atproto.svebcomponents.dev
Privacy
This page covers the hosted atproto-comments bridge — the service that handles sign-in, posting, and live updates for comment sections built with atproto-comments. It is written for two audiences: people who read or comment on a site using it, and people who run such a site.
The short version
- Your comments are never stored here. Replies, likes and reposts are written straight to your own ATProto repository through your own provider. The bridge passes them along and keeps no copy.
- If you don't sign in, the bridge usually never hears from you. On a default installation, a signed-out reader's browser makes no request to this service at all.
- Signing out actually signs you out. It ends your session and revokes the bridge's authorization to act on your account.
- No advertising, no analytics, no profiling, no sale of data.
Who is responsible
The bridge is operated by Theodor Baltus Steiner. For anything on this page, write to svebcomponents@theosteiner.de; that mailbox is monitored and is the fastest way to reach a person.
Under the GDPR, the operator of a site that embeds the component and the operator of this bridge are likely joint controllers for the data that reaches the bridge from that site — the site decided to embed it, this service receives the result. The essence of that arrangement is set out in For site operators below.
What the bridge receives, and when
If you only read comments
On a default installation (live="signed-in") nothing is sent
to this service. Comments are fetched from the Bluesky AppView, or
rendered by the site's own server before the page reaches you.
A site can choose to switch live updates on for everyone (live="all"). Where it has, your browser holds an open connection to this service
for as long as you're on the page, and we receive your IP address, your browser's user agent,
and which discussion thread you are reading. That is enough
to infer which page you're on. It is not used to build a profile and is not
combined with anything else. Sites are asked to disclose this; if you'd rather
not be included, this connection is what a site's consent banner should be controlling.
If you sign in
To let you post from the page, the bridge stores:
- your DID, handle, display name and avatar URL — the public parts of your ATProto profile;
- the website you signed in on, so a session for one site cannot be used on another;
- an authorization token set from your provider, which is what allows the bridge to post as you when you ask it to;
Your password never reaches this service. Sign-in happens on your own provider's site, and the bridge only ever receives the authorization that results from it.
What is counted
The service keeps running totals so its operator can see how much it is being used: how many websites use it, and how many sign-ins, replies, reactions and live connections there have been, grouped by website and by day. These are counts about sites, not about people — there is no visitor count, because counting distinct people would need an identifier per person and that is precisely what is not kept.
The totals are published in full on the front page, without the list of which sites they came from.
What is never collected
No comment text, no cookies for advertising or analytics, no tracking across sites, no data about you from anywhere other than the requests your browser makes and the public profile attached to the account you sign in with.
Why — the legal bases
| What | Why | Basis (GDPR Art. 6) |
|---|---|---|
| Sign-in, sessions, posting | You asked to sign in and post; it cannot work otherwise | (b) performance of a service you requested |
| Live updates for signed-in readers | Part of the service you signed in to | (b), and (f) legitimate interests |
| Live updates where a site enabled them for everyone | Delivering a feature the site chose, in a way that keeps the data minimal | (f) legitimate interests — or consent, where the site collects it |
| Counting sites and actions | Knowing how much the service is used and whether it is coping. Counts websites, not people | (f) legitimate interests |
| Diagnostic output (crashes, restarts) | Knowing when the service is broken. Contains no visitor data — see below | (f) legitimate interests |
Where a site's consent banner controls the comment section, that consent governs. You can object to processing based on legitimate interests at any time — see Your rights.
How long it is kept
| Data | Kept for |
|---|---|
| Browser session | 1 hour, renewed while you're active; deleted on sign-out |
| Authorization token set | Until you sign out, or 30 days unused — whichever comes first |
| Pending sign-in state | 10 minutes |
| Sign-in handoff record | 2 minutes, and deleted the moment it is collected |
| Live-update connections | Held in memory only, for the length of the connection. Nothing is written to disk. |
| Request and access logs | None are kept. The service writes no access log, and no IP address is ever written to disk. |
| Operational counters | Kept indefinitely. One row per embedding site per day holding counts — no IP address, user agent, thread, or per-reader record. |
| Diagnostic output | Crash and restart messages go to the system journal and are discarded after 30 days. They contain no visitor data. |
Who else is involved
- Your ATProto provider (PDS). Sign-in happens there and your posts are written there. Its own policy governs.
- Bluesky. Public comment content and profile pictures are fetched from the Bluesky AppView and CDN. Because avatars load directly in your browser, Bluesky receives your IP address when a comment section renders — whether or not you sign in, and whether or not live updates are on. This is inherent to displaying ATProto content and is not something this service mediates.
- Microcosm Spacedust. The bridge subscribes to this public firehose to learn when a reply appears. It is told which threads are being watched. It is not told anything about you — your browser never contacts it.
- exe.dev, hosting. Runs the server, and so processes data on the operator's behalf. Requests reach the server through exe.dev's own edge, which may record ordinary connection metadata under its own policy — that layer is outside this service's control.
No data is sold, shared for advertising, or handed to anyone else except where the law requires it.
Where the bridge runs
The service is operated from Japan and the server runs in Tokyo, Japan.
Japan is recognised by the European Commission as providing an adequate level of data protection, so personal data reaching this service from the EU or EEA does not depend on Standard Contractual Clauses or any additional safeguard.
Your rights
If you are in the EU, EEA or UK you have the right to access a copy of your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable form, and withdraw consent where consent was the basis. Exercising any of these costs nothing and will not make the service worse for you.
The fastest route is the sign-out button. It deletes your session and revokes the bridge's authorization on your account in one step. To have anything else removed, write to svebcomponents@theosteiner.de — please include the handle or DID you signed in with.
Deleting a comment is different: your replies live in your own repository, not here, so delete them the way you would any other post, from your ATProto client. Nothing needs to be asked of this service.
You can also complain to a supervisory authority — in the EU, the one for the country you live or work in.
This service is operated from Japan and is also subject to the Act on the Protection of Personal Information (APPI). If you are in Japan, requests to disclose, correct, or stop using your personal information go to the same address, and the purposes it is used for are the ones set out under the legal bases. Nothing is provided to a third party except as described under who else is involved.
For site operators
If you embed <atproto-comments> pointed at this bridge, you
are making a decision about your readers' data, and in the EU that most likely
makes you a joint controller with the bridge operator for what reaches it from
your site.
- Keep the default. With
live="signed-in", signed-out readers never contact this service, and the readers who do have opted in by signing in. This is the configuration with the least for you to disclose. - If you set
live="all", say so in your privacy policy: readers' IP addresses go to this service, and link here. Consider wiring theliveattribute to your consent banner instead — it can be changed at runtime and takes effect immediately. - Mention Bluesky either way. Avatars load from Bluesky's CDN for every reader regardless of configuration.
- Self-host to avoid all of this. Point
serviceat your own deployment and no third party is involved. See running your own. - Need a written arrangement? Write to svebcomponents@theosteiner.de and one can be provided.
Changes
If what the service collects changes, this page changes with it and the date at the top moves. Material changes will be noted in the project's release notes so they show up where developers will actually see them.