What apps can reach

An app runs on a card, in a frame walled off from the rest of Atomics. It can use only what it asked for when it was added, and Atomics checks that on every call. Here is what that means.

The apps there are

Seven apps run today: Colour Lab, Quick Poll, Quick Check, Focus Timer, Transcribe, Paddle and Flashcards. All seven are made by Atomics and free. The other apps in the marketplace are sample listings.
Add one from the Apps panel in a space, or from the marketplace. It arrives as a card on the board, and double-clicking the card lets you work in it.

What an app can’t reach

Your account and this site. The frame has no origin of its own, so the app can’t read your sign-in, your cookies or this site’s storage, and it can’t take the page you’re on somewhere else or open new windows.
The rest of the board. It can’t see other cards, or files you haven’t given it. It sees its own card and what you hand it, and a card locked after you gave it is refused.
The internet. It can’t reach the internet itself. When an app needs a large file, such as Transcribe’s speech model, Atomics downloads it from the address the app lists, checks it against the fingerprint the app lists, and hands it over.
Your devices. It can’t ask for your passkeys, payments, camera, microphone, screen, location or clipboard. The browser refuses them before the app can ask you.

What an app can be allowed

Each app lists what it needs, and its page in the marketplace shows that list. These are all there are:

Keeps its own data on its card, where everyone in the space sees it
Counts the people in the space
Sees the names of the people in the space
Reads the files you give it
Reads the tables and lists you give it, and follows them as they change
Adds cards to the board
Writes text onto the cards you give it, for search and the assistant
Sends recordings you give it to our transcription service, in synced spaces
Downloads the large files it needs, such as a speech model, once, and keeps them on this device

Atomics checks the permission on every call the app makes, not just when it opens.

What everyone in the space sees

An app keeps its data on its own card, so anyone who can see the space can read that data, including what the app doesn’t show.
Quick Poll can hide results until it closes. That hides them from view, not from someone who looks, and the poll says so. It shows votes without names unless the person who asked turns names on.

Transcribe and your recordings

In a synced space. Transcribe sends the recording you give it to our transcription service, which runs Whisper on Cloudflare Workers AI, where the recording is already stored. A long WAV or MP3 recording is cut into pieces of up to 8 MB, up to 48 of them, and each piece costs one of your credits. A recording in another format goes whole, up to 24 MB.
In a space kept on this device. It runs on your device, and the recording doesn’t leave it. The first time, it downloads a 66 MB speech model, English only, and keeps it, so after that it works offline.
Either way, the transcript goes onto the recording, where search and the assistant can find it, and onto a note beside it if you ask.

Where apps come from

Apps are files we serve from this site. Atomics checks each one against its fingerprint before it runs, so a file that has been changed doesn’t open. Once an app has opened, it’s kept on this device, so it opens offline too. Like the rest of Atomics, that check runs in code we send to your browser, so it protects you from a changed app file, not from a changed version of Atomics itself.

See the apps in the marketplace