keeps standard server logs, which include the address your device connects from and the pages requested, for a short period for security and operation. We do not run analytics and we do not use advertising or tracking cookies.

When something breaks. An error report goes to our error-monitoring service with technical details: the page, the type of browser, and the error. Before it leaves our servers we remove your identity, cookies, connection address and any sign-in tokens from it.

Cookies. When you are signed in, our authentication provider sets session cookies so you stay signed in. During sign-in, a cookie holds the page to return you to for fifteen minutes. That is all.

Creating an account. Signing in is by email link; there is no password. To create and run your account we collect:

• Your email address, used to send the sign-in link and to write to you about your own reports, claims and purchases. Our authentication provider holds it; our own records hold a one-way hash of it, used to detect duplicate accounts, and an encrypted copy so staff can reach you.
• Your first name, last name and phone number. These are required and stored encrypted. Staff use them for one purpose: to reach you, by email or phone, when verifying who you are for a report or a claim.
• The time you accepted the terms. You must be 18 or older to hold an account.

Our authentication provider also records the connection address and browser of each sign-in, as authentication services do.

Writing an experience report. We collect your relationship to the community, its dates and how precisely you want them shown, the report itself, your ratings, your current affiliation if any, and how you want the byline shown. Reports are published under a pseudonymous byline made of the relationship and dates. Your name appears only if you choose a display name. To verify your relationship, staff will ask for evidence such as a lease, a dues record, a booking or an application decision, and may ask for your legal name or a short interview. Evidence files go to a private store, are checked for malware, and are seen by staff only. They are destroyed thirty days after the final decision. A fingerprint of each file is kept to detect repeat fraud, and staff keep a record of the method, the decision and their notes. A legal name, if asked for, is stored encrypted.

Claiming a community's page. We collect the role you hold, the basis of your authority, the way you will verify it, and the evidence for that. Staff see these. If the claim is approved, your account is linked to the community. Readers see that the page is claimed; they do not see who claimed it.

Requesting a correction. We collect the fact you are correcting, what you say it should be, and a public address where it can be checked. You can do this without an account. If you are signed in, the request is linked to your account so you can follow it. An accepted correction appears in the community's change log without your name.

Buying the feasibility model. Payment is handled by Stripe. We never see or store card numbers. We keep the order: what was bought, when, its status and the amount, and the entitlement it grants. Stripe's own privacy policy applies to the payment itself.

Email we send. Only what your own activity needs: the sign-in link; word that your evidence arrived, that your report is published or needs more, or that a community responded; and, if you claim a page, that your claim was received, approved or not approved, and that a new report was published on it. Purchase receipts come from Stripe. We do not send marketing email.

Who can see what. Readers and communities see published reports under their bylines, published facts and their sources, and change logs. Communities also see their own claims and responses. Neither readers nor communities ever see your email, phone, name, or evidence, unless you chose to show a display name. Staff see identity and contact details and evidence, only to verify and moderate, and every staff action on your content is written to an audit log with the reason.

Service providers. These companies process data on our behalf, under their own security commitments: Supabase (database, authentication and file storage), Vercel (hosting), Resend (email delivery), Stripe (payments), Sentry (error reports), and Cloudflare (domain and email routing). We do not use data brokers or advertising networks.

How long we keep things. Your account details, for as long as your account exists. Verification evidence, thirty days after the final decision. Published reports stay, because they are the record. Orders, for as long as accounting requires.

Deleting your account. Email us from your account address and we will delete it. You can also delete it yourself from your account page. Your name, phone and email are destroyed. Your published reports remain under their bylines. The one-way hash of your email is kept so that a deleted account cannot be recreated to file a duplicate report.

Your rights and choices. You can see and change your name and phone on your account page at any time. You can ask for a copy of the data we hold about you, for corrections, or for deletion, by emailing hello@resideatlas.com from your account address. You can also download a copy from your account page. We answer within thirty days. Depending on where you live, the law may give you further rights over your data; the same address handles those requests.

Why we are allowed to use your data. Where the law asks us to name a basis: we process account details, reports, claims, corrections and orders to provide the service you asked for; we verify relationships, prevent duplicate accounts, keep audit logs and protect the site under our legitimate interest in an accurate and safe record; we keep order records because accounting law requires it; and where consent is the basis, such as choosing to show a display name, you can withdraw it by changing the setting or asking us.

Where your data is processed. Reside Atlas is operated from the United States, and our providers process data there and in the countries where they operate. If you use the site from elsewhere, your data is transferred to the United States and protected as this policy describes.

Children. The site is for adults. You must be 18 or older to create an account, and we do not knowingly collect personal data from anyone younger. If you believe someone under 18 has an account, tell us and we will delete it.

Security. Identity and contact fields are encrypted at rest. Access to every record is enforced in the database itself, not only in the application. Staff sign in with a second factor. Evidence lives in private storage reached only through short-lived links. Personal data is kept out of logs, analytics and error reports. No system is perfect; if you find a problem, tell us at hello@resideatlas.com.

Changes to this page. When our handling of data changes, this page changes with it, and the date at the top moves.

Contact. Questions about privacy: hello@resideatlas.com. Legal notices: legal@resideatlas.com.