ATOM account data flow
Version: public-account-2026-10-17

1. Website to account service
The website offers fixed HTTPS navigation to sign-in, registration, billing and device approval on the configured account service. It does not forward visitor-supplied return URLs, passwords or device codes. Navigation alone starts no payment and approves no device.

2. Browser and account storage
Account inputs are submitted to the account service in request bodies. The service processes usernames, passwords or recovery inputs, policy consent, cookie/session or passkey authentication and abuse-limit metadata. Storage holds salted password verifiers, recovery/session digests, passkey public-key metadata, consent versions/timestamps and security history. Browser cookies, tab session storage and temporary account-link authorization have distinct roles. Password sign-in is not passkey authentication.

3. Checkout and billing
The account service supplies a configured Lemon Squeezy checkout link with signed account and offer references. The browser enters payment information at the provider. Lemon Squeezy sends signed webhook messages to ATOM; after verification ATOM retains normalized billing facts, identifiers, digests and provenance. Raw messages can contain additional provider metadata. Paid access requires the appropriate account, current policy consent and verified eligible billing authority. A checkout redirect does not grant access.

4. Installation approval and entitlements
The plugin and account service exchange a device-binding identifier, device/user authorization codes and scoped authorization results. Explicit browser approval links the installation to the same account. The service issues signed activation/refresh entitlements; the plugin verifies them locally. Main account storage retains signed documents and activation/replay history. The licensing fields exclude repository contents, source code, prompts, diffs, local coordination receipts and build reports.

5. Private recovery custody
The main authority sends schema/state/table hashes, counts, monotonic floors, target/operation metadata and a platform bookmark through a private service binding to a separately keyed recovery custodian. The custodian keeps signed receipt/pending metadata, not the underlying account/password/payment rows. Main storage and separate backups can still contain account verifier, session and billing data. Recovery eligibility does not schedule their deletion or prove that a restore has been performed.

6. Optional website analytics
Only opted-in public-page events go to the website's same-origin analytics endpoint and separate Cloudflare D1 storage. Stored fields are closed public-page/event/referral/device categories and a day-bound browser-token hash. Account routes and account/license/payment fields are excluded from this projection. Host request/security metadata and backups are separate. Application expiry, opportunistic cleanup and withdrawal of analytics consent have different effects; see the privacy notice.

Publisher: Austin Peppers, individual. Privacy/support: Peppera091@gmail.com. Do not send credentials, payment details, license identifiers, repository contents or raw diagnostic files.