Privacy Policy

The short version

We collect what we need to help you find experiences that fit, match you with people and trips worth your time, and stay in touch if you want us to. We don't sell your data. You can delete your account any time and we'll actually delete it.

The rest of this page is the long version. Here's what's in it.

1. What we collect

When you use AtLost, we collect the following:

• Account info: your name, email, phone number, and the password-less token we use to sign you in.
• Onboarding responses: what you tell us about your professional stage, life transitions, interests, companions, communities, and past experiences. This is how matching works.
• Activity on the platform: experiences you save, review, recommend, and the people you follow.
• Device & usage: browser type, IP address, pages visited, referrer URL, and the UTM parameters on the link that brought you here.
• Optional extras: profile photo, bio, voice intake recordings (only if you start one), and anything you write into reviews or notes.

2. How we use it

• To match you with experiences that actually fit where you are.
• To show you recommendations from people you trust and founders walking similar roads.
• To send you email or SMS you asked for (sign-in codes, trip reminders, occasional updates you opted into).
• To understand how the product is being used so we can make it better.
• To keep the platform safe and functional (anti-abuse, debugging, legal compliance).

3. Cookies & tracking

AtLost uses cookies and similar technologies for three reasons: keeping you signed in, remembering preferences, and understanding how people use the site. You can decline non-essential cookies via the banner at the bottom of the page when you first visit — we'll respect that for analytics and marketing tools, but essential cookies (the ones that keep you logged in) have to stay on for the site to work.

4. Third-party services

We use a handful of vendors to make AtLost work. Each has access to only what they need:

• Google Tag Manager & analytics tools (PostHog): understand page views and funnels. Anonymized where possible.
• Twilio: sends SMS verification codes.
• Loops: sends transactional and opt-in marketing email.
• Vapi: powers optional voice intake calls.
• Anthropic, Together AI, Gemini, Exa: process onboarding responses and public experience descriptions to generate recommendations and summaries. We don't send these providers your private notes, reviews, or direct messages.
• Fly.io & AWS: hosting and storage for the platform itself.

We pick vendors who take privacy seriously, and we don't hand your data to anyone outside of what we need to run the product. We do not sell your personal data — full stop.

5. Your rights

Wherever you live, you can:

• See what we have on you.
• Ask us to correct anything that's wrong.
• Ask us to delete your account and everything tied to it.
• Opt out of marketing email at any time (every marketing email has an unsubscribe link).
• Withdraw consent you previously gave, at any time.

If you're in the EU/UK, you also have GDPR rights to portability and to object to processing. If you're in California, you have CCPA rights to access, delete, and opt out of "sales" (which we don't do anyway). Email [email protected] and we'll make it happen — usually within 30 days.

6. How long we keep it

While your account is active, as long as we need it to run the product. If you delete your account, we anonymize or remove your personal data within 30 days, except for records we're legally required to keep (e.g., tax/payment records, if applicable).

7. Kids

AtLost isn't for anyone under 18. We don't knowingly collect data from children, and if we learn we have, we'll delete it.

8. Changes to this policy

If we change anything material, we'll update the "last updated" date above and, for significant changes, let you know by email. The latest version always lives at this URL.

9. Contact

Questions, requests, complaints, or you just want to talk through something:
[email protected]