MentAtlas Privacy Policy
MentAtlas helps you remember the people you know, how you met and who connects to whom. It is built so that your contacts stay yours.
The short version
- Your contacts are stored on your phone, sealed with AES-256-GCM encryption before they are saved.
- The encryption key is protected by your passphrase or recovery key. Fingerprint or face unlock is optional.
- No MentAtlas sign-up: the beta has no account of its own to create.
- No ads, no tracking, no analytics in the app itself.
- Encrypted backups go only to a cloud drive you choose. CSV and vCard exports are plain files, yours to keep safe.
- If you request an invite on our website, we store that email only to send your invite, keep it for up to 90 days, and delete it on request.
What MentAtlas keeps, and where
Everything you add (names, numbers, notes, cities, how people are connected, your own card) is stored on your phone. Each record is sealed with AES-256-GCM encryption under a random master key before it is saved, so the database stores your contact records only as encrypted content. The master key itself is stored only in protected form: wrapped using your passphrase (PBKDF2-SHA256, 600,000 rounds) or your recovery key, or, if you turn on fingerprint or face unlock, a secret held by your phone's keystore.
The beta has no MentAtlas sign-up and no MentAtlas account to create. The features that connect to the internet - optional Google sign-in, Drive backup and Google Contacts import, and map tiles - are each described below.
MentAtlas is built to work offline: you can add and edit people with no internet connection.
Permissions we ask for
- Contacts
- Only when you choose to bring phone contacts in, or to save a person to your phone's contacts.
- Camera
- Only when you scan a business card. The card's text is read on your phone with on-device text recognition; the image is not uploaded for this.
- Fingerprint or face
- An optional, quicker way to unlock MentAtlas without typing your passphrase; unlocking uses a secret held by your phone's keystore. Your fingerprint or face data stays with your phone's system and is never given to us.
Backups, exports and Google sign-in
If you turn it on, MentAtlas can save an encrypted backup to a cloud drive you connect, or as a backup file you keep wherever you like. The backup is made from the already-encrypted records together with a protected copy of the key: its contents are ciphertext. Restoring needs your passphrase or recovery key.
Google Drive is the cloud drive supported in this beta.
Exports are different. CSV files, vCard (.vcf) files and contacts you save into your phone's own contacts app are ordinary, unencrypted files. Keep them as safe as you keep your phone.
Signing in with Google is optional. It is used only for the features you choose, such as Drive backup or bringing in your Google Contacts, and may pass through an Expo-hosted sign-in redirect (auth.expo.io) used by the toolkit MentAtlas is built with. For Google Drive, MentAtlas can see only the backup files it creates and files you explicitly open or share with it. MentAtlas does not use your Google data for anything else.
The map
Map tiles come from OpenFreeMap, built on OpenStreetMap. To draw the map, your phone requests the tiles for the area on screen from their servers; as with any map or website request, that includes your IP address and the area you are viewing. The pins for your people are drawn on your phone from your own records and are not part of any map request.
Calls and messages
When you tap Call, Message or WhatsApp, MentAtlas opens your phone's own app. Notes you add afterwards are saved in MentAtlas only.
Deleting your data
You can delete your contacts, your card and the app's settings from this phone at any time from Me → Security → Delete everything on this phone. That also removes the keys protecting your data. The app's owner identifier and setup name remain in the phone's secure storage until you uninstall the app. Files you exported stay where you saved them, and backups in your own cloud stay there until you delete them.
Children
MentAtlas is not made for children under 13.
Requesting an invite on our website
If you enter your email address in the invite form on mentatlas.com, we store that address (kept for up to 90 days, and deleted on request) solely to send your invite. Our hosting provider, Cloudflare, may briefly process your IP address to prevent abuse; we do not store it.
Changes and contact
If this policy changes, we will update this page and the date at the top. Questions: gobindsrivatsa@gmail.com