Privacy

The short version

• Your comments are never stored here. Replies, likes and reposts are written straight to your own ATProto repository through your own provider. The bridge passes them along and keeps no copy.
• If you don't sign in, the bridge usually never hears from you. On a default installation, a signed-out reader's browser makes no request to this service at all.
• Signing out actually signs you out. It ends your session and revokes the bridge's authorization to act on your account.
• No advertising, no analytics, no profiling, no sale of data.

Who is responsible

The bridge is operated by Theodor Baltus Steiner. For anything on this page, write to svebcomponents@theosteiner.de; that mailbox is monitored and is the fastest way to reach a person.

Under the GDPR, the operator of a site that embeds the component and the operator of this bridge are likely joint controllers for the data that reaches the bridge from that site — the site decided to embed it, this service receives the result. The essence of that arrangement is set out in For site operators below.

What the bridge receives, and when

If you only read comments

On a default installation (live="signed-in") nothing is sent to this service. Comments are fetched from an AppView — Bluesky's public AppView unless the site sets another — or rendered by the site's own server before the page reaches you.

A site can choose to switch live updates on for everyone (live="all"). Where it has, your browser holds an open connection to this service for as long as you're on the page, and we receive your IP address, your browser's user agent, and which discussion thread you are reading. That is enough to infer which page you're on. It is not used to build a profile and is not combined with anything else. Sites are asked to disclose this; if you'd rather not be included, this connection is what a site's consent banner should be controlling.

If you sign in

To let you post from the page, the bridge stores:

• your DID, handle, display name and avatar URL — the public parts of your ATProto profile;
• the website you signed in on, so a session for one site cannot be used on another;
• an authorization token set from your provider, which is what allows the bridge to post as you when you ask it to;

Your password never reaches this service. Sign-in happens on your own provider's site, and the bridge only ever receives the authorization that results from it.

If an app asks for more than commenting

The operator can let a few named apps ask for more than commenting, for example to show you your own feeds. You approve this separately: the bridge's sign-in page lists what the app asks for, and your provider's approval screen shows the app's name. If you approve, then at that app's request the bridge can:

• read your feeds and Following timeline through your provider and pass them to the app. Nothing it reads is stored or logged. A timeline can reveal who you follow and what you see;
• ask your provider for a short-lived token, valid for 60 seconds, that proves to the app's own server which account you are. Your provider signs it; the bridge holds no key for this.

This access lives in a separate authorization that only the approved app can use. Other sites using the bridge never get it, and signing out of the app revokes it.

What is counted

The service keeps running totals so its operator can see how much it is being used: how many websites use it, and how many sign-ins, replies, reactions and live connections there have been, grouped by website and by day. These are counts about sites, not about people — there is no visitor count, because counting distinct people would need an identifier per person and that is precisely what is not kept.

The totals are published on the front page, without the list of which sites they came from.

What is never collected

No comment text, no cookies for advertising or analytics, no tracking across sites, no data about you from anywhere other than the requests your browser makes and the public profile attached to the account you sign in with.

Why — the legal bases

Where a site's consent banner controls the comment section, that consent governs. You can object to processing based on legitimate interests at any time — see Your rights.

How long it is kept

Who else is involved

• Your ATProto provider (PDS). Sign-in happens there and your posts are written there. Its own policy governs.
• An AppView — Bluesky's by default. Public comment content and profile pictures are fetched from an AppView and its CDN. Because avatars load directly in your browser, that AppView receives your IP address when a comment section renders — whether or not you sign in, and whether or not live updates are on. Sites choose which AppView via the component's appview property; unset, it is Bluesky's public AppView. This is inherent to displaying ATProto content and is not something this service mediates.
• Apps you approve for extra access. They receive the feeds, timeline and account tokens they request, as described above. Their own policies govern what they do with them.
• Microcosm Spacedust. The bridge subscribes to this public firehose to learn when a reply appears. It is told which threads are being watched. It is not told anything about you — your browser never contacts it.
• exe.dev, hosting. Runs the server, and so processes data on the operator's behalf. Requests reach the server through exe.dev's own edge, which may record ordinary connection metadata under its own policy — that layer is outside this service's control.

No data is sold, shared for advertising, or handed to anyone else except where the law requires it.

Where the bridge runs

The service is operated from Japan and the server runs in Tokyo, Japan.

Japan is recognised by the European Commission as providing an adequate level of data protection, so personal data reaching this service from the EU or EEA does not depend on Standard Contractual Clauses or any additional safeguard.

Your rights

If you are in the EU, EEA or UK you have the right to access a copy of your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable form, and withdraw consent where consent was the basis. Exercising any of these costs nothing and will not make the service worse for you.

The fastest route is the sign-out button. It deletes your session and revokes the bridge's authorization on your account in one step. To have anything else removed, write to svebcomponents@theosteiner.de — please include the handle or DID you signed in with.

Deleting a comment is different: your replies live in your own repository, not here, so delete them the way you would any other post, from your ATProto client. Nothing needs to be asked of this service.

You can also complain to a supervisory authority — in the EU, the one for the country you live or work in.

This service is operated from Japan and is also subject to the Act on the Protection of Personal Information (APPI). If you are in Japan, requests to disclose, correct, or stop using your personal information go to the same address, and the purposes it is used for are the ones set out under the legal bases. Nothing is provided to a third party except as described under who else is involved.

For site operators

If you embed <atproto-comments> pointed at this bridge, you are making a decision about your readers' data, and in the EU that most likely makes you a joint controller with the bridge operator for what reaches it from your site. Embedding a widget that calls a third party makes you a joint controller for what it sends (Fashion ID, C-40/17), and IP addresses are personal data (Breyer, C-582/14). The default keeps signed-out readers out of scope entirely.

• Keep the default. With live="signed-in", signed-out readers never contact this service, and the readers who do have opted in by signing in. This is the configuration with the least for you to disclose.
• If you set live="all", say so in your privacy policy: readers' IP addresses go to this service, and link here. Or wire the live attribute to your consent banner instead — it can be changed at runtime and takes effect immediately, in both directions.

  const comments = document.querySelector("atproto-comments");
  comments.live = "off";
  onConsent((granted) => (comments.live = granted ? "all" : "off"));

• Mention the AppView either way. Avatars load from the AppView's CDN for every reader regardless of configuration — Bluesky's unless you set appview.
• Self-host to avoid all of this. Point service at your own deployment and no third party is involved. See running your own.
• Need a written arrangement? Write to svebcomponents@theosteiner.de and one can be provided.

Changes

If what the service collects changes, this page changes with it and the date at the top moves. Material changes will be noted in the project's release notes so they show up where developers will actually see them.